joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002cba0
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r13, rsi
mov qword [rsp + 0x18], r13
xchg r13, rsi
xchg rdx, rdi
mov qword [rsp + 0x20], rdx
xchg rdi, rdx
nop
mov qword [rsp - 8], r14
sub rsp, 8
sub rsp, 0x30
mov rsi, rcx
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
add rcx, 0x6c9a9a2b
sub rcx, 0x6c9a9963
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x4c35e05c
sub dword [rsp + 0x20], 0x190654f8
sub dword [rsp + 0x20], 0x2affe936
add dword [rsp + 0x20], 0x40aab390
add dword [rsp + 0x20], 0x2ffa8cf4
xor dword [rsp + 0x20], 0x78d4e2ba
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b7f0
test eax, eax
js 0x14002cc58
cmp qword [rsp + 0x40], rbx
je 0x14002cc58
lea eax, [rbx + 1]
jmp 0x14002cd85
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002cca1
mov eax, 0xde2d92c
add eax, 0x6916bd66
xor eax, 0x5496ca3b
add eax, 0x8370e0
xor eax, 0x50e15f0a
xor eax, 0x50700f41
add eax, 0x1d582069
xor eax, 0x1768f060
sub eax, 0x28d34e49
jmp 0x14002cd85
cmp dword [rcx + 0x74], ebx
jbe 0x14002ccd2
mov eax, 0x4aaf7194
add eax, 0x1ed3b83b
xor eax, 0x13a3abab
sub eax, 0x5efb560e
add eax, 0x50bfe9ea
xor eax, 0xabb9bf8
sub eax, 0x615e8db5
jmp 0x14002cd85
cmp byte [rdi + 2], bl
je 0x14002ccfe
mov eax, 0x5fd5bad3
add eax, 0x7ec9398
xor eax, 0x60331c83
add eax, 0x2173d43f
xor eax, 0x5a80767f
xor eax, 0x73e5515c
jmp 0x14002cd85
cmp r14d, 0xa
jb 0x14002cd4a
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cd4a
mov eax, 0x63139ee6
sub eax, 0x69e9b92
sub eax, 0x4a96c6f7
add eax, 0x64685e28
sub eax, 0x46a71c57
add eax, 0x3be72d9b
sub eax, 0x4ca59195
xor eax, 0x1ee11a3c
jmp 0x14002cd85
lea rcx, [rsi + 0xb8]
mov edx, 0x49c88438
add edx, 0x20bab2b9
xor edx, 0x1310d05f
sub edx, 0x3be1e490
xor edx, 0x6dec50ec
add edx, 0x493b46a7
call fcn.14002c170
jmp 0x14002cd83
mov eax, ebx
mov rbx, qword [rsp + 0x48]
xchg rbp, rsi
mov rbp, qword [rsp + 0x50]
xchg rbp, rsi
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
nop
xchg qword [rsp], r14
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140035a00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
push rbx
mov qword [rsp], r15
sub rsp, 0x30
mov r15, rdx
mov r14, rcx
movabs rsi, 0xfffffff3a983a7f
add rsi, 0x91be20f
sub rsi, 0x634d5f0
add rsi, 0x2c5deb5f
sub rsi, 0x12c29595
xor rsi, 0x7cb19b9b
add rsi, 0x501f2832
add rsi, 0x7fffffff
xor rsi, 0x435cfdb
cmp rdx, rsi
ja 0x140035c0e
mov r12, qword [rcx + 8]
sub r12, qword [rcx]
sar r12, 1
sar r12, 1
sar r12, 1
sar r12, 1
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 3
sar rcx, 1
mov rdx, rcx
shr rdx, 1
xchg rbp, rax
mov rbp, rsi
xchg rbp, rax
sub rax, rdx
cmp rcx, rax
ja 0x140035ab5
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
mov qword [rsp + 0x88], rsi
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
xchg rcx, r14
mov r14, rcx
xchg rcx, r14
call fcn.140053790
mov r13, rax
mov qword [rsp + 0x28], rax
xchg rbx, r12
mov r12, rbx
xchg r12, rbx
shl rbx, 4
add rbx, rax
mov qword [rsp + 0x20], rbx
xchg r15, rdi
mov r15, rdi
xchg r15, rdi
sub rdi, r12
mov qword [rsp + 0x78], rbx
je 0x140035b52
nop word [rax + rax]
mov byte [rbx], 0x72
sub byte [rbx], 0x54
xor byte [rbx], 0x28
xor byte [rbx], 0x1c
sub byte [rbx], 0xa
xor byte [rbx], 0x64
sub byte [rbx], 0x33
add byte [rbx], 0x65
sub byte [rbx], 0x76
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004baa0
nop
neg rbx
add rbx, 0xfffffffffffffff0
neg rbx
mov qword [rsp + 0x78], rbx
sub rdi, 1
jne 0x140035b12
mov r8, qword [r14 + 8]
mov rdx, r13
xchg rcx, rdx
mov rdx, qword [r14]
xchg rcx, rdx
cmp rcx, r8
je 0x140035ba4
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov byte [rcx], r9b
xchg r11, r9
mov qword [rcx + 8], r11
xchg r9, r11
lea rdx, [rdx + 0x10]
nop
sub rcx, 0x7a966ca8
add rcx, 0x7a966cb8
cmp rcx, r8
jne 0x140035b6e
xchg rcx, rsi
mov r9, rcx
xchg rsi, rcx
xchg r8, r15
mov r15, r8
xchg r15, r8
xchg r13, rdi
mov rdx, rdi
xchg r13, rdi
mov rcx, r14
add rsp, 0x30
nop
mov r15, qword [rsp]
add rsp, 8
nop
xchg qword [rsp], r14
