joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033c80
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 0x10], r14
xchg r14, rbx
xchg rbp, rdx
mov qword [rsp + 0x18], rdx
xchg rbp, rdx
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, r8
mov r8, rbx
xchg rbx, r8
xchg rsi, r12
mov r12, rdx
xchg rsi, r12
xchg rbp, r11
mov r11, rcx
xchg rbp, r11
jne 0x140033d56
xchg rdi, r8
mov qword [rsp + 0x30], r8
xchg rdi, r8
nop dword [rax]
nop dword [rax + rax]
xchg r8, r9
mov r9, qword [rbx + 0x10]
xchg r9, r8
xchg rbp, rdx
mov rbp, rsi
xchg rbp, rdx
xchg rcx, rsi
mov rsi, rbp
xchg rcx, rsi
call fcn.140033c80
xchg rdi, rbx
mov rbx, rdi
xchg rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cd90
mov edx, 0x43d7fd95
add edx, 0x904e9b
add edx, 0x19ce1f0d
xor edx, 0x5886d7d2
xor edx, 0x6d5d6dda
xor edx, 0x6bedd165
xchg rcx, r9
mov r9, rdi
xchg r9, rcx
call fcn.1401fcccc
cmp byte [rbx + 0x19], 0
je 0x140033ce0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
xchg rbx, rbp
mov rbx, qword [rsp + 0x40]
xchg rbp, rbx
add rsp, 0x20
push rbx
push rdx
push rbx
push rax
push rax
push rbx
xchg qword [rsp + 0x30], rsi
pop rbx
pop rax
pop rax
pop rbx
pop rdx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033d90
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 0x10], rsi
xchg rbx, rsi
mov qword [rsp + 0x18], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, r13
mov r13, r8
xchg rbx, r13
xchg rdx, rsi
mov rdx, rsi
xchg rsi, rdx
xchg r12, rbp
mov r12, rcx
xchg r12, rbp
jne 0x140033e66
xchg rsi, rdi
mov qword [rsp + 0x30], rsi
xchg rsi, rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
xchg rsi, rdx
mov rsi, rdx
xchg rdx, rsi
xchg rbp, rcx
mov rbp, rcx
xchg rcx, rbp
call fcn.140033d90
xchg rbx, rdi
mov rbx, rdi
xchg rbx, rdi
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cd90
mov edx, 0x5e251f68
sub edx, 0x41b3ed30
xor edx, 0x696ca853
sub edx, 0x2215533b
sub edx, 0x466d495a
xor edx, 0x53892419
add edx, 0xbb85319
sub edx, 0x6acc2c98
xchg rdi, rcx
mov rdi, rcx
xchg rcx, rdi
call fcn.1401fcccc
cmp byte [rbx + 0x19], 0
je 0x140033dea
mov rdi, qword [rsp + 0x30]
xchg rbx, r12
mov r12, qword [rsp + 0x38]
xchg rbx, r12
xchg rbp, r13
mov r13, qword [rsp + 0x40]
xchg r13, rbp
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140035de0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xchg rdx, r15
mov rdi, r15
xchg rdx, r15
xchg rbx, r15
mov r15, rcx
xchg r15, rbx
test rdx, rdx
je 0x140035e42
nop word [rax + rax]
mov byte [rbx], 0x6c
sub byte [rbx], 0x3f
sub byte [rbx], 0x12
xor byte [rbx], 0x4b
xor byte [rbx], 0x7b
xor byte [rbx], 0x59
xor byte [rbx], 0x72
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bba0
nop
nop
add rbx, 0x4e81f3f1
sub rbx, 0x4e81f3e1
sub rdi, 1
jne 0x140035e0c
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
xchg r9, rbx
mov r9, qword [rsp + 0x30]
xchg r9, rbx
add rsp, 0x20
push rdx
push rbx
push rcx
push rcx
push rbx
push rax
push rcx
push rcx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14004c360
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0xf
add byte [rcx + rax + 6], 0x42
add byte [rcx + rax + 6], 0x16
xor byte [rcx + rax + 6], 0x26
xor byte [rcx + rax + 6], 0x30
sub byte [rcx + rax + 6], 0x26
sub byte [rcx + rax + 6], 0x44
xor byte [rcx + rax + 6], 7
inc rax
cmp rax, 8
jb 0x14004c362
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14004c3a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x44
sub byte [rcx + rax + 6], 0xc
sub byte [rcx + rax + 6], 0x22
xor byte [rcx + rax + 6], 6
xor byte [rcx + rax + 6], 0x50
sub byte [rcx + rax + 6], 3
sub byte [rcx + rax + 6], 7
sub byte [rcx + rax + 6], 0x36
