joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007ca00
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rbx, rsi
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r11, rdi
mov r11, rcx
xchg r11, rdi
lea rbx, [rdx + 0x22]
xchg rbx, r8
mov rdx, r8
xchg rbx, r8
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x1f
add byte [rbx + rax], 0xb
xor byte [rbx + rax], 0x69
xor byte [rbx + rax], 0x7b
sub byte [rbx + rax], 0x35
sub byte [rbx + rax], 3
inc rax
cmp rax, 0x42
jb 0x14007ca3b
xchg rsi, rax
mov rsi, rdi
xchg rsi, rax
xchg r15, rbx
mov r15, qword [rsp + 0x30]
xchg r15, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007ca80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg r14, rdi
mov r14, rcx
xchg r14, rdi
lea rbx, [rdx + 0x24]
xchg rbx, r10
mov rdx, r10
xchg r10, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x55
xor byte [rbx + rax], 0x68
add byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x56
xor byte [rbx + rax], 0x4a
sub byte [rbx + rax], 0x49
inc rax
cmp rax, 0x46
jb 0x14007caad
xchg rdi, r10
mov rax, r10
xchg r10, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007caf0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rbx, rdi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x28]
xchg rsi, rbx
mov rdx, rsi
xchg rsi, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x78
sub byte [rbx + rax], 0x61
sub byte [rbx + rax], 4
add byte [rbx + rax], 0x53
xor byte [rbx + rax], 0x2c
sub byte [rbx + rax], 0x4a
inc rax
cmp rax, 0x4c
jb 0x14007cb23
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r15, rbx
mov r15, qword [rsp + 0x30]
xchg r15, rbx
add rsp, 0x20
push rcx
push rax
push rdx
push rdx
push rax
push rbx
push rax
xchg qword [rsp + 0x38], rdi
pop rax
pop rbx
pop rax
pop rdx
pop rdx
pop rax
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cc00
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg r15, rbx
xchg rdx, r14
mov qword [rsp + 0x10], r14
xchg r14, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x2a]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x56
sub byte [rbx + rax], 0x35
xor byte [rbx + rax], 9
add byte [rbx + rax], 0x52
xor byte [rbx + rax], 0x22
sub byte [rbx + rax], 0x22
add byte [rbx + rax], 0x15
sub byte [rbx + rax], 0x4b
inc rax
cmp rax, 0x52
jb 0x14007cc41
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rax
push rbx
xchg qword [rsp + 0x18], rdi
pop rbx
pop rax
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007cc90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg r13, rdi
mov r13, rcx
xchg rdi, r13
lea rbx, [rdx + 0x2c]
mov rdx, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0x42
sub byte [rbx + rax], 0x5b
sub byte [rbx + rax], 0x11
add byte [rbx + rax], 0x5d
add byte [rbx + rax], 0x1c
xor byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x3c
sub byte [rbx + rax], 0x3a
inc rax
cmp rax, 0x54
jb 0x14007ccb7
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
xchg rbx, rsi
mov rsi, qword [rsp + 0x30]
xchg rsi, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007cd10
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg rbx, r10
mov qword [rsp + 0x10], rdx
nop
push 0x51e1ade3
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x2e]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x16
xor byte [rbx + rax], 0x72
sub byte [rbx + rax], 0x42
xor byte [rbx + rax], 0x22
add byte [rbx + rax], 0x58
xor byte [rbx + rax], 0x58
inc rax
cmp rax, 0x58
jb 0x14007cd46
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg rbx, r10
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cd90
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg rbx, r15
xchg rdx, rbx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r11, rcx
mov rdi, r11
xchg r11, rcx
lea rbx, [rdx + 0x2e]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x6b
sub byte [rbx + rax], 0x53
sub byte [rbx + rax], 4
xor byte [rbx + rax], 0x19
add byte [rbx + rax], 0x1f
add byte [rbx + rax], 1
xor byte [rbx + rax], 0x1c
add byte [rbx + rax], 0x3c
sub byte [rbx + rax], 0x6d
inc rax
cmp rax, 0x5a
jb 0x14007cdd1