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
xchg qword [rsp], r12
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp fcn.140052900
call fcn.14002f990
int3

Function at 0x140035c90
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbp, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdx, rdi
mov rdx, rdi
xchg rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x140035d00
nop word [rax + rax]
mov byte [rbx], 0x41
xor byte [rbx], 0x24
xor byte [rbx], 0x30
sub byte [rbx], 0x4e
xor byte [rbx], 0x2f
xor byte [rbx], 0x69
add byte [rbx], 0x14
xor byte [rbx], 0x76
sub byte [rbx], 0x23
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004baa0
nop
nop
sub rbx, 0x6a102314
add rbx, 0x6a102324
sub rdi, 1
jne 0x140035cc4
xchg rbx, r8
mov rax, r8
xchg r8, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14004c2a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x18
xor byte [rcx + rax + 6], 0x2f
sub byte [rcx + rax + 6], 0x1f
xor byte [rcx + rax + 6], 0x76
sub byte [rcx + rax + 6], 0x2d
sub byte [rcx + rax + 6], 0x21
add byte [rcx + rax + 6], 0xb
xor byte [rcx + rax + 6], 0x2b
inc rax
cmp rax, 8
jb 0x14004c2a2
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14004c2e0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x53
add byte [rcx + rax + 6], 0xf
sub byte [rcx + rax + 6], 0x53
xor byte [rcx + rax + 6], 0x7e
xor byte [rcx + rax + 6], 4
sub byte [rcx + rax + 6], 0x2a
xor byte [rcx + rax + 6], 0x42
add byte [rcx + rax + 6], 0x37
sub byte [rcx + rax + 6], 0x40
inc rax
cmp rax, 0xa
jb 0x14004c2e2
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140070ee0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
lea r10, [rsp + 0x3d]
mov r8d, edx
mov rbx, rcx
test edx, edx
jns 0x140070f91
neg r8d
nop dword [rax + rax]
dec r10
mov eax, 0xcf9f5d1
xor eax, 0x6cedee65
add eax, 0x182a5508
sub eax, 0x3f40733
sub eax, 0x11d7c6db
xor eax, 0x37744ac2
add eax, 0x77c5e461
mul r8d
shr edx, 2
shr edx, 1
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
neg r8b
add r8b, 0xd0
neg r8b
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140070f04
dec r10
mov byte [r10], 0x5e
sub byte [r10], 0x13
xor byte [r10], 0x4d
add byte [r10], 0x27
xor byte [r10], 8
sub byte [r10], 0x1c
add byte [r10], 0x2c
sub byte [r10], 0x2a
add byte [r10], 0x22
jmp 0x140070feb
dec r10
mov eax, 0x2d97be4c
add eax, 0x19940f20
add eax, 0x2e316e4b
sub eax, 0x25befcf9
sub eax, 0x3583a949
add eax, 0x265348ee
xor eax, 0x1aa099ce
xor eax, 0x75ad7bd3
add eax, 0x9d6c904f
mul r8d
shr edx, 1
shr edx, 1
shr edx, 1
movzx eax, dl
shl al, 1
shl al, 1
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
sub r8b, 0xd0
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140070f91
lea r9, [rsp + 0x58]
xchg rdx, rdi
mov rdi, r10
xchg rdi, rdx
lea r8, [rsp + 0x3d]
mov rcx, rbx
call fcn.140030060
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
add rsp, 0x40
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400760d0
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, r12
mov r9, r12
xchg rcx, r12
mov r8d, 0x50f02fab
sub r8d, 0x260d9042
add r8d, 0xd11816d
add r8d, 0xa84b4dc
sub r8d, 0x1ec77eeb
add r8d, 0x308259d9
xor r8d, 0x77e5c583
sub r8d, 0x14d675da
add r8d, 0xf10000b6
test rcx, rcx
je 0x1400761f4
cmp byte [rcx], 0
je 0x1400761f4
test rdx, rdx
jne 0x14007618c
nop
movabs rdx, 0xffffffff71a6aebe
sub rdx, 0x13399715
sub rdx, 0x31ca5282
sub rdx, 0x19f3346f
xor rdx, 0x2a43dee8
sub rdx, 0x10645c7c
add rdx, 0x1cc22072
add rdx, 0x7fffffff
add rdx, 0x3ab5edba
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x140076176
test rdx, rdx
je 0x1400761f1
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
xor rcx, qword [rsp]
add rsp, 0x10
shr r8d, 8
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x14007619e
not r8d
mov eax, r8d
ret

Function at 0x14007afb0
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rax
mov r14, qword [rcx + 0x10]
xchg r14, rax
xchg rdx, rbp
mov rbp, rcx
xchg rbp, rdx
test rax, rax
jne 0x14007afd5
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b01e
