joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c840
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg r9, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x16]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x6a
sub byte [rbx + rax], 0x4a
xor byte [rbx + rax], 0x3c
add byte [rbx + rax], 0x60
sub byte [rbx + rax], 7
xor byte [rbx + rax], 0x58
add byte [rbx + rax], 0x22
xor byte [rbx + rax], 0x4c
sub byte [rbx + rax], 3
inc rax
cmp rax, 0x2a
jb 0x14007c875
xchg r13, rax
mov r13, rdi
xchg r13, rax
xchg r15, rbx
mov r15, qword [rsp + 0x30]
xchg rbx, r15
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c8d0
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg r10, rbx
xchg rsi, rdx
mov qword [rsp + 0x10], rsi
xchg rsi, rdx
nop
push 0x6fb55500
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x18]
xchg r13, rbx
mov rdx, r13
xchg rbx, r13
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x2b
add byte [rbx + rax], 0x1d
sub byte [rbx + rax], 0x30
add byte [rbx + rax], 8
add byte [rbx + rax], 0x19
xor byte [rbx + rax], 0x4b
sub byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x60
inc rax
cmp rax, 0x2e
jb 0x14007c90c
xchg r13, rax
mov r13, rdi
xchg r13, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c960
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg r11, rbx
xchg r13, rdx
mov qword [rsp + 0x10], r13
xchg rdx, r13
push rdi
sub rsp, 0x20
xchg rdi, r8
mov r8, rcx
xchg rdi, r8
lea rbx, [rdx + 0x1a]
xchg r12, rdx
mov r12, rbx
xchg r12, rdx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x31
sub byte [rbx + rax], 0x2f
xor byte [rbx + rax], 0x74
xor byte [rbx + rax], 0x63
add byte [rbx + rax], 0x1d
sub byte [rbx + rax], 5
sub byte [rbx + rax], 0x2d
inc rax
cmp rax, 0x32
jb 0x14007c999
mov rax, rdi
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c9f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r10
mov qword [rsp + 0x10], r10
xchg rdx, r10
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r11
mov rdi, r11
xchg rcx, r11
lea rbx, [rdx + 0x1c]
mov rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x1a
add byte [rbx + rax], 0x2e
xor byte [rbx + rax], 0x40
xor byte [rbx + rax], 3
add byte [rbx + rax], 0x3a
sub byte [rbx + rax], 0x22
xor byte [rbx + rax], 0x23
inc rax
cmp rax, 0x34
jb 0x14007ca25
mov rax, rdi
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007ca70
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x1c]
xchg rdx, r10
mov r10, rbx
xchg rdx, r10
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x13
xor byte [rbx + rax], 0x2b
xor byte [rbx + rax], 0x42
sub byte [rbx + rax], 0x58
xor byte [rbx + rax], 0x70
xor byte [rbx + rax], 0x52
add byte [rbx + rax], 0x38
add byte [rbx + rax], 0x28
xor byte [rbx + rax], 0x60
inc rax
cmp rax, 0x36
jb 0x14007caab
xchg rbp, rdi
mov rax, rbp
xchg rbp, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rcx
push rdx
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cb00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r9
mov r9, rcx
xchg r9, rdi
lea rbx, [rdx + 0x1e]
mov rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x21
xor byte [rbx + rax], 0
add byte [rbx + rax], 3
add byte [rbx + rax], 0x13
add byte [rbx + rax], 0x35
add byte [rbx + rax], 0xc
sub byte [rbx + rax], 0x28
xor byte [rbx + rax], 0x50
inc rax
cmp rax, 0x38
jb 0x14007cb30
xchg rbp, rax
mov rbp, rdi
xchg rbp, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cb80
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbx, rbp
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rsi, rcx
mov rdi, rsi
xchg rsi, rcx
lea rbx, [rdx + 0x20]
xchg rcx, rdx
mov rcx, rbx
xchg rdx, rcx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x42
sub byte [rbx + rax], 0x34
add byte [rbx + rax], 0xd
xor byte [rbx + rax], 0x10
add byte [rbx + rax], 0x32
xor byte [rbx + rax], 0x1b
add byte [rbx + rax], 0xa
add byte [rbx + rax], 0x21
xor byte [rbx + rax], 0x51
inc rax
cmp rax, 0x3e
jb 0x14007cbbc
xchg r11, rdi
mov rax, r11
xchg rdi, r11
xchg r15, rbx
mov r15, qword [rsp + 0x30]
xchg rbx, r15
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cc20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdi, rdx
mov qword [rsp + 0x10], rdi
xchg rdi, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r14, rdi
mov r14, rcx
xchg rdi, r14
lea rbx, [rdx + 0x22]
xchg rdx, r11
mov r11, rbx
xchg r11, rdx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x4f