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r9
mov r9, qword [rsp + 0x30]
xchg r9, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ceb0
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg rbx, r13
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x30]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x78
sub byte [rbx + rax], 0x66
add byte [rbx + rax], 0xa
sub byte [rbx + rax], 0xe
add byte [rbx + rax], 0x13
xor byte [rbx + rax], 0x3a
xor byte [rbx + rax], 0x6f
xor byte [rbx + rax], 0x74
inc rax
cmp rax, 0x5e
jb 0x14007ceeb
xchg rdi, r14
mov rax, r14
xchg r14, rdi
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007cf40
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg rbx, r12
xchg r10, rdx
mov qword [rsp + 0x10], r10
xchg r10, rdx
push rdi
sub rsp, 0x20
xchg rdi, rdx
mov rdx, rcx
xchg rdx, rdi
lea rbx, [rdx + 0x32]
mov rdx, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 8
add byte [rbx + rax], 0xd
add byte [rbx + rax], 0x5f
sub byte [rbx + rax], 0x59
xor byte [rbx + rax], 1
xor byte [rbx + rax], 0x1a
inc rax
cmp rax, 0x60
jb 0x14007cf73
xchg rsi, rax
mov rsi, rdi
xchg rsi, rax
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg r13, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007cfc0
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
xchg rdx, r8
mov qword [rsp + 0x10], r8
xchg rdx, r8
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x34]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 9
xor byte [rbx + rax], 0x1a
add byte [rbx + rax], 0x44
sub byte [rbx + rax], 0x2f
add byte [rbx + rax], 3
xor byte [rbx + rax], 0x2b
inc rax
cmp rax, 0x64
jb 0x14007cffb
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rsi
mov rsi, qword [rsp + 0x30]
xchg rsi, rbx
add rsp, 0x20
push rcx
push rdx
push rcx
push rbx
xchg qword [rsp + 0x20], rdi
pop rbx
pop rcx
pop rdx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d050
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg r10, rbx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
push rdi
sub rsp, 0x20
xchg r10, rcx
mov rdi, r10
xchg r10, rcx
lea rbx, [rdx + 0x38]
xchg rbx, r13
mov rdx, r13
xchg r13, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x6a
sub byte [rbx + rax], 0x30
add byte [rbx + rax], 0x40
sub byte [rbx + rax], 0x36
xor byte [rbx + rax], 0x5a
sub byte [rbx + rax], 0x1d
sub byte [rbx + rax], 1
inc rax
cmp rax, 0x6e
jb 0x14007d089
xchg rdi, r8
mov rax, r8
xchg rdi, r8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rax
push rax
push rdx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
ret

Function at 0x14007d0d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg rdx, r12
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r10
mov r10, rcx
xchg rdi, r10
lea rbx, [rdx + 0x4e]
mov rdx, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x64
sub byte [rbx + rax], 0x4b
xor byte [rbx + rax], 0x2b
sub byte [rbx + rax], 0x29
add byte [rbx + rax], 0x55
xor byte [rbx + rax], 0x4c
add byte [rbx + rax], 0x4e
sub byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x44
inc rax
cmp rax, 0x98
jb 0x14007d105
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d160
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg rbx, r10
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x56]
xchg rdx, r10
mov r10, rbx
xchg r10, rdx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 4
xor byte [rbx + rax], 0x2f
add byte [rbx + rax], 0x3d
sub byte [rbx + rax], 6
xor byte [rbx + rax], 0x6e
xor byte [rbx + rax], 0xc
inc rax
cmp rax, 0xa8
jb 0x14007d193
xchg r9, rax
mov r9, rdi
xchg r9, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d1e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r11
mov qword [rsp + 0x10], r11
xchg r11, rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x5a]
xchg rdx, r9
mov r9, rbx
xchg rdx, r9
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x6a
sub byte [rbx + rax], 0x5e
sub byte [rbx + rax], 4
sub byte [rbx + rax], 1
xor byte [rbx + rax], 0x39
sub byte [rbx + rax], 0x3e
inc rax
cmp rax, 0xb0
jb 0x14007d20d
xchg rdx, rdi
mov rax, rdx
xchg rdi, rdx
