joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ca60
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
xchg rbx, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
nop
sub rsp, 8
mov qword [rsp], r14
sub rsp, 0x30
xchg rsi, rcx
mov rcx, rsi
xchg rcx, rsi
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg rbx, r10
mov qword [rsp + 0x40], r10
xchg rbx, r10
add rcx, 0xc8
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x14c21a7a
sub dword [rsp + 0x20], 0x31a625f
sub dword [rsp + 0x20], 0xad92f84
add dword [rsp + 0x20], 0x750739ac
sub dword [rsp + 0x20], 0x21a3aed7
add dword [rsp + 0x20], 0x11ba2d2
sub dword [rsp + 0x20], 0x5b4db636
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b700
test eax, eax
js 0x14002cb1e
cmp qword [rsp + 0x40], rbx
je 0x14002cb1e
lea eax, [rbx + 1]
jmp 0x14002cc50
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002cb62
mov eax, 0x39533efe
xor eax, 0x3160552f
add eax, 0x4e55d9c1
add eax, 0xf1af010
sub eax, 0x13892d21
sub eax, 0x4bf3319a
xor eax, 0xb344548
sub eax, 0xd1393ad
jmp 0x14002cc50
cmp dword [rcx + 0x74], ebx
jbe 0x14002cb9d
mov eax, 0x364dd731
add eax, 0xbac0f77
sub eax, 0x478f890
xor eax, 0x604909be
sub eax, 0x19b5a887
sub eax, 0x3aef8489
add eax, 0x29ff0fb
xor eax, 0x205a42f8
sub eax, 0x2b9ee966
jmp 0x14002cc50
cmp byte [rdi + 2], bl
je 0x14002cbce
mov eax, 0x10b98262
add eax, 0x43d6cbd1
sub eax, 0x430ed404
add eax, 0x6bbbf267
sub eax, 0x321d7a5
sub eax, 0x7315b722
sub eax, 0x705ddcb
jmp 0x14002cc50
cmp r14d, 0xa
jb 0x14002cc15
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cc15
mov eax, 0x5a53b301
add eax, 0x1323446b
sub eax, 0x4a808b90
sub eax, 0x66572b6
add eax, 0x3ded8dae
sub eax, 0xcaa2dc4
sub eax, 0x4dd45908
jmp 0x14002cc50
lea rcx, [rsi + 0xb8]
mov edx, 0xfce1c26
add edx, 0x25bfd173
xor edx, 0x3ebb083a
xor edx, 0x391d0229
add edx, 0x18732229
add edx, 0x4efa8fe6
call fcn.14002c020
jmp 0x14002cc4e
mov eax, ebx
xchg r10, rbx
mov r10, qword [rsp + 0x48]
xchg rbx, r10
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14002da30
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
xchg rbp, rcx
mov rbx, rbp
xchg rcx, rbp
cmp byte [rcx + 6], 0
je 0x14002da62
xor eax, eax
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx + 1], 0
je 0x14002daaa
mov eax, 0x504de674
sub eax, 0x44605780
add eax, 0x701914d5
sub eax, 0x5c40edae
xor eax, 0x42785faf
add eax, 0x20e5d28d
sub eax, 0x44c6414c
sub eax, 0x39dd7af2
add rsp, 0x20
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
je 0x14002dae5
mov eax, 0x7b7c3373
sub eax, 0x60855552
xor eax, 0x4fd074b2
sub eax, 0x25f4a3e9
sub eax, 0x272a7f41
add eax, 0x752e9934
xor eax, 0x7d362099
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
cmp byte [rcx + 4], 0
je 0x14002db2b
mov eax, 0x4b4047cc
add eax, 0x175a0f1e
sub eax, 0x3a6abac4
add eax, 0x49eaf04c
sub eax, 0x524bef04
xor eax, 0x25c741a2
add eax, 0xbb2ca3
sub eax, 0x296134a0
xor eax, 0x1163d4c8
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
mov edx, 0x7bc97e69
sub edx, 0x151c3eb
sub edx, 0x7a6e3546
add edx, 0x50885f56
add edx, 0x19afd87f
add edx, 0xf0e5bd4
sub edx, 0x5ca441b0
sub edx, 0x1cabd72d
mov ecx, dword [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
int3
Function at 0x140033b10
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 0x10], rdi
xchg rbx, rdi
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, r8
mov r8, rbx
xchg rbx, r8
