joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004c2a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x39
sub byte [rcx + rax + 6], 4
add byte [rcx + rax + 6], 0x2f
sub byte [rcx + rax + 6], 0x34
xor byte [rcx + rax + 6], 0x7a
xor byte [rcx + rax + 6], 0x32
sub byte [rcx + rax + 6], 0x28
sub byte [rcx + rax + 6], 0x32
sub byte [rcx + rax + 6], 0x1e
inc rax
cmp rax, 8
jb 0x14004c2a2
ret
Function at 0x140071240
Capabilities:
Encode data using xor

Disassembly:
push rax
mov qword [rsp], rbx
sub rsp, 0x40
lea r10, [rsp + 0x3d]
mov r8d, edx
mov rbx, rcx
test edx, edx
jns 0x1400712f5
neg r8d
nop dword [rax + rax]
dec r10
mov eax, 0x59f23262
xor eax, 0x5605f440
add eax, 0x26a26149
add eax, 0x3e60bfa3
sub eax, 0x57e7ad02
xor eax, 0x7206f153
xor eax, 0x34541361
add eax, 0x11c9e1ea
xor eax, 0xa1c776e5
mul r8d
shr edx, 2
shr edx, 1
movzx eax, dl
shl al, 1
shl al, 1
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x62
sub r8b, 0x32
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140071267
dec r10
mov byte [r10], 0x2a
xor byte [r10], 0x54
sub byte [r10], 0x72
add byte [r10], 0x33
add byte [r10], 0x27
sub byte [r10], 0x26
sub byte [r10], 0x13
jmp 0x140071347
dec r10
mov eax, 0x63251910
xor eax, 0x567a8d06
add eax, 0x403940e7
sub eax, 0x19948f2a
add eax, 0x23c5efef
xor eax, 0x4e7a95b8
add eax, 0x9b1c2c53
mul r8d
shr edx, 1
shr edx, 2
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x74
sub r8b, 0x44
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x1400712f5
lea r9, [rsp + 0x58]
xchg rcx, rdx
mov rcx, r10
xchg rdx, rcx
lea r8, [rsp + 0x3d]
xchg rbx, rdx
mov rcx, rdx
xchg rdx, rbx
call fcn.140030090
xchg rbx, rsi
mov rax, rsi
xchg rbx, rsi
add rsp, 0x40
push rax
push rdx
push rcx
push rax
xchg qword [rsp + 0x20], rbx
pop rax
pop rcx
pop rdx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400764e0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov r8d, 0x4af7451d
xor r8d, 0x28cab2b4
xor r8d, 0x4e8d4336
add r8d, 0x183d7fe1
xor r8d, 0x7484b3a1
sub r8d, 0x2b75b6c1
xor r8d, 0xfb0b2f9f
test rcx, rcx
je 0x1400765e2
cmp byte [rcx], 0
je 0x1400765e2
test rdx, rdx
jne 0x14007657a
nop
movabs rdx, 0xffffffff50dcb426
add rdx, 0x34d812
sub rdx, 0x19e9fee3
xor rdx, 0x7891bac3
xor rdx, 0x6abcfda0
add rdx, 0x7fffffff
add rdx, 0x5af535ca
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x140076564
test rdx, rdx
je 0x1400765df
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
xor rcx, qword [rsp]
add rsp, 0x10
shr r8d, 8
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x14007658c
not r8d
mov eax, r8d
ret
Function at 0x14007ac50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r13, rdx
mov rdi, r13
xchg rdx, r13
mov rbx, rcx
test rdx, rdx
jne 0x14007acab
xchg rdx, rbp
mov qword [rcx + 0x10], rbp
xchg rdx, rbp
xchg rdx, rcx
mov rax, rdx
xchg rdx, rcx
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
nop
movabs r8, 0xffffffff46379024
add r8, 0xf38fcb7
xor r8, 0x7303571a
xor r8, 0x174cc1b4
sub r8, 0x6b4c337
add r8, 0x2ded1c87
add r8, 0x7fffffff
xor r8, 0x27888c3b
xchg r8, rdi
mov rcx, rdi
xchg r8, rdi
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x14007acf0
inc rcx
mov eax, 0x140a709c
add eax, 0x65d06782
sub eax, 0x19b74eb5
xor eax, 0x20d7ebd5
xor eax, 0x275733bd
sub eax, 0x674700eb
add eax, 0x67f70c8d
sub eax, 0x68535ca1
mul rcx
mov qword [rbx + 8], rcx
cmovo rax, r8
xchg rcx, r11
mov r11, rax
xchg rcx, r11
call fcn.1401fcce0
xchg r8, r14
mov r14, qword [rbx + 8]
xchg r8, r14
mov rdx, rdi
add r8, r8
xchg rcx, rax
mov qword [rbx + 0x10], rcx
xchg rcx, rax
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call sub.VCRUNTIME140.dll_memcpy
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007ad80
dec eax
or eax, 0xffff0000
inc eax
xor edx, edx
mov word [rbx + 2], ax
cmp qword [rbx + 8], rdx
