joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028970
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg r15, rbx
xchg rcx, rsi
mov qword [rsp + 0x10], rcx
xchg rsi, rcx
push rdi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r8, rdi
mov rbx, rdi
xchg r8, rdi
mov rdi, rdx
xchg rcx, rsi
mov rcx, rsi
xchg rsi, rcx
jne 0x140028a05
nop
mov r8, qword [rbx + 0x10]
xchg rdx, rdi
mov rdi, rdx
xchg rdx, rdi
mov rcx, rsi
call fcn.140028970
mov rcx, rbx
mov edx, 0x408af485
xor edx, 0x21381940
sub edx, 0x55488bf8
add edx, 0x49ad4bfb
sub edx, 0x36da3e16
sub edx, 0x3f880f
xor edx, 0x1b25fbc5
sub edx, 0x5d81c36
mov rbx, qword [rbx]
call fcn.1401fcb88
cmp byte [rbx + 0x19], 0
je 0x1400289ac
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg rbx, r8
xchg rbx, rsi
mov rbx, qword [rsp + 0x38]
xchg rbx, rsi
add rsp, 0x20
push rcx
push rdx
push rcx
push rdx
xchg qword [rsp + 0x20], rdi
pop rdx
pop rcx
pop rdx
pop rcx
add rsp, 8
ret

Function at 0x140029940
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg r11, rbx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
xor ebx, ebx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1400299be
xchg rdx, r14
mov r14, qword [rdi + 0x28]
xchg rdx, r14
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1400299ad
mov r8, qword [rcx - 8]
nop
sub rdx, 0x7c64852
add rdx, 0x7c64879
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029a66
mov rcx, r8
call fcn.1401fcb88
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x20], rbx
mov qword [rdi + 0x28], rbx
xchg rcx, r12
mov r12, qword [rdi + 8]
xchg r12, rcx
mov rax, qword [rcx + 8]
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140029a26
nop dword [rax + rax]
xchg r9, rbx
mov r9, qword [rcx]
xchg r9, rbx
mov edx, 0x2267e2b
add edx, 0x37ba8b85
sub edx, 0x2436372
xor edx, 0x1d88cab5
sub edx, 0x28ad61c6
sub edx, 0x1680aad
call fcn.1401fcb88
xchg r12, rbx
mov rcx, r12
xchg rbx, r12
test rbx, rbx
jne 0x1400299e3
mov rcx, qword [rdi + 8]
mov edx, 0x5657a7d5
xor edx, 0x3104785d
sub edx, 0x3fab0ae5
add edx, 0x31e779ad
sub edx, 0x28d563d8
xor edx, 0x30baea60
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rbx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
jmp fcn.1401fcb88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14002ca40
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
xchg rdx, rsi
mov rdx, rcx
xchg rsi, rdx
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg r12, rbx
mov qword [rsp + 0x40], r12
xchg rbx, r12
sub rcx, 0xffffffffffffff38
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0xd4773b8
add dword [rsp + 0x20], 0x40bfc632
sub dword [rsp + 0x20], 0xde623b3
add dword [rsp + 0x20], 0xb28e318
add dword [rsp + 0x20], 0x245efb85
sub dword [rsp + 0x20], 0x26503c4e
sub dword [rsp + 0x20], 0x4958b87e
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b6c0
test eax, eax
js 0x14002caf1
cmp qword [rsp + 0x40], rbx
je 0x14002caf1
lea eax, [rbx + 1]
jmp 0x14002cc36
mov rax, qword gs:[0x60]
xchg rcx, r12
mov r12, qword [rax + 0x30]
xchg rcx, r12
cmp dword [rcx + 0x70], 2
jbe 0x14002cb36
mov eax, 0x226eb876
xor eax, 0xf551cda
sub eax, 0x25e00b5b
add eax, 0x12f23119
sub eax, 0x11095e8d
add eax, 0x4ac2db0b
sub eax, 0x540746e6
jmp 0x14002cc36
cmp dword [rcx + 0x74], ebx
jbe 0x14002cb71
mov eax, 0x4d1c44d0
sub eax, 0x638afd5
add eax, 0x137a5a58