add byte [rbx + rax], 0x2f
xor byte [rbx + rax], 0x4a
xor byte [rbx + rax], 0x13
sub byte [rbx + rax], 7
xor byte [rbx + rax], 0x74
sub byte [rbx + rax], 0x47
xor byte [rbx + rax], 0xb
xor byte [rbx + rax], 6
inc rax
cmp rax, 0x40
jb 0x14007cc5c
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rcx
push rbx
xchg qword [rsp + 0x18], rdi
pop rbx
pop rcx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007cd30
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg r9, rbx
xchg r13, rdx
mov qword [rsp + 0x10], r13
xchg rdx, r13
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x24]
xchg rbx, rsi
mov rdx, rsi
xchg rsi, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x41
sub byte [rbx + rax], 1
xor byte [rbx + rax], 0x55
add byte [rbx + rax], 0x14
add byte [rbx + rax], 7
xor byte [rbx + rax], 0x57
xor byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x68
inc rax
cmp rax, 0x46
jb 0x14007cd6c
xchg rcx, rax
mov rcx, rdi
xchg rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007cdb0
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg rbx, r11
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x28]
xchg r11, rbx
mov rdx, r11
xchg r11, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x4b
add byte [rbx + rax], 6
sub byte [rbx + rax], 0x2f
sub byte [rbx + rax], 8
add byte [rbx + rax], 0x17
add byte [rbx + rax], 0x31
xor byte [rbx + rax], 0x6f
xor byte [rbx + rax], 0x51
sub byte [rbx + rax], 0x5c
inc rax
cmp rax, 0x4c
jb 0x14007cdf1
mov rax, rdi
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007ce40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
push r11
mov qword [rsp], rdi
sub rsp, 0x20
xchg r13, rcx
mov rdi, r13
xchg r13, rcx
lea rbx, [rdx + 0x2a]
xchg rdx, r12
mov r12, rbx
xchg rdx, r12
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 5
add byte [rbx + rax], 0x6e
sub byte [rbx + rax], 0x41
xor byte [rbx + rax], 0x55
sub byte [rbx + rax], 0x37
xor byte [rbx + rax], 0x75
add byte [rbx + rax], 0x35
sub byte [rbx + rax], 0x4e
sub byte [rbx + rax], 0x2c
inc rax
cmp rax, 0x50
jb 0x14007ce73
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007cec0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r11
mov qword [rsp + 0x10], r11
xchg rdx, r11
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x2a]
xchg r12, rdx
mov r12, rbx
xchg r12, rdx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x43
xor byte [rbx + rax], 0x5d
sub byte [rbx + rax], 0x17
add byte [rbx + rax], 0x43
add byte [rbx + rax], 0x2b
add byte [rbx + rax], 0
xor byte [rbx + rax], 0x75
inc rax
cmp rax, 0x52
jb 0x14007cef3
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007cf40
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg rbx, r9
xchg rdx, r14
mov qword [rsp + 0x10], r14
xchg r14, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r10, rdi
mov r10, rcx
xchg rdi, r10
lea rbx, [rdx + 0x2c]
xchg rdi, rdx
mov rdi, rbx
xchg rdx, rdi
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 8
add byte [rbx + rax], 0x20
add byte [rbx + rax], 0x37
xor byte [rbx + rax], 0x21
sub byte [rbx + rax], 0x50
sub byte [rbx + rax], 0xb
xor byte [rbx + rax], 0x44
sub byte [rbx + rax], 0x67
inc rax
cmp rax, 0x54
jb 0x14007cf81
xchg r10, rax
mov r10, rdi
xchg r10, rax
xchg r9, rbx
mov r9, qword [rsp + 0x30]
xchg r9, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d060
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg r12, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r9
mov r9, rcx
xchg r9, rdi
lea rbx, [rdx + 0x2e]
mov rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0x20
xor byte [rbx + rax], 0xd
add byte [rbx + rax], 0x71
sub byte [rbx + rax], 0x66
add byte [rbx + rax], 0x56
sub byte [rbx + rax], 0x26
xor byte [rbx + rax], 0x7d
xor byte [rbx + rax], 0x46
inc rax
cmp rax, 0x5a
jb 0x14007d095
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
xchg rbp, rbx
mov rbp, qword [rsp + 0x30]
xchg rbx, rbp
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d0f0
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg rbx, r12
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, r14
mov rdi, r14
xchg rcx, r14
lea rbx, [rdx + 0x30]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x68
sub byte [rbx + rax], 0x41
xor byte [rbx + rax], 0x70
sub byte [rbx + rax], 0x16
sub byte [rbx + rax], 0x30
xor byte [rbx + rax], 0x70
sub byte [rbx + rax], 3
sub byte [rbx + rax], 0x5e
inc rax