jbe 0x14007adae
nop
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007ad92
mov byte [rbx], 0x45
add byte [rbx], 0xa
xor byte [rbx], 0x63
sub byte [rbx], 0x13
xor byte [rbx], 0x4f
xor byte [rbx], 0x56
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbx, rbp
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b3d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rdx, r14
mov r14, rcx
xchg r14, rdx
test rax, rax
jne 0x14007b3f1
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b436
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b41b
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b3ff
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x7a
sub byte [rdx], 0x40
sub byte [rdx], 5
add byte [rdx], 0xa
xor byte [rdx], 1
sub byte [rdx], 0x3d
add byte [rdx], 0x56
add byte [rdx], 4
xor byte [rdx], 0x5a
ret
Function at 0x14007b440
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rax
mov r9, qword [rcx + 0x10]
xchg r9, rax
xchg rbp, rcx
mov rdx, rbp
xchg rcx, rbp
test rax, rax
jne 0x14007b465
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b4a8
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b490
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b473
xchg r8, rax
mov r8, qword [rdx + 0x10]
xchg r8, rax
mov byte [rdx], SHCreateMemStream
xor byte [rdx], 0x2f
sub byte [rdx], 9
add byte [rdx], 0x15
xor byte [rdx], 0x34
xor byte [rdx], 3
add byte [rdx], 0x5f
sub byte [rdx], 0x65
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b740
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
xchg rdi, rcx
mov rbx, rdi
xchg rdi, rcx
je 0x14007b7b7
cmp byte [rcx], 0
je 0x14007b7b7
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007b771
dec eax
or eax, 0xffff0000
inc eax
xor word [rbx + 2], ax
xor edx, edx
cmp qword [rbx + 8], rdx
jbe 0x14007b7a2
nop word [rax + rax]
xchg r11, rax
mov r11, qword [rbx + 0x10]
xchg r11, rax
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007b786
mov byte [rbx], 0x1f
add byte [rbx], 0xd
add byte [rbx], 0x2f
xor byte [rbx], 0x61
xor byte [rbx], 0x54
xor byte [rbx], 0x7f
sub byte [rbx], 0x11
add rsp, 0x20
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b7d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rcx, r15
mov rdx, r15
xchg rcx, r15
test rax, rax
jne 0x14007b7e3
ret
cmp byte [rcx], 0
jne 0x14007b835
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b81a
nop dword [rax + rax]
xchg rsi, rax
mov rsi, qword [rdx + 0x10]
xchg rsi, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b7f6
xchg rbx, rax
mov rbx, qword [rdx + 0x10]
xchg rbx, rax
mov byte [rdx], 0x3c
sub byte [rdx], 0x2c
xor byte [rdx], 0x45
sub byte [rdx], 0x43
xor byte [rdx], 0x6c
xor byte [rdx], 0x36
xor byte [rdx], 0x34
xor byte [rdx], 0x3b
xor byte [rdx], 0x46
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c0b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg r11, rbx
xchg rbx, rdx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r10
mov rdi, r10
xchg rcx, r10
lea rbx, [rdx + 4]
xchg r15, rbx
mov rdx, r15
xchg rbx, r15
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x5b
xor byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x74
add byte [rbx + rax], 0x25
xor byte [rbx + rax], 0x21
sub byte [rbx + rax], 0x7e
inc rax
cmp rax, 6
jb 0x14007c0f2
xchg rdi, r9
mov rax, r9
xchg r9, rdi
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg rbx, r13
add rsp, 0x20
push rbx
push rcx
push rax
push rdx
push rax
push rbx
push rbx
push rdx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c150
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rcx, rbx
xchg rbp, rdx
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
push rdi
sub rsp, 0x20
xchg rdx, rcx
mov rdi, rdx
xchg rcx, rdx
lea rbx, [rdx + 6]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x78