add eax, 0x208f786b
sub eax, 0x6f17c78
xor eax, 0x2bcb0ba8
sub eax, 0x101884e9
sub eax, 0x1467ca8d
xor eax, 0x33b0917b
jmp 0x14002cc36
cmp byte [rdi + 2], bl
je 0x14002cb9d
mov eax, 0x3cae4521
sub eax, 0x314379b8
add eax, 0x53af4699
sub eax, 0x588f7b08
add eax, 0x71f18554
sub eax, 0x787c1c4a
jmp 0x14002cc36
cmp r14d, 0xa
jb 0x14002cbe9
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cbe9
mov eax, 0x62569620
sub eax, 0x60beae13
add eax, 0x50c1aadb
xor eax, 0x29830f46
sub eax, 0x672bdcc8
xor eax, 0x285de5b2
sub eax, 0x1401e799
xor eax, 0x28f13db3
jmp 0x14002cc36
lea rcx, [rsi + 0xb8]
mov edx, 0x18f49146
xor edx, 0x273b15b8
xor edx, 0x16dc8777
add edx, 0x2edaa85d
xor edx, 0x34ea2416
xor edx, 0xe405e68
sub edx, 0x5648c5a7
sub edx, 0xff0dced
add edx, 0x928b6a95
call fcn.14002bfe0
jmp 0x14002cc34
mov eax, ebx
mov rbx, qword [rsp + 0x48]
xchg rsi, rdi
mov rdi, qword [rsp + 0x50]
xchg rsi, rdi
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
nop
xchg qword [rsp], r14
add rsp, 8
ret
Function at 0x140033ab0
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 0x10], r14
xchg r14, rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
mov rbx, r8
xchg rsi, rdx
mov rdx, rsi
xchg rsi, rdx
xchg rsi, rbp
mov rsi, rcx
xchg rbp, rsi
jne 0x140033b6c
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
mov rdx, rsi
xchg r14, rcx
mov r14, rbp
xchg r14, rcx
call fcn.140033ab0
xchg r9, rbx
mov rdi, r9
xchg rbx, r9
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cc00
mov edx, 0x74e968c2
sub edx, 0x555323ef
add edx, 0x56e5308e
xor edx, 0x42a28c96
add edx, 0x19c19463
sub edx, 0x19c9fb1e
xor edx, 0x34d1936c
xchg rcx, rbp
mov rbp, rdi
xchg rbp, rcx
call fcn.1401fcb88
cmp byte [rbx + 0x19], 0
je 0x140033af6
xchg rdi, r10
mov r10, qword [rsp + 0x30]
xchg rdi, r10
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033b90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, r8
mov r8, rbx
xchg r8, rbx
xchg r13, rdx
mov rsi, r13
xchg rdx, r13
xchg r9, rcx
mov rbp, r9
xchg rcx, r9
jne 0x140033c54
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
xchg r11, r8
mov r11, qword [rbx + 0x10]
xchg r11, r8
xchg r12, rsi
mov rdx, r12
xchg rsi, r12
xchg rcx, rbp
mov rbp, rcx
xchg rbp, rcx
call fcn.140033b90
xchg rbx, rdi
mov rbx, rdi
xchg rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cc00
mov edx, 0x5c3ac1d
xor edx, 0x4ca725b5
sub edx, 0x38185e5
add edx, 0x25352ad4
sub edx, 0x5408041a
sub edx, 0x17102a2d
mov rcx, rdi
call fcn.1401fcb88
cmp byte [rbx + 0x19], 0
je 0x140033bde
xchg rcx, rdi
mov rcx, qword [rsp + 0x30]
xchg rdi, rcx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
push rbx
push rax
push rbx
push rcx
push rbx
push rcx
push rcx
xchg qword [rsp + 0x38], rsi
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140035850
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rcx
mov qword [rsp + 8], r9
xchg rcx, r9
nop
mov qword [rsp - 8], rbx
sub rsp, 8
nop
push r11
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x30
xchg rdx, r8
mov r15, r8
xchg rdx, r8
xchg rbx, rcx
mov r14, rbx
xchg rcx, rbx
movabs rsi, 0xfffffff22d2e0b0
add rsi, 0xa0c69a6
xor rsi, 0x187b48f5
add rsi, 0x383c1ae9
sub rsi, 0x1881ac21
sub rsi, 0x24b622eb
add rsi, 0x7fffffff
xor rsi, 0x5057b180
cmp rdx, rsi
ja 0x140035a95
mov r12, qword [rcx + 8]
sub r12, qword [rcx]
sar r12, 1