xchg r9, rsi
mov r9, rdx
xchg r9, rsi
mov rbp, rcx
jne 0x140033bc6
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
xchg rdx, rcx
mov rcx, rsi
xchg rdx, rcx
mov rcx, rbp
call fcn.140033b10
xchg rdi, rbx
mov rbx, rdi
xchg rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cc50
mov edx, 0x56fe3da7
xor edx, 0x35d4a696
xor edx, 0x29e6f644
sub edx, 0x3e71baa7
add edx, 0x5cb62167
xor edx, 0x6910d465
xchg rbp, rdi
mov rcx, rbp
xchg rbp, rdi
call fcn.1401fcba8
cmp byte [rbx + 0x19], 0
je 0x140033b56
xchg r13, rdi
mov r13, qword [rsp + 0x30]
xchg rdi, r13
xchg rdx, rbx
mov rdx, qword [rsp + 0x38]
xchg rbx, rdx
xchg rsi, rbp
mov rsi, qword [rsp + 0x40]
xchg rbp, rsi
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033c00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rbp, r8
mov qword [rsp + 0x18], r8
xchg r8, rbp
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r12, rbx
mov r12, r8
xchg r12, rbx
mov rsi, rdx
xchg rcx, rbp
mov rcx, rbp
xchg rbp, rcx
jne 0x140033cb8
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
xchg rdx, r14
mov r14, rsi
xchg r14, rdx
mov rcx, rbp
call fcn.140033c00
mov rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cc50
mov edx, 0xa6a29db
xor edx, 0x5ab0a4e4
sub edx, 0x244737a
sub edx, 0x449e908
sub edx, 0x1696084c
sub edx, 0x290898a
xor edx, 0x31259eb7
xchg r11, rdi
mov rcx, r11
xchg rdi, r11
call fcn.1401fcba8
cmp byte [rbx + 0x19], 0
je 0x140033c4e
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140035930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
nop
mov qword [rsp - 8], rbx
sub rsp, 8
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x30
xchg rdx, r15
mov rdx, r15
xchg r15, rdx
xchg r14, r13
mov r13, rcx
xchg r13, r14
movabs rsi, 0xfffffff0aaf7112
add rsi, 0x51734984
sub rsi, 0x3f5763cf
add rsi, 0x3d8127ea
xor rsi, 0x29e5fefd
sub rsi, 0x12106cbe
add rsi, 0x7fffffff
add rsi, 0x1e66ec72
cmp rdx, rsi
ja 0x140035b6f
mov r12, qword [rcx + 8]
sub r12, qword [rcx]
sar r12, 1
sar r12, 2
sar r12, 1
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 4
xchg rcx, rdx
mov rcx, rdx
xchg rcx, rdx
shr rdx, 1
xchg r14, rax
mov r14, rsi
xchg r14, rax
sub rax, rdx
cmp rcx, rax
ja 0x140035a17
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
xchg r14, rsi
mov qword [rsp + 0x88], r14
xchg rsi, r14
xchg rsi, rdx
mov rsi, rdx
xchg rdx, rsi
xchg r14, rcx
mov r14, rcx
xchg r14, rcx
call fcn.1400539a0
xchg r11, rax
mov r13, r11
xchg r11, rax
mov qword [rsp + 0x28], rax
mov rbx, r12
shl rbx, 3
shl rbx, 1
add rbx, rax
mov qword [rsp + 0x20], rbx
xchg rdi, r15
mov r15, rdi
xchg r15, rdi
sub rdi, r12
xchg r14, rbx
mov qword [rsp + 0x78], r14
xchg rbx, r14
je 0x140035ab2
nop word [rax + rax]
mov byte [rbx], 0x24
sub byte [rbx], 3
xor byte [rbx], 0x53
sub byte [rbx], 0x24
xor byte [rbx], 0x46
sub byte [rbx], 8
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004ba70
nop
add rbx, 0x10
mov qword [rsp + 0x78], rbx
sub rdi, 1
jne 0x140035a81
mov r8, qword [r14 + 8]
mov rdx, r13
xchg rcx, r9
mov r9, qword [r14]
xchg rcx, r9
cmp rcx, r8
je 0x140035afb
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
xchg rsi, rax
mov rsi, qword [rcx + 8]
xchg rsi, rax
xchg r8, rax
mov qword [rdx + 8], r8
xchg r8, rax
mov byte [rcx], r9b
mov qword [rcx + 8], r9
lea rdx, [rdx + 0x10]
add rcx, 0x10
cmp rcx, r8
jne 0x140035ace
mov r9, rsi
xchg r8, r15
mov r15, r8
xchg r15, r8
xchg r13, rdx
mov r13, rdx