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg rbx, r13
add rsp, 0x20
push rbx
push rcx
push rcx
push rdx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
ret

Function at 0x14007d260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r9, rdx
mov qword [rsp + 0x10], r9
xchg rdx, r9
nop
push r9
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r15
mov r15, rcx
xchg rdi, r15
lea rbx, [rdx + 0x70]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x28
xor byte [rbx + rax], 0x3d
add byte [rbx + rax], 0x5f
sub byte [rbx + rax], 0x36
add byte [rbx + rax], 0
sub byte [rbx + rax], 0x1a
add byte [rbx + rax], 0xf
xor byte [rbx + rax], 0x66
xor byte [rbx + rax], 0x55
inc rax
cmp rax, 0xdc
jb 0x14007d299
xchg r14, rdi
mov rax, r14
xchg r14, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d2f0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbp, rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg rdx, r12
push rdi
sub rsp, 0x20
xchg r12, rdi
mov r12, rcx
xchg rdi, r12
lea rbx, [rdx + 0x70]
xchg rbx, r15
mov rdx, r15
xchg r15, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x68
xor byte [rbx + rax], 0x11
sub byte [rbx + rax], 0x11
add byte [rbx + rax], 2
xor byte [rbx + rax], 0x28
xor byte [rbx + rax], 0x78
xor byte [rbx + rax], 0xa
add byte [rbx + rax], 0x26
xor byte [rbx + rax], 0x56
inc rax
cmp rax, 0xde
jb 0x14007d329
xchg rdi, rdx
mov rax, rdx
xchg rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rcx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d380
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg rbx, r15
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, r12
mov rdi, r12
xchg r12, rcx
lea rbx, [rdx + 0x76]
xchg rcx, rbx
mov rdx, rcx
xchg rcx, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 3
xor byte [rbx + rax], 0x39
sub byte [rbx + rax], 0x33
add byte [rbx + rax], 0x40
add byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x79
sub byte [rbx + rax], 0x26
inc rax
cmp rax, 0xea
jb 0x14007d3b3
mov rax, rdi
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg r15, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007d400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r14, rdx
mov qword [rsp + 0x10], r14
xchg r14, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r11, rdi
mov r11, rcx
xchg rdi, r11
lea rbx, [rdx + 0x7c]
xchg rbp, rdx
mov rbp, rbx
xchg rdx, rbp
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x38
add byte [rbx + rax], 0x23
sub byte [rbx + rax], 0x52
add byte [rbx + rax], 0x1d
add byte [rbx + rax], 0x10
sub byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x53
xor byte [rbx + rax], 0x2f
sub byte [rbx + rax], 0x54
inc rax
cmp rax, 0xf4
jb 0x14007d43c
xchg rdi, rbp
mov rax, rbp
xchg rbp, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007d490
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x9a]
xchg rdx, rbp
mov rbp, rbx
xchg rdx, rbp
call fcn.14007ab10
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0xd
xor byte [rbx + rax], 0x7d
sub byte [rbx + rax], 0x42
add byte [rbx + rax], 0x4e
sub byte [rbx + rax], 0x7b
xor byte [rbx + rax], 0x77
sub byte [rbx + rax], 0x1b
sub byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x3f
inc rax
cmp rax, 0x130
jb 0x14007d4ce
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d520
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r14
mov rdi, r14
xchg rcx, r14
lea rbx, [rdx + 0xc]
xchg r13, rbx
mov rdx, r13
xchg rbx, r13
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x34
add byte [rbx + rax], 0x2e
sub byte [rbx + rax], 0x3a
xor byte [rbx + rax], 4
add byte [rbx + rax], 0x46
sub byte [rbx + rax], 0x6b
xor byte [rbx + rax], 0x2c
add byte [rbx + rax], 0x3e
sub byte [rbx + rax], 0x69
inc rax
cmp rax, 0x14
jb 0x14007d55b
xchg rdi, r10
mov rax, r10
xchg rdi, r10
xchg rbx, r11
mov r11, qword [rsp + 0x30]
xchg rbx, r11
add rsp, 0x20
push rax
push rdx
push rbx
push rbx
push rax
push rdx
push rax
push rbx
xchg qword [rsp + 0x40], rdi
pop rbx
pop rax
pop rdx
pop rax
pop rbx
pop rbx
pop rdx
pop rax
add rsp, 8
ret
Function at 0x14007d5c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdx, rdi