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b003
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007afe3
xchg r10, rax
mov r10, qword [rdx + 0x10]
xchg r10, rax
mov byte [rdx], 0x19
add byte [rdx], 0x23
xor byte [rdx], 0x4a
xor byte [rdx], 0x4e
sub byte [rdx], 0x30
add byte [rdx], 0x2a
xor byte [rdx], 0x6e
xor byte [rdx], 0x15
sub byte [rdx], 0x48
ret

Function at 0x14007b020
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rax
mov r15, qword [rcx + 0x10]
xchg r15, rax
xchg rdx, rsi
mov rsi, rcx
xchg rdx, rsi
test rax, rax
jne 0x14007b03d
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b07f
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b064
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b04b
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x33
add byte [rdx], 0x39
xor byte [rdx], 0x77
add byte [rdx], 7
add byte [rdx], 0
sub byte [rdx], 5
xor byte [rdx], 0x33
xor byte [rdx], 0x73
sub byte [rdx], 0x5c
ret
Function at 0x14007b320
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
xchg rcx, r14
mov rbx, r14
xchg r14, rcx
je 0x14007b394
cmp byte [rcx], 0
je 0x14007b394
push rsi
call 0x140650448
and eax, 0x8000ffff
jge 0x14007b351
dec eax
or eax, 0xffff0000
inc eax
xor word [rbx + 2], ax
xor edx, edx
cmp qword [rbx + 8], rdx
jbe 0x14007b382
nop word [rax + rax]
xchg rcx, rax
mov rcx, qword [rbx + 0x10]
xchg rcx, rax
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007b366
mov byte [rbx], 0x46
xor byte [rbx], 0x28
xor byte [rbx], 0x4b
xor byte [rbx], 0x36
add byte [rbx], 0x42
sub byte [rbx], 0x55
add rsp, 0x20
push rcx
push rax
push rcx
push rdx
push rax
push rdx
xchg qword [rsp + 0x30], rbx
pop rdx
pop rax
pop rdx
pop rcx
pop rax
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b3c0
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rax
mov rdx, qword [rcx + 0x10]
xchg rdx, rax
xchg rcx, rdi
mov rdx, rdi
xchg rdi, rcx
test rax, rax
jne 0x14007b3df
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b429
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b40e
nop dword [rax + rax]
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b3f2
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x4e
add byte [rdx], 0x1e
sub byte [rdx], 0x65
xor byte [rdx], 0x3b
add byte [rdx], 0x39
sub byte [rdx], 0x39
add byte [rdx], 0x31
sub byte [rdx], 0x3f
xor byte [rdx], 0x2f
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007bca0
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg r12, rbx
xchg rbx, rdx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 4]
xchg rcx, rdx
mov rcx, rbx
xchg rdx, rcx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x63
sub byte [rbx + rax], 0x2a
sub byte [rbx + rax], 0x11
add byte [rbx + rax], 0x42
xor byte [rbx + rax], 0x1f
xor byte [rbx + rax], 0x28
sub byte [rbx + rax], 0x5d
inc rax
cmp rax, 6
jb 0x14007bcdb
xchg r14, rax
mov r14, rdi
xchg r14, rax
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007bdc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r11, rdi
mov r11, rcx
xchg r11, rdi
lea rbx, [rdx + 6]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x3d
xor byte [rbx + rax], 0x27
add byte [rbx + rax], 0x3d
add byte [rbx + rax], 0x1a
sub byte [rbx + rax], 0x54
add byte [rbx + rax], 0x35
sub byte [rbx + rax], 0x52
inc rax
cmp rax, 0xa
jb 0x14007bdf6
mov rax, rdi
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x14007be40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 8]
mov rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x74
sub byte [rbx + rax], 0x1a
xor byte [rbx + rax], 0x4e
add byte [rbx + rax], 0x27
sub byte [rbx + rax], 0x1a
sub byte [rbx + rax], 0x19
add byte [rbx + rax], 0x2a
add byte [rbx + rax], 0x44
xor byte [rbx + rax], 0x76
inc rax
cmp rax, 0xe
jb 0x14007be70
xchg rsi, rdi
mov rax, rsi
xchg rdi, rsi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007bec0
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg r10, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r13
mov r13, rcx
xchg r13, rdi
lea rbx, [rdx + 0xa]