xchg rdx, r13
mov rcx, r14
add rsp, 0x30
push rdx
push rax
push rcx
push rax
push rcx
push rcx
xchg qword [rsp + 0x30], r15
pop rcx
pop rcx
pop rax
pop rcx
pop rax
pop rdx
add rsp, 8
push rbx
push rdx
xchg qword [rsp + 0x10], r14
pop rdx
pop rbx
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r13
nop
add rsp, 8
xchg qword [rsp - 8], r12
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp fcn.140052b30
call fcn.14002f900
int3
Function at 0x140035bf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r8, rdi
mov r8, rdx
xchg rdi, r8
mov rbx, rcx
test rdx, rdx
je 0x140035c5b
nop word [rax + rax]
mov byte [rbx], 0x3e
add byte [rbx], 0x10
sub byte [rbx], 6
xor byte [rbx], 0x50
xor byte [rbx], 0x35
xor byte [rbx], 0x3a
add byte [rbx], 0x25
xor byte [rbx], 0x65
sub byte [rbx], 0x59
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004ba70
nop
nop
add rbx, 0x575285da
sub rbx, 0x575285ca
sub rdi, 1
jne 0x140035c1f
mov rax, rbx
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
push rbx
push rcx
push rbx
push rax
push rcx
push rcx
push rax
push rdx
xchg qword [rsp + 0x40], rdi
pop rdx
pop rax
pop rcx
pop rcx
pop rax
pop rbx
pop rcx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14004c230
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x3a
xor byte [rcx + rax + 6], 0x60
add byte [rcx + rax + 6], 0x1c
sub byte [rcx + rax + 6], 0x6a
sub byte [rcx + rax + 6], 0xb
xor byte [rcx + rax + 6], 0xe
add byte [rcx + rax + 6], 0x67
xor byte [rcx + rax + 6], 0x1e
xor byte [rcx + rax + 6], 0x68
inc rax
cmp rax, 8
jb 0x14004c232
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14004c280
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x72
xor byte [rcx + rax + 6], 0x7b
add byte [rcx + rax + 6], 0x4d
xor byte [rcx + rax + 6], 0x36
sub byte [rcx + rax + 6], 0x53
xor byte [rcx + rax + 6], 0x62
xor byte [rcx + rax + 6], 0x5a
add byte [rcx + rax + 6], 0x30
xor byte [rcx + rax + 6], 0x65
inc rax
cmp rax, 0xa
jb 0x14004c282
ret
Function at 0x1400712d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
lea r10, [rsp + 0x3d]
mov r8d, edx
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
test edx, edx
jns 0x14007136e
neg r8d
nop dword [rax + rax]
dec r10
mov eax, 0x695df5a
xor eax, 0x64d394fc
sub eax, 0x414ddc8b
sub eax, 0x203ba004
add eax, 0xecc4e1c
add eax, 0xbd43af9a
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x1400712fa
dec r10
mov byte [r10], SHCreateMemStream
add byte [r10], 0x2a
xor byte [r10], 0x75
add byte [r10], 0x29
sub byte [r10], 0x51
add byte [r10], 0x15
jmp 0x1400713cc
dec r10
mov eax, 0xb63030b
add eax, 0x180170c
add eax, 0x334dca47
xor eax, 0x2affcd42
xor eax, 0x129e6aae
add eax, 0x7760a6e
sub eax, 0x2b80714b
xor eax, 0x18d61805
add eax, 0x803c07fd
mul r8d
shr edx, 2
shr edx, 1
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
neg r8b
add r8b, 0xd0
neg r8b
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x14007136e
lea r9, [rsp + 0x58]
xchg r10, r14
mov rdx, r14
xchg r10, r14
lea r8, [rsp + 0x3d]
xchg rbx, r10
mov rcx, r10
xchg rbx, r10
call fcn.14002ff80
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
add rsp, 0x40
push rdx
push rdx
push rax
push rax
xchg qword [rsp + 0x20], rbx
add rsp, 0x28
ret
Function at 0x140076530
Capabilities:
Encode data using xor

Disassembly:
xchg r9, r11
mov r11, rcx
xchg r11, r9
mov r8d, 0x6259bee9
xor r8d, 0x666ca685
add r8d, 0x190b9b19
sub r8d, 0xc350479