sub byte [rbx + rax], 0x1f
sub byte [rbx + rax], 0x11
xor byte [rbx + rax], 0x18
add byte [rbx + rax], 0x19
add byte [rbx + rax], 0xc
add byte [rbx + rax], 8
sub byte [rbx + rax], 0x59
sub byte [rbx + rax], 0x24
inc rax
cmp rax, 8
jb 0x14007c189
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c1e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rbp
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
nop
push r14
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdx, rcx
mov rdi, rdx
xchg rcx, rdx
lea rbx, [rdx + 6]
xchg r13, rdx
mov r13, rbx
xchg rdx, r13
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x75
sub byte [rbx + rax], 5
sub byte [rbx + rax], 0x35
add byte [rbx + rax], 0x19
xor byte [rbx + rax], 0x53
xor byte [rbx + rax], 0x11
add byte [rbx + rax], 0x53
sub byte [rbx + rax], 7
sub byte [rbx + rax], 0x62
inc rax
cmp rax, 0xa
jb 0x14007c219
mov rax, rdi
xchg rbx, rdi
mov rdi, qword [rsp + 0x30]
xchg rdi, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007c270
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r14, rdi
mov r14, rcx
xchg rdi, r14
lea rbx, [rdx + 8]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x10
add byte [rbx + rax], 0x4e
xor byte [rbx + rax], 0x25
sub byte [rbx + rax], 0x17
xor byte [rbx + rax], 0x2a
sub byte [rbx + rax], 0x25
add byte [rbx + rax], 0x4a
xor byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x61
inc rax
cmp rax, 0xe
jb 0x14007c29f
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, rdx
mov qword [rsp + 0x10], rsi
xchg rsi, rdx
nop
push 0x22da46d9
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0xa]
xchg rbx, r10
mov rdx, r10
xchg rbx, r10
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x46
add byte [rbx + rax], 0x27
sub byte [rbx + rax], 0x4b
xor byte [rbx + rax], 0x78
add byte [rbx + rax], 0x13
xor byte [rbx + rax], 0x15
sub byte [rbx + rax], 0x1d
xor byte [rbx + rax], 0x27
sub byte [rbx + rax], 0x7c
inc rax
cmp rax, 0x10
jb 0x14007c33c
xchg rcx, rdi
mov rax, rcx
xchg rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x14007c390
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg rbx, r12
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg rdx, r12
push rdi
sub rsp, 0x20
xchg rcx, r11
mov rdi, r11
xchg rcx, r11
lea rbx, [rdx + 0xa]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0x44
sub byte [rbx + rax], 0x35
add byte [rbx + rax], 0x42
xor byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x7c
inc rax
cmp rax, 0x12
jb 0x14007c3c3
xchg rsi, rax
mov rsi, rdi
xchg rsi, rax
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c410
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, rdx
mov qword [rsp + 0x10], rsi
xchg rdx, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x10]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x12
add byte [rbx + rax], 0x50
add byte [rbx + rax], 3
xor byte [rbx + rax], 0x3a
sub byte [rbx + rax], 0x3a
add byte [rbx + rax], 7
sub byte [rbx + rax], 4
xor byte [rbx + rax], 0x28
inc rax
cmp rax, 0x1e
jb 0x14007c445
xchg r9, rdi
mov rax, r9
xchg r9, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c4a0
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rbp
mov rdi, rbp
xchg rcx, rbp
lea rbx, [rdx + 0x12]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x60
sub byte [rbx + rax], 0x2e
sub byte [rbx + rax], 0x16
add byte [rbx + rax], 0x24
xor byte [rbx + rax], 9
sub byte [rbx + rax], 0x33
xor byte [rbx + rax], 0x16
inc rax
cmp rax, 0x20
jb 0x14007c4cd
xchg r8, rax
mov r8, rdi
xchg r8, rax
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg rbx, r8
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007c520
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
xchg r12, rdx
mov qword [rsp + 0x10], r12
xchg r12, rdx
push rdi
sub rsp, 0x20
xchg rdi, r13