inc rax
cmp rax, 0xa
jb 0x14004c3a2
ret
Function at 0x1400762b0
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, r9
mov rcx, r9
xchg r9, rcx
mov r8d, 0x475aec3d
xor r8d, 0x60b7fc34
add r8d, 0x26a574ab
add r8d, 0x1928e8d0
sub r8d, 0x20c555d0
sub r8d, 0x342ea8d4
xor r8d, 0x5971f3e2
add r8d, 0xedd04ea
xor r8d, 0xa56c5e13
test rcx, rcx
je 0x1400763cc
cmp byte [rcx], 0
je 0x1400763cc
test rdx, rdx
jne 0x14007635e
nop
movabs rdx, 0xffffffff21497666
add rdx, 0x46fc6a57
sub rdx, 0x32e8cf58
sub rdx, 0x200da3b7
add rdx, 0x2f71f75d
add rdx, 0x7fffffff
add rdx, 0x3b3e9af5
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x140076348
test rdx, rdx
je 0x1400763c9
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
or rcx, qword [rsp]
add rsp, 0x10
shr r8d, 6
shr r8d, 1
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x140076370
not r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007ab10
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg r14, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r9, rdi
mov r9, rdx
xchg rdi, r9
xchg rcx, r12
mov rbx, r12
xchg r12, rcx
test rdx, rdx
jne 0x14007ab6d
xchg r14, rdx
mov qword [rcx + 0x10], r14
xchg rdx, r14
mov rax, rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
nop
movabs r8, 0xffffffff5697dc65
add r8, 0xb11876d
xor r8, 0x4c39d4c5
add r8, 0x23ee46ad
xor r8, 0x7af59ded
add r8, 0x30b5f16b
add r8, 0xc7bd723
sub r8, 0x148ee2da
add r8, 0x7fffffff
add r8, 0x2bd1ba23
mov rcx, r8
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x14007abba
inc rcx
mov eax, 0x5e27cf05
sub eax, 0x434828d8
add eax, 0x52fe1488
sub eax, 0x3111bbe6
xor eax, 0x2596ba77
xor eax, 0x1986b927
sub eax, 0xdbfd9d
mul rcx
mov qword [rbx + 8], rcx
cmovo rax, r8
xchg r8, rax
mov rcx, r8
xchg r8, rax
call fcn.1401fccd4
mov r8, qword [rbx + 8]
xchg r13, rdx
mov r13, rdi
xchg rdx, r13
add r8, r8
xchg r14, rax
mov qword [rbx + 0x10], r14
xchg r14, rax
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007ac3f
dec eax
or eax, 0xffff0000
inc eax
xor edx, edx
mov word [rbx + 2], ax
cmp qword [rbx + 8], rdx
jbe 0x14007ac6d
nop
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007ac51
mov byte [rbx], 0x45
sub byte [rbx], 1
xor byte [rbx], 0x7c
add byte [rbx], 0x23
xor byte [rbx], 0x68
xor byte [rbx], 0x73
sub byte [rbx], 0x40
xchg rbx, rdx
mov rax, rdx
xchg rdx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rdx
push rbx
push rax
push rdx
push rcx
xchg qword [rsp + 0x30], rdi
pop rcx
pop rdx
pop rax
pop rbx
pop rdx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b260
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rcx, rdx
mov rcx, rdx
xchg rdx, rcx
test rax, rax
jne 0x14007b279
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b2b8
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b2a3
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b287
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x7a
add byte [rdx], 0
xor byte [rdx], 0x18
add byte [rdx], 0xd
sub byte [rdx], 0x69
xor byte [rdx], 0x2d
sub byte [rdx], 0x2a
ret
Function at 0x14007b2c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rdx, r10
mov r10, rcx
xchg r10, rdx
test rax, rax
jne 0x14007b2d9
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b325
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b30a
xchg r15, rcx
mov r15, qword [rdx + 0x10]
xchg r15, rcx
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b2e7
xchg r12, rax
mov r12, qword [rdx + 0x10]
xchg r12, rax
mov byte [rdx], 0x1d
add byte [rdx], 0x34
sub byte [rdx], 0x2a
add byte [rdx], 0x26
add byte [rdx], 3
sub byte [rdx], 0x47
add byte [rdx], 0x58
xor byte [rdx], 0xc
sub byte [rdx], 0x6c