add r8d, 0x1449d77d
add r8d, 0xe82008b
xor r8d, 0x5724251a
sub r8d, 0x4b524973
add r8d, 0xe65ea764
test rcx, rcx
je 0x140076654
cmp byte [rcx], 0
je 0x140076654
test rdx, rdx
jne 0x1400765e5
nop
movabs rdx, 0xffffffff2b9dc1f5
sub rdx, 0x826e998
add rdx, 0x292e21ac
xor rdx, 0x321d7196
xor rdx, 0x5a9b698c
xor rdx, 0x37b9ea61
add rdx, 0x7fffffff
add rdx, 0x6c64f78e
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x1400765cf
test rdx, rdx
je 0x140076651
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
xor rcx, qword [rsp]
add rsp, 0x10
shr r8d, 5
shr r8d, 2
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x1400765f7
not r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007ac50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
push 0x4a67c865
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rdx
xchg rdi, rcx
mov rbx, rdi
xchg rcx, rdi
test rdx, rdx
jne 0x14007aca0
mov qword [rcx + 0x10], rdx
mov rax, rcx
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rbx, rcx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
nop
movabs r8, 0xffffffff519afff8
xor r8, 0x2578fd60
sub r8, 0x148933e9
sub r8, 0x41663bf4
add r8, 0x5d093b74
sub r8, 0x307a0294
sub r8, 0x8d4976c
add r8, 0x7fffffff
add r8, 0x3d52cbd1
xchg r14, rcx
mov r14, r8
xchg rcx, r14
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x14007acec
inc rcx
mov eax, 0x66c69d43
sub eax, 0x64c34a45
add eax, 0xa06f0c9
add eax, 0x6bab35d5
sub eax, 0x4fa98d0c
sub eax, 0x243b2ea
sub eax, 0x25c839a4
mul rcx
mov qword [rbx + 8], rcx
cmovo rax, r8
mov rcx, rax
call fcn.1401fcbb0
xchg r12, r8
mov r12, qword [rbx + 8]
xchg r12, r8
xchg r10, rdi
mov rdx, r10
xchg r10, rdi
add r8, r8
mov qword [rbx + 0x10], rax
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007ad6f
dec eax
or eax, 0xffff0000
inc eax
xor edx, edx
mov word [rbx + 2], ax
cmp qword [rbx + 8], rdx
jbe 0x14007ada1
nop
xchg rbp, rax
mov rbp, qword [rbx + 0x10]
xchg rbp, rax
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007ad81
mov byte [rbx], 0x22
xor byte [rbx], 0x47
sub byte [rbx], 0x13
sub byte [rbx], 0x29
add byte [rbx], 0x2e
xor byte [rbx], 0x57
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007b3f0
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rax
mov rsi, qword [rcx + 0x10]
xchg rsi, rax
xchg r9, rdx
mov r9, rcx
xchg rdx, r9
test rax, rax
jne 0x14007b40d
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b457
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b43f
xchg r10, rax
mov r10, qword [rdx + 0x10]
xchg r10, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b41b
xchg r11, rax
mov r11, qword [rdx + 0x10]
xchg r11, rax
mov byte [rdx], 0x1f
xor byte [rdx], 0x2c
xor byte [rdx], 7
add byte [rdx], 0x10
add byte [rdx], 0x11
add byte [rdx], 0x11
xor byte [rdx], 0x1b
xor byte [rdx], 0x7c
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b460
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rdx, rcx
mov rcx, rdx
xchg rcx, rdx
test rax, rax
jne 0x14007b481
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b4c7
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b4ac
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b48f
xchg rcx, rax
mov rcx, qword [rdx + 0x10]
xchg rcx, rax
mov byte [rdx], 0xe
add byte [rdx], 2
xor byte [rdx], 0x7b
sub byte [rdx], 0x3f
add byte [rdx], 7
sub byte [rdx], 0x26
xor byte [rdx], 0x7b
xor byte [rdx], 0x13
sub byte [rdx], 0x64