mov r13, rcx
xchg r13, rdi
lea rbx, [rdx + 0x12]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x5d
sub byte [rbx + rax], 0x3b
sub byte [rbx + rax], 0x1d
xor byte [rbx + rax], 0x29
add byte [rbx + rax], 9
add byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x3f
inc rax
cmp rax, 0x22
jb 0x14007c553
xchg rsi, rax
mov rsi, rdi
xchg rsi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c620
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rbp
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r10, rcx
mov rdi, r10
xchg rcx, r10
lea rbx, [rdx + 0x14]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x5f
xor byte [rbx + rax], 0x1e
xor byte [rbx + rax], 0xb
sub byte [rbx + rax], 0x11
xor byte [rbx + rax], 0xd
sub byte [rbx + rax], 3
add byte [rbx + rax], 0xc
sub byte [rbx + rax], 0x3d
inc rax
cmp rax, 0x26
jb 0x14007c65c
mov rax, rdi
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg rbx, r13
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c6b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rbx, rdi
xchg rdx, r11
mov qword [rsp + 0x10], r11
xchg r11, rdx
nop
push r14
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r13
mov rdi, r13
xchg rcx, r13
lea rbx, [rdx + 0x16]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x24
add byte [rbx + rax], 0x4b
sub byte [rbx + rax], 2
xor byte [rbx + rax], 5
xor byte [rbx + rax], 0x5d
xor byte [rbx + rax], 0x3c
xor byte [rbx + rax], 0x36
xor byte [rbx + rax], 0x3f
inc rax
cmp rax, 0x28
jb 0x14007c6ef
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rdx
push rax
push rcx
push rax
push rcx
push rbx
push rcx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c740
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg rbx, r12
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x16]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x6a
sub byte [rbx + rax], 0x50
xor byte [rbx + rax], 0x11
add byte [rbx + rax], 0x64
sub byte [rbx + rax], 0x46
xor byte [rbx + rax], 0x2c
xor byte [rbx + rax], 0x71
sub byte [rbx + rax], 0x74
inc rax
cmp rax, 0x2a
jb 0x14007c767
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg rbx, r10
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007c7b0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg r12, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x18]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x66
sub byte [rbx + rax], 0x53
add byte [rbx + rax], 0x4f
sub byte [rbx + rax], 0x4a
sub byte [rbx + rax], 0x25
inc rax
cmp rax, 0x2e
jb 0x14007c7dd
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r12, rbx
mov r12, qword [rsp + 0x30]
xchg r12, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x14007c820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdi, rdx
mov qword [rsp + 0x10], rdi
xchg rdi, rdx
nop
push 0x875dacc
mov qword [rsp], rdi
sub rsp, 0x20
xchg r12, rcx
mov rdi, r12
xchg rcx, r12
lea rbx, [rdx + 0x1a]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x28
xor byte [rbx + rax], 0x6a
xor byte [rbx + rax], 0x50
xor byte [rbx + rax], 0x75
sub byte [rbx + rax], 0x51
xor byte [rbx + rax], 0x2e
xor byte [rbx + rax], 0x6d
sub byte [rbx + rax], 0x55
inc rax
cmp rax, 0x32
jb 0x14007c85c
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
xchg rbp, rbx
mov rbp, qword [rsp + 0x30]
xchg rbx, rbp
add rsp, 0x20
push rcx
push rax
push rdx
push rdx
push rdx
push rdx
push rcx
xchg qword [rsp + 0x38], rdi
pop rcx
pop rdx
pop rdx
pop rdx
pop rdx
pop rax
pop rcx
add rsp, 8
ret

Function at 0x14007c940
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rbx, rcx
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdx, rdi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rbx, rdi
mov rbx, rcx
xchg rdi, rbx
lea rbx, [rdx + 0x1c]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x7c