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b660
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, qword [rcx + 0x10]
xchg r8, rax
mov rdx, rcx
test rax, rax
jne 0x14007b679
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b6c8
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b6b0
nop dword [rax + rax]
xchg rdi, rax
mov rdi, qword [rdx + 0x10]
xchg rdi, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b68c
xchg r15, rax
mov r15, qword [rdx + 0x10]
xchg r15, rax
mov byte [rdx], 0x16
add byte [rdx], 0x1b
add byte [rdx], 0x28
add byte [rdx], 8
sub byte [rdx], 0x1b
add byte [rdx], 0x2b
xor byte [rdx], 0x1f
sub byte [rdx], 0x6d
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007bf50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbx, rdx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
nop
push 0x7003544
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 4]
xchg r12, rbx
mov rdx, r12
xchg rbx, r12
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x49
add byte [rbx + rax], 1
sub byte [rbx + rax], 0x24
add byte [rbx + rax], 0x3b
sub byte [rbx + rax], 0x55
add byte [rbx + rax], 0x27
add byte [rbx + rax], 0x19
xor byte [rbx + rax], 0x50
xor byte [rbx + rax], 0x1c
inc rax
cmp rax, 6
jb 0x14007bf86
mov rax, rdi
xchg r9, rbx
mov r9, qword [rsp + 0x30]
xchg r9, rbx
add rsp, 0x20
push rax
push rcx
push rdx
push rbx
push rcx
push rbx
xchg qword [rsp + 0x30], rdi
add rsp, 0x38
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007bfe0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 6]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x1a
xor byte [rbx + rax], 0xe
add byte [rbx + rax], 7
add byte [rbx + rax], 0x50
xor byte [rbx + rax], 0x58
xor byte [rbx + rax], 0x74
sub byte [rbx + rax], 0x47
inc rax
cmp rax, 8
jb 0x14007c016
xchg rsi, rax
mov rsi, rdi
xchg rsi, rax
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c070
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg r12, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 6]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x74
sub byte [rbx + rax], 0x52
sub byte [rbx + rax], 0x1d
xor byte [rbx + rax], 0x20
add byte [rbx + rax], 0x3e
sub byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0x5c
xor byte [rbx + rax], 0x6a
inc rax
cmp rax, 0xa
jb 0x14007c0a3
xchg rdx, rax
mov rdx, rdi
xchg rdx, rax
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg r15, rbx
add rsp, 0x20
push rdx
push rax
push rcx
push rdx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
ret

Function at 0x14007c0f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rbp
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
nop
push 0x5f9af985
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r12
mov r12, rcx
xchg r12, rdi
lea rbx, [rdx + 8]
xchg r9, rbx
mov rdx, r9
xchg rbx, r9
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x6f
sub byte [rbx + rax], 0x11
sub byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x4f
add byte [rbx + rax], 0x56
xor byte [rbx + rax], 0x29
sub byte [rbx + rax], 0x12
sub byte [rbx + rax], 0x36
inc rax
cmp rax, 0xe
jb 0x14007c12c
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c180
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg rbx, r13
xchg rdx, r10
mov qword [rsp + 0x10], r10
xchg rdx, r10
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xa]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x5b
sub byte [rbx + rax], 0x36
add byte [rbx + rax], 0x28
sub byte [rbx + rax], 0x1c
sub byte [rbx + rax], 5
xor byte [rbx + rax], 0x51
sub byte [rbx + rax], 0x6b
sub byte [rbx + rax], 0x12
inc rax
cmp rax, 0x10
jb 0x14007c1bb
mov rax, rdi