cmp rax, 0x5c
jb 0x14007d123
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d180
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rsi, rcx
mov rdi, rsi
xchg rsi, rcx
lea rbx, [rdx + 0x30]
xchg r14, rbx
mov rdx, r14
xchg rbx, r14
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x24
sub byte [rbx + rax], 0xf
xor byte [rbx + rax], 0x58
add byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x2e
sub byte [rbx + rax], 0x45
inc rax
cmp rax, 0x5e
jb 0x14007d1b3
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
add rsp, 0x20
push rdx
push rdx
push rdx
xchg qword [rsp + 0x18], rdi
pop rdx
pop rdx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d210
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r13
mov qword [rsp + 0x10], r13
xchg r13, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x32]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x27
xor byte [rbx + rax], 0x16
add byte [rbx + rax], 0x46
xor byte [rbx + rax], 0x40
xor byte [rbx + rax], 0x38
sub byte [rbx + rax], 0xf
inc rax
cmp rax, 0x60
jb 0x14007d246
xchg rsi, rax
mov rsi, rdi
xchg rsi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, r14
mov rdi, r14
xchg r14, rcx
lea rbx, [rdx + 0x34]
mov rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x13
add byte [rbx + rax], 0x1f
add byte [rbx + rax], 0x31
add byte [rbx + rax], 0xc
xor byte [rbx + rax], 0x55
xor byte [rbx + rax], 0x7b
add byte [rbx + rax], 2
sub byte [rbx + rax], 0x43
inc rax
cmp rax, 0x64
jb 0x14007d2b7
xchg r10, rdi
mov rax, r10
xchg r10, rdi
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg rbx, r10
add rsp, 0x20
push rdx
push rbx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
ret

Function at 0x14007d310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x38]
mov rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x32
add byte [rbx + rax], 0x1b
add byte [rbx + rax], 0x19
xor byte [rbx + rax], 0x7c
add byte [rbx + rax], 0x5e
xor byte [rbx + rax], 0x12
sub byte [rbx + rax], 0x68
add byte [rbx + rax], 7
xor byte [rbx + rax], 9
inc rax
cmp rax, 0x6e
jb 0x14007d339
xchg rdi, rbx
mov rax, rbx
xchg rdi, rbx
xchg rbx, rdi
mov rdi, qword [rsp + 0x30]
xchg rbx, rdi
add rsp, 0x20
push rax
push rbx
push rcx
push rcx
push rdx
push rbx
push rcx
push rcx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d3a0
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x4e]
mov rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x24
add byte [rbx + rax], 0x15
add byte [rbx + rax], 4
sub byte [rbx + rax], 0x29
xor byte [rbx + rax], 0x30
sub byte [rbx + rax], 0x24
inc rax
cmp rax, 0x98
jb 0x14007d3d0
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d420
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r11
mov qword [rsp + 0x10], r11
xchg rdx, r11
push rax
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r14
mov r14, rcx
xchg r14, rdi
lea rbx, [rdx + 0x56]
xchg rdx, rbp
mov rbp, rbx
xchg rdx, rbp
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x37
add byte [rbx + rax], 0x3b
sub byte [rbx + rax], 0x64
add byte [rbx + rax], 0x49
sub byte [rbx + rax], 0x17
add byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x73
sub byte [rbx + rax], 0x13
sub byte [rbx + rax], 0x13
inc rax
cmp rax, 0xa8
jb 0x14007d457
xchg rdi, rsi
mov rax, rsi
xchg rsi, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d4b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r12, rcx
mov rdi, r12
xchg r12, rcx
lea rbx, [rdx + 0x5a]
xchg rbx, r10
mov rdx, r10
xchg r10, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x5f
sub byte [rbx + rax], 1
xor byte [rbx + rax], 0x54
xor byte [rbx + rax], 0xa
add byte [rbx + rax], 0x52
sub byte [rbx + rax], 2
sub byte [rbx + rax], 0x50
inc rax
cmp rax, 0xb0
jb 0x14007d4e5
xchg rdi, rbp
mov rax, rbp
xchg rbp, rdi
xchg rbx, rsi
mov rsi, qword [rsp + 0x30]
xchg rsi, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d540
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rbx
mov rbx, rcx
xchg rdi, rbx
lea rbx, [rdx + 0x70]
xchg rbx, r9
mov rdx, r9
xchg r9, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x36
add byte [rbx + rax], 0x45
xor byte [rbx + rax], 0x28
xor byte [rbx + rax], 5
sub byte [rbx + rax], 0x3c
xor byte [rbx + rax], 0x32
sub byte [rbx + rax], 0x28
inc rax
cmp rax, 0xdc
jb 0x14007d575
xchg r11, rdi
mov rax, r11
xchg r11, rdi
xchg rbx, rsi
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d5d0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg rbx, r9