xor byte [rbx + rax], 0x55
add byte [rbx + rax], 4
xor byte [rbx + rax], 0x5f
sub byte [rbx + rax], 0x53
add byte [rbx + rax], 0xb
xor byte [rbx + rax], 0x2a
inc rax
cmp rax, 0x36
jb 0x14007c982
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
push rbx
push rdx
push rcx
push rcx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
ret

Function at 0x14007c9d0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rbp
mov rbp, rcx
xchg rbp, rdi
lea rbx, [rdx + 0x1e]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x15
add byte [rbx + rax], 0x5d
sub byte [rbx + rax], 0x63
add byte [rbx + rax], 0x49
add byte [rbx + rax], 0x1f
sub byte [rbx + rax], 0x18
add byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x6e
sub byte [rbx + rax], 0x14
inc rax
cmp rax, 0x38
jb 0x14007ca0c
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ca60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rbx
mov qword [rsp + 0x10], rbx
xchg rdx, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x20]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x5c
xor byte [rbx + rax], 0x39
xor byte [rbx + rax], 0x3c
add byte [rbx + rax], 4
xor byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x4f
inc rax
cmp rax, 0x3e
jb 0x14007ca9c
xchg rdi, r8
mov rax, r8
xchg r8, rdi
xchg rbp, rbx
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007caf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r9, rdx
mov qword [rsp + 0x10], r9
xchg r9, rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x22]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x34
xor byte [rbx + rax], 0x42
sub byte [rbx + rax], 0x20
xor byte [rbx + rax], 0x34
xor byte [rbx + rax], 0x52
add byte [rbx + rax], 0x1e
sub byte [rbx + rax], 0x21
sub byte [rbx + rax], 0x2d
inc rax
cmp rax, 0x40
jb 0x14007cb1d
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rax
push rbx
push rax
push rdx
push rax
push rbx
xchg qword [rsp + 0x38], rdi
pop rbx
pop rax
pop rdx
pop rax
pop rbx
pop rax
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cb80
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r12, rdx
mov qword [rsp + 0x10], r12
xchg r12, rdx
push rax
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x22]
xchg r15, rbx
mov rdx, r15
xchg r15, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], SHCreateMemStream
xor byte [rbx + rax], 0x6a
xor byte [rbx + rax], 0x32
sub byte [rbx + rax], 0x16
add byte [rbx + rax], 0x17
xor byte [rbx + rax], 0x54
inc rax
cmp rax, 0x42
jb 0x14007cbb1
xchg rbp, rax
mov rbp, rdi
xchg rbp, rax
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
push rcx
push rcx
push rbx
push rcx
push rax
xchg qword [rsp + 0x28], rdi
pop rax
pop rcx
pop rbx
pop rcx
pop rcx
add rsp, 8
ret

Function at 0x14007cc00
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rdx, rcx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r8
mov r8, rcx
xchg rdi, r8
lea rbx, [rdx + 0x24]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x50
sub byte [rbx + rax], 0x32
xor byte [rbx + rax], 0x35
add byte [rbx + rax], 0x43
sub byte [rbx + rax], 0x41
xor byte [rbx + rax], 9
sub byte [rbx + rax], 0x24
inc rax
cmp rax, 0x46
jb 0x14007cc41
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007cc80
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rbx, rsi
xchg rdx, r10
mov qword [rsp + 0x10], r10
xchg r10, rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x28]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x53
add byte [rbx + rax], 0xe
sub byte [rbx + rax], 0x30
sub byte [rbx + rax], 0x1c
xor byte [rbx + rax], 0x52
xor byte [rbx + rax], 0x2f
sub byte [rbx + rax], 0x4d
xor byte [rbx + rax], 0x1b
inc rax
cmp rax, 0x4c
jb 0x14007ccb3
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
xchg qword [rsp + 8], rdi
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]