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c210
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r13
mov qword [rsp + 0x10], r13
xchg rdx, r13
nop
push r12
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0xa]
xchg r8, rdx
mov r8, rbx
xchg r8, rdx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x40
sub byte [rbx + rax], 0x26
add byte [rbx + rax], 0x56
xor byte [rbx + rax], 0x7d
add byte [rbx + rax], 0x6b
xor byte [rbx + rax], 0x78
inc rax
cmp rax, 0x12
jb 0x14007c249
xchg rdx, rax
mov rdx, rdi
xchg rdx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret
Function at 0x14007c290
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg rbx, r9
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x10]
xchg rcx, rbx
mov rdx, rcx
xchg rbx, rcx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x54
xor byte [rbx + rax], 0xe
sub byte [rbx + rax], 0x38
xor byte [rbx + rax], 0x11
xor byte [rbx + rax], 0x25
add byte [rbx + rax], 0x19
add byte [rbx + rax], 0x29
xor byte [rbx + rax], 0x58
inc rax
cmp rax, 0x1e
jb 0x14007c2bd
xchg r8, rax
mov r8, rdi
xchg r8, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007c3a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x12]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x55
sub byte [rbx + rax], 0x2a
add byte [rbx + rax], 0x37
add byte [rbx + rax], 0x1c
xor byte [rbx + rax], 0x3e
xor byte [rbx + rax], 0x48
xor byte [rbx + rax], 0x24
sub byte [rbx + rax], 0x24
inc rax
cmp rax, 0x22
jb 0x14007c3d6
xchg rsi, rax
mov rsi, rdi
xchg rsi, rax
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg r13, rbx
add rsp, 0x20
push rbx
push rcx
push rax
push rdx
push rcx
push rdx
push rbx
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c440
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x14]
mov rdx, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0xa
add byte [rbx + rax], 0x23
add byte [rbx + rax], 5
xor byte [rbx + rax], 0x32
add byte [rbx + rax], 0x57
sub byte [rbx + rax], 0x2b
sub byte [rbx + rax], 0xe
sub byte [rbx + rax], 0x1e
inc rax
cmp rax, 0x24
jb 0x14007c467
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007c4b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r8
mov qword [rsp + 0x10], r8
xchg rdx, r8
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x14]
xchg rbx, r11
mov rdx, r11
xchg r11, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], reloc.SHLWAPI.dll_SHCreateMemStream
add byte [rbx + rax], 0x1d
xor byte [rbx + rax], 0x78
xor byte [rbx + rax], 3
add byte [rbx + rax], 6
sub byte [rbx + rax], 0x1a
sub byte [rbx + rax], 0x3e
inc rax
cmp rax, 0x26
jb 0x14007c4e3
mov rax, rdi
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg rbx, r15
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c530
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg r15, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x16]
xchg rdx, rsi
mov rsi, rbx
xchg rdx, rsi
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x5b
xor byte [rbx + rax], 0x22
sub byte [rbx + rax], 0x52
xor byte [rbx + rax], 0x2f
xor byte [rbx + rax], 0x67
sub byte [rbx + rax], 0x6f
inc rax
cmp rax, 0x28
jb 0x14007c55d
xchg rdx, rax
mov rdx, rdi
xchg rdx, rax
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbx, rbp
add rsp, 0x20
push rdx
push rcx
push rax
push rax
push rbx
push rdx
push rbx
xchg qword [rsp + 0x38], rdi
pop rbx
pop rdx
pop rbx
pop rax
pop rax
pop rcx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c5c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x16]
xchg rdi, rbx
mov rdx, rdi
xchg rdi, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x53
xor byte [rbx + rax], 0x49