sar r12, 3
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 2
sar rcx, 2
xchg rdx, rcx
mov rcx, rdx
xchg rdx, rcx
shr rdx, 1
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
sub rax, rdx
cmp rcx, rax
ja 0x14003592f
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
mov qword [rsp + 0x88], rsi
mov rdx, rsi
mov rcx, r14
call fcn.1400537d0
xchg r13, rax
mov rax, r13
xchg r13, rax
xchg r8, rax
mov qword [rsp + 0x28], r8
xchg r8, rax
xchg rbx, r12
mov r12, rbx
xchg r12, rbx
shl rbx, 1
shl rbx, 1
shl rbx, 1
shl rbx, 1
add rbx, rax
xchg rbx, r12
mov qword [rsp + 0x20], r12
xchg r12, rbx
xchg rdi, rbp
mov rbp, r15
xchg rbp, rdi
sub rdi, r12
xchg rbx, r15
mov qword [rsp + 0x78], r15
xchg rbx, r15
je 0x1400359d3
nop word [rax + rax]
mov byte [rbx], 0x42
xor byte [rbx], 0x7b
xor byte [rbx], 0x1b
xor byte [rbx], 0x67
sub byte [rbx], 0x11
sub byte [rbx], 0x34
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004b9d0
nop
add rbx, 0x10
xchg rbx, r10
mov qword [rsp + 0x78], r10
xchg rbx, r10
sub rdi, 1
jne 0x14003599c
mov r8, qword [r14 + 8]
xchg rdx, r13
mov r13, rdx
xchg r13, rdx
xchg rcx, rdi
mov rdi, qword [r14]
xchg rdi, rcx
cmp rcx, r8
je 0x140035a24
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
mov rax, qword [rcx + 8]
xchg r12, rax
mov qword [rdx + 8], r12
xchg r12, rax
mov byte [rcx], r9b
mov qword [rcx + 8], r9
lea rdx, [rdx + 0x10]
neg rcx
add rcx, 0xfffffffffffffff0
neg rcx
cmp rcx, r8
jne 0x1400359f5
mov r9, rsi
mov r8, r15
xchg rdx, rdi
mov rdi, r13
xchg rdi, rdx
mov rcx, r14
add rsp, 0x30
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
xchg qword [rsp], r14
add rsp, 8
push rcx
push rbx
push rdx
xchg qword [rsp + 0x18], r13
add rsp, 0x20
push rdx
push rbx
push rcx
push rdx
push rcx
push rcx
xchg qword [rsp + 0x30], r12
pop rcx
pop rcx
pop rdx
pop rcx
pop rbx
pop rdx
add rsp, 8
push rcx
push rcx
push rcx
xchg qword [rsp + 0x18], rdi
pop rcx
pop rcx
pop rcx
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp fcn.1400528d0
call fcn.14002f860
int3
Function at 0x140035b00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r12, rdi
mov r12, rdx
xchg rdi, r12
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
test rdx, rdx
je 0x140035b69
nop word [rax + rax]
mov byte [rbx], 0x6d
xor byte [rbx], 0x7b
add byte [rbx], 6
xor byte [rbx], 0x12
xor byte [rbx], 0x50
add byte [rbx], 0x1b
sub byte [rbx], 0x21
sub byte [rbx], 0x58
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004b9d0
nop
neg rbx
add rbx, 0xfffffffffffffff0
neg rbx
sub rdi, 1
jne 0x140035b35
xchg r14, rax
mov r14, rbx
xchg r14, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x14004c1b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x49
add byte [rcx + rax + 6], 0x1c
sub byte [rcx + rax + 6], 4
xor byte [rcx + rax + 6], 0x78
add byte [rcx + rax + 6], 0x13
xor byte [rcx + rax + 6], 0x6a
sub byte [rcx + rax + 6], 0x46
inc rax
cmp rax, 8
jb 0x14004c1b2
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14004c1f0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x67
sub byte [rcx + rax + 6], 0x4e
sub byte [rcx + rax + 6], 0x12
xor byte [rcx + rax + 6], 0x70
sub byte [rcx + rax + 6], 0x59
sub byte [rcx + rax + 6], 0x1e
inc rax
cmp rax, 0xa
jb 0x14004c1f2
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140076220
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rdx