mov rdx, rcx
xchg rdi, rdx
lea rbx, [rdx + 0xe]
mov rdx, rbx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x10
sub byte [rbx + rax], 1
add byte [rbx + rax], 0x6b
sub byte [rbx + rax], 0x67
xor byte [rbx + rax], 0x1f
add byte [rbx + rax], 0x6d
xor byte [rbx + rax], 0x20
add byte [rbx + rax], 0x19
sub byte [rbx + rax], 0x72
inc rax
cmp rax, 0x18
jb 0x14007d5e7
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d640
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg rbx, r12
mov qword [rsp + 0x10], rdx
push rdi
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xe]
xchg rdx, r12
mov r12, rbx
xchg r12, rdx
call fcn.14007ab10
nop
xor eax, eax
mov byte [rbx + rax], 0x6f
add byte [rbx + rax], 1
sub byte [rbx + rax], 0x5c
xor byte [rbx + rax], 0x5a
xor byte [rbx + rax], 0x51
add byte [rbx + rax], 0x20
add byte [rbx + rax], 0x2f
xor byte [rbx + rax], 0x6e
inc rax
cmp rax, 0x1a
jb 0x14007d671
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rdx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
ret

Function at 0x140081000
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rbx
xchg r13, rbp
mov qword [rsp + 0x18], r13
xchg r13, rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r14, rbx
mov r14, r8
xchg rbx, r14
xchg r14, rdx
mov rsi, r14
xchg r14, rdx
xchg rcx, r10
mov rbp, r10
xchg r10, rcx
jne 0x1400810cb
xchg rdi, r9
mov qword [rsp + 0x30], r9
xchg rdi, r9
nop dword [rax]
nop dword [rax + rax]
xchg r11, r8
mov r11, qword [rbx + 0x10]
xchg r11, r8
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
mov rcx, rbp
call fcn.140081000
mov rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x28]
call fcn.1400917e0
mov edx, 0x2aceb7a7
add edx, 0x1b83ce17
sub edx, 0x25aa6030
xor edx, 0x5684a521
sub edx, 0x5fe27374
sub edx, 0x164a0ca3
xchg r8, rdi
mov rcx, r8
xchg rdi, r8
call fcn.1401fcccc
cmp byte [rbx + 0x19], 0
je 0x140081061
mov rdi, qword [rsp + 0x30]
xchg rdi, rbx
mov rdi, qword [rsp + 0x38]
xchg rdi, rbx
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
push rbx
push rdx
push rax
push rax
push rax
push rcx
push rcx
xchg qword [rsp + 0x38], rsi
pop rcx
pop rcx
pop rax
pop rax
pop rax
pop rdx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140083c70
Capabilities:
Encode data using xor

Disassembly:
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
sub rcx, 2
mov eax, 0x3a46ab16
add eax, 0x2ea07430
xor eax, 0x3766cb48
sub eax, 0x356d4f2b
add eax, 0x7be53b1
add eax, 0x2eb05050
sub eax, 0x4b257854
add eax, 0xb76f1c3d
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea r9d, [rax + rdx]
add r9w, r9w
sub r8w, r9w
add r8w, 0x30
mov word [rcx], r8w
mov r8d, edx
test edx, edx
jne 0x140083c80
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140083f70
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x1400840c7
mov r9, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
movups xmmword [rax], xmm0
xchg rsi, r10
mov qword [r9 + r8 - 0x70], rsi
xchg rsi, r10
mov qword [r9 + r8 - 0x68], r10
xchg r8, rdx
movups xmm0, xmmword [rdx - 0x80]
xchg rdx, r8
xchg rdx, rax
movups xmmword [rdx], xmm0
xchg rdx, rax
xchg r12, r8
movups xmm1, xmmword [r12 - 0x70]
xchg r8, r12
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm1
xchg r9, r10
mov qword [r8 - 0x70], r9
xchg r9, r10
nop
sub rax, 0x1755b754
add rax, 0x1755b79c
mov qword [r8 - 0x68], 0x10a9d914
xor qword [r8 - 0x68], 0x4602f862
sub qword [r8 - 0x68], 0x420a1a2b
add qword [r8 - 0x68], 0x6b1a7b51
sub qword [r8 - 0x68], 0x62c969ca
add qword [r8 - 0x68], 0x576161cd
sub qword [r8 - 0x68], 0x74537a98
mov word [r8 - 0x80], r10w
xchg r11, r9
movups xmmword [r11 + r8 - 0x60], xmm0
xchg r9, r11
mov qword [r9 + r8 - 0x50], r10
xchg r11, r10
mov qword [r9 + r8 - 0x48], r11
xchg r11, r10
movups xmm0, xmmword [r8 - 0x60]
xchg r13, r9
movups xmmword [r13 + r8 - 0x60], xmm0
xchg r13, r9
movups xmm1, xmmword [r8 - 0x50]
xchg r9, rbx
movups xmmword [rbx + r8 - 0x50], xmm1
xchg r9, rbx
mov qword [r8 - 0x50], r10
mov qword [r8 - 0x48], 0x23cbc386
xor qword [r8 - 0x48], 0x70ce5967