mov rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x34
add byte [rbx + rax], 0xd
sub byte [rbx + rax], 0x2e
add byte [rbx + rax], 8
add byte [rbx + rax], 0x47
sub byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x51
sub byte [rbx + rax], 0x1b
inc rax
cmp rax, 0x10
jb 0x14007bef5
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg rbx, r8
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007bf50
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg rbx, r14
xchg rsi, rdx
mov qword [rsp + 0x10], rsi
xchg rsi, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xa]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x33
add byte [rbx + rax], 0x10
add byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x36
xor byte [rbx + rax], 0x19
xor byte [rbx + rax], 0x71
inc rax
cmp rax, 0x12
jb 0x14007bf8b
xchg r10, rax
mov r10, rdi
xchg r10, rax
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007bfe0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
push 0x3f0e2c8d
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x10]
mov rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x75
sub byte [rbx + rax], 0x2b
xor byte [rbx + rax], 0x1a
sub byte [rbx + rax], 0x3d
xor byte [rbx + rax], 0x3f
sub byte [rbx + rax], 0x2c
inc rax
cmp rax, 0x1e
jb 0x14007c010
xchg r12, rax
mov r12, rdi
xchg r12, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c0f0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg rbx, r10
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rdx
push rdi
sub rsp, 0x20
xchg r10, rdi
mov r10, rcx
xchg r10, rdi
lea rbx, [rdx + 0x12]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x47
sub byte [rbx + rax], 0x38
add byte [rbx + rax], 0xa
add byte [rbx + rax], 0x42
xor byte [rbx + rax], 0xb
sub byte [rbx + rax], 0x4d
add byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x51
sub byte [rbx + rax], 0x76
inc rax
cmp rax, 0x22
jb 0x14007c129
xchg r8, rdi
mov rax, r8
xchg r8, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r13, rcx
mov rdi, r13
xchg rcx, r13
lea rbx, [rdx + 0x14]
xchg r12, rbx
mov rdx, r12
xchg rbx, r12
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x61
add byte [rbx + rax], 0x1b
sub byte [rbx + rax], 0x5c
sub byte [rbx + rax], 3
add byte [rbx + rax], 0xc
add byte [rbx + rax], 0x2e
xor byte [rbx + rax], 0x10
xor byte [rbx + rax], 0x47
inc rax
cmp rax, 0x24
jb 0x14007c1b5
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rsi
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c210
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg rbx, r11
xchg rdx, r10
mov qword [rsp + 0x10], r10
xchg rdx, r10
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x14]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x39
xor byte [rbx + rax], 0x50
xor byte [rbx + rax], 0x37
xor byte [rbx + rax], 0x73
xor byte [rbx + rax], 0x7b
sub byte [rbx + rax], 0xc
xor byte [rbx + rax], 0x1d
sub byte [rbx + rax], 0x57
inc rax
cmp rax, 0x26
jb 0x14007c251
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c2a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r14
mov qword [rsp + 0x10], r14
xchg r14, rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x16]
xchg rbx, r12
mov rdx, r12
xchg rbx, r12
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x38
xor byte [rbx + rax], 0x18
sub byte [rbx + rax], 0x23
add byte [rbx + rax], 0x36
add byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x28
sub byte [rbx + rax], 0x4a
inc rax
cmp rax, 0x28
jb 0x14007c2d3
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007c3a0
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rdx, rbx
xchg r15, rdx
mov qword [rsp + 0x10], r15
xchg rdx, r15
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x18]
xchg rbp, rdx
mov rbp, rbx
xchg rdx, rbp
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x59
xor byte [rbx + rax], 0x11
add byte [rbx + rax], 4
sub byte [rbx + rax], 0x1d
sub byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x25
inc rax
cmp rax, 0x2e
jb 0x14007c3db
xchg r10, rax
mov r10, rdi
xchg r10, rax
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