xchg r11, rdx
mov qword [rsp + 0x10], r11
xchg r11, rdx
push rdi
sub rsp, 0x20
xchg rdi, r13
mov r13, rcx
xchg rdi, r13
lea rbx, [rdx + 0x70]
xchg rbx, r14
mov rdx, r14
xchg rbx, r14
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x67
sub byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x19
add byte [rbx + rax], 0x17
sub byte [rbx + rax], 0x25
xor byte [rbx + rax], 0x2c
add byte [rbx + rax], 0x24
sub byte [rbx + rax], 0x10
sub byte [rbx + rax], 0x53
inc rax
cmp rax, 0xde
jb 0x14007d609
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rax
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d6e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg r15, rbx
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x7c]
xchg rbx, rcx
mov rdx, rcx
xchg rbx, rcx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0xa
add byte [rbx + rax], 0x4c
sub byte [rbx + rax], 0x2f
xor byte [rbx + rax], 0x35
xor byte [rbx + rax], 0x1c
xor byte [rbx + rax], 0xe
inc rax
cmp rax, 0xf4
jb 0x14007d713
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007d760
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x9a]
mov rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x58
add byte [rbx + rax], 0x1d
xor byte [rbx + rax], 0x35
sub byte [rbx + rax], 4
add byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x2c
add byte [rbx + rax], 0x17
xor byte [rbx + rax], 0x54
inc rax
cmp rax, 0x130
jb 0x14007d798
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d7f0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg rbx, r14
mov qword [rsp + 0x10], rdx
push rsi
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xc]
mov rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x7d
xor byte [rbx + rax], 0x32
add byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x32
sub byte [rbx + rax], 0x2b
add byte [rbx + rax], 0xe
sub byte [rbx + rax], 0x21
inc rax
cmp rax, 0x14
jb 0x14007d81b
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d870
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, r10
mov r10, rcx
xchg r10, rdi
lea rbx, [rdx + 0xe]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], reloc.SHLWAPI.dll_SHCreateMemStream
xor byte [rbx + rax], 0x75
xor byte [rbx + rax], 0x3d
add byte [rbx + rax], 0xb
add byte [rbx + rax], 0x2c
sub byte [rbx + rax], 0x63
add byte [rbx + rax], 0x36
sub byte [rbx + rax], 0x4e
inc rax
cmp rax, 0x18
jb 0x14007d8a3
xchg r14, rax
mov r14, rdi
xchg r14, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d8f0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg rbx, r11
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg rdx, r9
push rdi
sub rsp, 0x20
xchg rcx, rbp
mov rdi, rbp
xchg rcx, rbp
lea rbx, [rdx + 0xe]
xchg rdx, r11
mov r11, rbx
xchg r11, rdx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x16
add byte [rbx + rax], 0x27
sub byte [rbx + rax], 0x38
add byte [rbx + rax], 0x68
sub byte [rbx + rax], 5
sub byte [rbx + rax], 0x37
sub byte [rbx + rax], 0xf
xor byte [rbx + rax], 0x22
add byte [rbx + rax], 0
inc rax
cmp rax, 0x1a
jb 0x14007d929
xchg r8, rdi
mov rax, r8
xchg rdi, r8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rax
push rcx
push rcx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400812d0
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
xchg rbx, rdx
xchg rbp, r14
mov qword [rsp + 0x18], r14
xchg rbp, r14
push rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r9, rbx
mov r9, r8
xchg r9, rbx
xchg rdi, rdx
mov rsi, rdi
xchg rdi, rdx
xchg rbp, rcx
mov rcx, rbp
xchg rbp, rcx
jne 0x140081398
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
xchg r8, rcx
mov rcx, qword [rbx + 0x10]
xchg rcx, r8
mov rdx, rsi
mov rcx, rbp
call fcn.1400812d0
mov rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x28]
call fcn.140091910
mov edx, 0x7ca3b2aa
xor edx, 0x1d48750d
add edx, 0x1da469b6
sub edx, 0x6b84a34
sub edx, 0xdf89364
sub edx, 0x30c16efa
add edx, 0x194d5dac
xor edx, 0x60760bc2
sub edx, 0x331d491d
xchg rcx, r11
mov r11, rdi
xchg rcx, r11
call fcn.1401fc5cc
cmp byte [rbx + 0x19], 0
je 0x140081322
mov rdi, qword [rsp + 0x30]
xchg r15, rbx
mov r15, qword [rsp + 0x38]
xchg r15, rbx
xchg rbx, rbp
mov rbx, qword [rsp + 0x40]
xchg rbx, rbp
add rsp, 0x20
push rbx
push rcx
push rcx
push rcx
push rax
push rax
xchg qword [rsp + 0x30], rsi
add rsp, 0x38
nop
add rsp, 8
jmp qword [rsp - 8]