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007b7e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg r9, rdx
mov r9, rcx
xchg r9, rdx
test rax, rax
jne 0x14007b7fb
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b843
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b82e
nop dword [rax + rax]
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b80e
xchg r15, rax
mov r15, qword [rdx + 0x10]
xchg r15, rax
mov byte [rdx], 0x3d
add byte [rdx], 0x1a
sub byte [rdx], 0x24
add byte [rdx], 0xc
xor byte [rdx], 0x5b
sub byte [rdx], 0x1b
sub byte [rdx], 0x48
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c0a0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg r9, rbx
xchg r8, rdx
mov qword [rsp + 0x10], r8
xchg rdx, r8
nop
push r8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 4]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x4b
xor byte [rbx + rax], 0x32
sub byte [rbx + rax], 0x56
add byte [rbx + rax], 0x20
sub byte [rbx + rax], 0x2c
xor byte [rbx + rax], 0xd
sub byte [rbx + rax], 0x1a
inc rax
cmp rax, 6
jb 0x14007c0d9
mov rax, rdi
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg rbx, r15
add rsp, 0x20
push rcx
push rbx
push rax
push rbx
push rcx
xchg qword [rsp + 0x28], rdi
pop rcx
pop rbx
pop rax
pop rbx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c130
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg r14, rbx
xchg rdx, r10
mov qword [rsp + 0x10], r10
xchg r10, rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 6]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], reloc.SHLWAPI.dll_SHCreateMemStream
add byte [rbx + rax], 0x22
xor byte [rbx + rax], 0x27
sub byte [rbx + rax], 6
add byte [rbx + rax], 0x70
sub byte [rbx + rax], 0x35
xor byte [rbx + rax], 0x1b
add byte [rbx + rax], 2
xor byte [rbx + rax], 0x27
inc rax
cmp rax, 8
jb 0x14007c15d
xchg rdi, rbp
mov rax, rbp
xchg rbp, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007c1b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, r10
mov r10, rcx
xchg rdi, r10
lea rbx, [rdx + 6]
xchg rbx, r12
mov rdx, r12
xchg rbx, r12
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x30
sub byte [rbx + rax], 5
xor byte [rbx + rax], 0x70
add byte [rbx + rax], 0x11
sub byte [rbx + rax], 0x19
sub byte [rbx + rax], 0x18
sub byte [rbx + rax], 0x3b
inc rax
cmp rax, 0xa
jb 0x14007c1dd
mov rax, rdi
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c230
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg r9, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 8]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x24
add byte [rbx + rax], 0x21
add byte [rbx + rax], 7
xor byte [rbx + rax], 0x46
add byte [rbx + rax], 0x46
sub byte [rbx + rax], 1
sub byte [rbx + rax], 0x4f
inc rax
cmp rax, 0xe
jb 0x14007c263
xchg rdx, rax
mov rdx, rdi
xchg rdx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007c2b0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0xa]
xchg rbx, r12
mov rdx, r12
xchg rbx, r12
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 7
xor byte [rbx + rax], 0xf
add byte [rbx + rax], 0x6a
xor byte [rbx + rax], 0x6b
xor byte [rbx + rax], 0x36
sub byte [rbx + rax], 0x25
sub byte [rbx + rax], 0xa
inc rax
cmp rax, 0x10
jb 0x14007c2eb
xchg rdi, r13
mov rax, r13
xchg r13, rdi
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg rbx, r13
add rsp, 0x20
push rax
push rcx
push rdx
push rdx
push rax
push rcx
xchg qword [rsp + 0x30], rdi