xor qword [r8 - 0x48], 0x5ee92258
xor qword [r8 - 0x48], 0x67e8c6fa
sub qword [r8 - 0x48], 0x2e840e39
add qword [r8 - 0x48], 0x32583e66
xor qword [r8 - 0x48], 0x658e826e
xor qword [r8 - 0x48], 0x44b993b4
sub qword [r8 - 0x48], 0x4cefbfa3
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140083f90
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400841e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x14008429f
xchg r12, rax
mov r9, r12
xchg r12, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
movups xmmword [rax], xmm0
xchg r12, r10
mov qword [r9 + r8 - 0x28], r12
xchg r12, r10
lea rcx, [r8 - 0x18]
xchg rsi, r10
mov qword [r8 + r9 - 0x20], rsi
xchg r10, rsi
xchg rbp, r8
movups xmm0, xmmword [rbp - 0x38]
xchg r8, rbp
xchg rsi, rax
movups xmmword [rsi], xmm0
xchg rsi, rax
xchg rcx, r8
movups xmm1, xmmword [rcx - 0x28]
xchg rcx, r8
xchg r14, rax
movups xmmword [r14 + 0x10], xmm1
xchg r14, rax
mov qword [r8 - 0x28], r10
nop
add rax, 0x5ac33ec5
sub rax, 0x5ac33ea5
mov qword [r8 - 0x20], 0x50f77ec7
xor qword [r8 - 0x20], 0x11d5770c
xor qword [r8 - 0x20], 0x53d122da
add qword [r8 - 0x20], 0x2ce99c5
add qword [r8 - 0x20], 0x67ddc782
sub qword [r8 - 0x20], 0x7d9f8c51
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x140084208
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14008e620
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x2f
xor byte [rcx + rax + 0xa], 0x42
sub byte [rcx + rax + 0xa], 0x57
add byte [rcx + rax + 0xa], 0x28
xor byte [rcx + rax + 0xa], 0x27
xor byte [rcx + rax + 0xa], 0x46
sub byte [rcx + rax + 0xa], 0x3e
add byte [rcx + rax + 0xa], 8
sub byte [rcx + rax + 0xa], 0x29
inc rax
cmp rax, 0x10
jb 0x14008e622
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14008e750
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x28
add byte [rcx + rax + 0x14], 0x3d
add byte [rcx + rax + 0x14], 6
xor byte [rcx + rax + 0x14], 0x27
sub byte [rcx + rax + 0x14], 0x2d
xor byte [rcx + rax + 0x14], 0x2a
xor byte [rcx + rax + 0x14], 0xc
sub byte [rcx + rax + 0x14], 0x39
inc rax
cmp rax, 0x24
jb 0x14008e752
ret
Function at 0x1400f15d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
push r11
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x80
mov rdi, r9
mov esi, r8d
mov rbx, rdx
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.140049bd0
mov dword [rsp + 0x70], esi
xchg rcx, rdi
mov qword [rsp + 0x78], rcx
xchg rcx, rdi
lea ecx, [rbp + 0x30]
call fcn.1401fcc90
test rax, rax
je 0x1400f166a
movups xmm0, xmmword [rsp + 0x50]
xchg r10, rax
movups xmmword [r10], xmm0
xchg r10, rax
movups xmm1, xmmword [rsp + 0x60]
xchg r8, rax
movups xmmword [r8 + 0x10], xmm1
xchg r8, rax
movdqa xmm0, xmmword [0x140002c70]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bp
mov dword [rax + 0x20], esi
mov qword [rax + 0x28], rdi
jmp 0x1400f166d
mov rax, rbp
xchg r12, rax
mov qword [rsp + 0xb8], r12
xchg r12, rax
lea rcx, [rsp + 0x38]
xchg r11, rcx
mov qword [rsp + 0x28], r11
xchg rcx, r11
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140081e90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400f1734
cmp dword [rsp + 0x38], 0
je 0x1400f176d
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400f172c
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x50]
call fcn.14002f950
nop
xchg rbx, r14
mov rcx, r14
xchg rbx, r14
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
nop
mov rdi, qword [rsp]
add rsp, 8
push rax
push rdx
xchg qword [rsp + 0x10], rsi
pop rdx
pop rax
add rsp, 8
push rbx
push rdx
push rdx
push rcx
push rbx
xchg qword [rsp + 0x28], rbp
add rsp, 0x30
jmp fcn.14002f950
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], ebp
mov ecx, 0x44ecee68
sub ecx, 0x5772a40
xor ecx, 0x3716abcd
xor ecx, 0x6ec7a356
sub ecx, 0x44899f4e
xor ecx, 0x1020b2bf
sub ecx, 0x283501f8
xor ecx, 0xa069de4
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 0x79eddd59
add ecx, 0x5a03bb3
xor ecx, 0x5fc58edf
add ecx, 0x21a5b5fd
add ecx, 0x12b6615d
add ecx, 0xe46c72c
add ecx, 0x63c0a28
sub ecx, 0x5a664815
sub ecx, 0xec4386b
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3