sub byte [rbx + rax], 0x17
xor byte [rbx + rax], 0x52
sub byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x36
add byte [rbx + rax], 0x4c
add byte [rbx + rax], 6
sub byte [rbx + rax], 0x63
inc rax
cmp rax, 0x2a
jb 0x14007c5ef
xchg r11, rdi
mov rax, r11
xchg r11, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x18]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x41
sub byte [rbx + rax], 0x38
add byte [rbx + rax], 6
add byte [rbx + rax], 0x12
sub byte [rbx + rax], 0xd
add byte [rbx + rax], 0x1f
add byte [rbx + rax], 0x1c
add byte [rbx + rax], 0x2b
xor byte [rbx + rax], 0x7a
inc rax
cmp rax, 0x2e
jb 0x14007c667
mov rax, rdi
xchg rbx, rsi
mov rsi, qword [rsp + 0x30]
xchg rsi, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c6c0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rdi, rbx
xchg rdx, r10
mov qword [rsp + 0x10], r10
xchg rdx, r10
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x1a]
xchg r15, rbx
mov rdx, r15
xchg r15, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 6
xor byte [rbx + rax], 0x2c
xor byte [rbx + rax], 0x75
add byte [rbx + rax], 3
add byte [rbx + rax], 0xe
add byte [rbx + rax], 4
xor byte [rbx + rax], 0x3e
sub byte [rbx + rax], 0x49
sub byte [rbx + rax], 1
inc rax
cmp rax, 0x32
jb 0x14007c6f3
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rcx
push rdx
push rcx
push rbx
push rax
push rbx
xchg qword [rsp + 0x38], rdi
pop rbx
pop rax
pop rbx
pop rcx
pop rdx
pop rcx
pop rax
add rsp, 8
ret
Function at 0x14007c750
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg rbx, r13
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r14
mov rdi, r14
xchg r14, rcx
lea rbx, [rdx + 0x1c]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x52
xor byte [rbx + rax], 0x41
xor byte [rbx + rax], 0x22
sub byte [rbx + rax], 9
add byte [rbx + rax], 0x42
xor byte [rbx + rax], 0x59
xor byte [rbx + rax], 0x19
sub byte [rbx + rax], 0x2a
inc rax
cmp rax, 0x34
jb 0x14007c78b
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rax
xchg qword [rsp + 0x10], rdi
pop rax
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c870
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x1e]
xchg rdi, rbx
mov rdx, rdi
xchg rbx, rdi
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x52
sub byte [rbx + rax], 0x13
xor byte [rbx + rax], 1
sub byte [rbx + rax], 0x35
add byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x11
xor byte [rbx + rax], 0x46
sub byte [rbx + rax], 0x63
inc rax
cmp rax, 0x38
jb 0x14007c89d
mov rax, rdi
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg r13, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007c8f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x20]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x55
sub byte [rbx + rax], 0x4b
xor byte [rbx + rax], 0x1e
add byte [rbx + rax], 0x27
xor byte [rbx + rax], 0x23
sub byte [rbx + rax], 0xe
add byte [rbx + rax], 0x53
xor byte [rbx + rax], 0x20
sub byte [rbx + rax], 0x7d
inc rax
cmp rax, 0x3e
jb 0x14007c917
xchg rdi, r9
mov rax, r9
xchg r9, rdi
xchg r9, rbx
mov r9, qword [rsp + 0x30]
xchg r9, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c970
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg r8, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x22]
xchg rdi, rdx
mov rdi, rbx
xchg rdi, rdx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x4a
sub byte [rbx + rax], 0x23
add byte [rbx + rax], 0x44
sub byte [rbx + rax], 0x15
sub byte [rbx + rax], 0x3c
xor byte [rbx + rax], 0x7b
xor byte [rbx + rax], 0x61
inc rax
cmp rax, 0x40
jb 0x14007c9a3
xchg r10, rax
mov r10, rdi
xchg r10, rax
xchg rbp, rbx
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]