pop rcx
pop rax
pop rdx
pop rdx
pop rcx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c350
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r14, rdx
mov qword [rsp + 0x10], r14
xchg r14, rdx
push rdi
sub rsp, 0x20
xchg r9, rcx
mov rdi, r9
xchg r9, rcx
lea rbx, [rdx + 0xa]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x3a
sub byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x7a
xor byte [rbx + rax], 0x55
xor byte [rbx + rax], 0xd
add byte [rbx + rax], 0xa
add byte [rbx + rax], 0xb
sub byte [rbx + rax], 0x23
inc rax
cmp rax, 0x12
jb 0x14007c37d
xchg rdi, r13
mov rax, r13
xchg rdi, r13
xchg rbx, rdi
mov rdi, qword [rsp + 0x30]
xchg rbx, rdi
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c3d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r9, rcx
mov rdi, r9
xchg rcx, r9
lea rbx, [rdx + 0x10]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x18
sub byte [rbx + rax], 0x14
add byte [rbx + rax], 0x61
xor byte [rbx + rax], 0x5e
xor byte [rbx + rax], 0x3e
sub byte [rbx + rax], 5
inc rax
cmp rax, 0x1e
jb 0x14007c405
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rsi, rbx
add rsp, 0x20
push rax
push rbx
xchg qword [rsp + 0x10], rdi
pop rbx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c460
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg r13, rbx
xchg rdx, r15
mov qword [rsp + 0x10], r15
xchg rdx, r15
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x12]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0
add byte [rbx + rax], 0x23
xor byte [rbx + rax], 0x49
xor byte [rbx + rax], 8
sub byte [rbx + rax], 0x23
xor byte [rbx + rax], 0x28
add byte [rbx + rax], 3
sub byte [rbx + rax], 0x1a
inc rax
cmp rax, 0x20
jb 0x14007c49b
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c570
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg rbx, r11
xchg rdx, r8
mov qword [rsp + 0x10], r8
xchg r8, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r8, rdi
mov r8, rcx
xchg r8, rdi
lea rbx, [rdx + 0x14]
xchg rdx, r14
mov r14, rbx
xchg rdx, r14
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x57
sub byte [rbx + rax], 0x16
sub byte [rbx + rax], 0x25
add byte [rbx + rax], 0x34
sub byte [rbx + rax], 0x3f
xor byte [rbx + rax], 0x11
xor byte [rbx + rax], 0x2f
sub byte [rbx + rax], 0x2f
inc rax
cmp rax, 0x24
jb 0x14007c5b1
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c610
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbp, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x14]
xchg r15, rdx
mov r15, rbx
xchg r15, rdx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x55
sub byte [rbx + rax], 0x45
add byte [rbx + rax], 0x67
xor byte [rbx + rax], 0x48
sub byte [rbx + rax], 0x17
sub byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0xc
inc rax
cmp rax, 0x26
jb 0x14007c64c
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007c690
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x16]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x6c
xor byte [rbx + rax], 0x34
sub byte [rbx + rax], 0x2e
add byte [rbx + rax], 0xb
xor byte [rbx + rax], 0x1d
xor byte [rbx + rax], 0x76
sub byte [rbx + rax], 0x5e
inc rax
cmp rax, 0x28
jb 0x14007c6c0
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rdi, rbx
mov rdi, qword [rsp + 0x30]
xchg rbx, rdi
add rsp, 0x20
push rcx
push rdx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
nop
add rsp, 8
jmp qword [rsp - 8]