push rax
push rdx
push rax
push rax
push rax
xchg qword [rsp + 0x28], rdi
pop rax
pop rax
pop rax
pop rdx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c430
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r10, rdx
mov qword [rsp + 0x10], r10
xchg rdx, r10
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r13, rdi
mov r13, rcx
xchg r13, rdi
lea rbx, [rdx + 0x1a]
xchg rbx, rbp
mov rdx, rbp
xchg rbx, rbp
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 9
add byte [rbx + rax], 0x62
sub byte [rbx + rax], 4
xor byte [rbx + rax], 0x20
add byte [rbx + rax], 0x35
sub byte [rbx + rax], 0x46
sub byte [rbx + rax], 0x29
xor byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x2b
inc rax
cmp rax, 0x32
jb 0x14007c46c
xchg rdi, r8
mov rax, r8
xchg rdi, r8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rdx
push rbx
push rax
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c4d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r15, rdx
mov qword [rsp + 0x10], r15
xchg rdx, r15
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r15, rcx
mov rdi, r15
xchg r15, rcx
lea rbx, [rdx + 0x1c]
mov rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 1
xor byte [rbx + rax], 0x6b
sub byte [rbx + rax], 0x3c
add byte [rbx + rax], 0x3a
xor byte [rbx + rax], 0x3c
sub byte [rbx + rax], 0x3b
sub byte [rbx + rax], 0x19
inc rax
cmp rax, 0x34
jb 0x14007c506
mov rax, rdi
xchg rbx, r9
mov r9, qword [rsp + 0x30]
xchg rbx, r9
add rsp, 0x20
push rax
push rcx
push rcx
push rdx
push rbx
push rcx
push rax
push rcx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c560
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg rbx, r11
xchg rdx, rbx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x1c]
xchg rbx, r15
mov rdx, r15
xchg rbx, r15
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x29
xor byte [rbx + rax], 0x53
sub byte [rbx + rax], 0x57
xor byte [rbx + rax], 0x45
add byte [rbx + rax], 0x14
sub byte [rbx + rax], 0x2f
xor byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x44
inc rax
cmp rax, 0x36
jb 0x14007c5a1
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rbx
push rcx
push rdx
push rbx
push rdx
push rbx
xchg qword [rsp + 0x38], rdi
pop rbx
pop rdx
pop rbx
pop rdx
pop rcx
pop rbx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c600
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg r15, rbx
xchg rsi, rdx
mov qword [rsp + 0x10], rsi
xchg rsi, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r8
mov r8, rcx
xchg r8, rdi
lea rbx, [rdx + 0x1e]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0x46
xor byte [rbx + rax], 0x26
xor byte [rbx + rax], 9
add byte [rbx + rax], 0x15
sub byte [rbx + rax], 0x30
sub byte [rbx + rax], 9
sub byte [rbx + rax], 9
sub byte [rbx + rax], 0x17
inc rax
cmp rax, 0x38
jb 0x14007c642
mov rax, rdi
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rsi, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c6a0
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rcx, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x20]
xchg rdx, r10
mov r10, rbx
xchg rdx, r10
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x62
xor byte [rbx + rax], 0x70
add byte [rbx + rax], 0x4a
add byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x19
sub byte [rbx + rax], 0x36
xor byte [rbx + rax], 0x32
inc rax
cmp rax, 0x3e
jb 0x14007c6db
xchg rdi, r15
mov rax, r15
xchg rdi, r15
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007c720
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbp, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rdx
mov rdx, rcx
xchg rdi, rdx
lea rbx, [rdx + 0x22]
mov rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x16
add byte [rbx + rax], 0x1e
add byte [rbx + rax], 0x44
xor byte [rbx + rax], 0x4e
sub byte [rbx + rax], 0x1c
sub byte [rbx + rax], 9
add byte [rbx + rax], 0x4c
sub byte [rbx + rax], 4
xor byte [rbx + rax], 0x59
inc rax
cmp rax, 0x40
jb 0x14007c756
mov rax, rdi
xchg rbx, r9
mov r9, qword [rsp + 0x30]
xchg r9, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]