mov r9, rdx
xchg rcx, rdx
mov r8d, 0x6fb6a119
sub r8d, 0x41808706
add r8d, 0x34ff72e1
sub r8d, 0x50c2a725
add r8d, 0x434c1bd3
xor r8d, 0xaa40fe5d
test rcx, rcx
je 0x140076333
cmp byte [rcx], 0
je 0x140076333
test rdx, rdx
jne 0x1400762c7
nop
movabs rdx, 0xffffffff3703714c
add rdx, 0x193bb5fe
add rdx, 0xce0712f
xor rdx, 0x7fa959a2
add rdx, 0x4eb6eeb8
sub rdx, 0x15cd9042
sub rdx, 0x4feb4a4f
add rdx, 0x7fffffff
add rdx, 0x744b29fe
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x1400762b1
test rdx, rdx
je 0x140076330
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
xor rcx, qword [rsp]
add rsp, 0x10
shr r8d, 5
shr r8d, 3
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x1400762d9
not r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007aa60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdx, rdi
mov rdx, rdi
xchg rdi, rdx
xchg rcx, r10
mov rbx, r10
xchg rcx, r10
test rdx, rdx
jne 0x14007aac2
xchg rdx, r15
mov qword [rcx + 0x10], r15
xchg r15, rdx
xchg r11, rcx
mov rax, r11
xchg r11, rcx
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
nop
movabs r8, 0xffffffff3b6cf99a
xor r8, 0x7fab8d2d
xor r8, 0x7b5495d4
xor r8, 0x18ae135e
add r8, 0x3f9a5f74
xor r8, 0x1db06905
xor r8, 0x8984c1e
add r8, 0x7fffffff
add r8, 0xc0f8b56
xchg rbp, r8
mov rcx, rbp
xchg r8, rbp
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x14007ab0e
inc rcx
mov eax, 0x32821329
add eax, 0x3596e85c
sub eax, 0xc9de39b
add eax, 0xac1eca4
add eax, 0xef51c2b
add eax, 0xa978ed0
sub eax, 0x653859a9
sub eax, 0x1a9155de
mul rcx
mov qword [rbx + 8], rcx
cmovo rax, r8
xchg rdx, rcx
mov rdx, rax
xchg rcx, rdx
call fcn.1401fcb90
xchg rdi, r8
mov rdi, qword [rbx + 8]
xchg rdi, r8
mov rdx, rdi
add r8, r8
mov qword [rbx + 0x10], rax
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call sub.VCRUNTIME140.dll_memcpy
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007ab9a
dec eax
or eax, 0xffff0000
inc eax
xor edx, edx
mov word [rbx + 2], ax
cmp qword [rbx + 8], rdx
jbe 0x14007abc8
nop
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007abac
mov byte [rbx], 0x41
sub byte [rbx], 6
xor byte [rbx], 0x79
add byte [rbx], 0x1c
xor byte [rbx], 0x49
xor byte [rbx], 0x7e
sub byte [rbx], 0x69
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b1a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
mov rdx, rcx
test rax, rax
jne 0x14007b1bb
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b1fa
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b1e5
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b1c9
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x16
sub byte [rdx], 0x12
add byte [rdx], 0x59
sub byte [rdx], 0x46
add byte [rdx], 0x3d
xor byte [rdx], 0x70
xor byte [rdx], 0x25
ret
Function at 0x14007b200
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rax
mov r9, qword [rcx + 0x10]
xchg r9, rax
xchg r12, rcx
mov rdx, r12
xchg r12, rcx
test rax, rax
jne 0x14007b225
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b271
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b256
xchg rcx, rbx
mov rbx, qword [rdx + 0x10]
xchg rcx, rbx
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b233
xchg rcx, rax
mov rcx, qword [rdx + 0x10]
xchg rcx, rax
mov byte [rdx], 0xf
xor byte [rdx], 0x48
sub byte [rdx], 0x17
add byte [rdx], 0xb
add byte [rdx], 0x40
sub byte [rdx], 0x31
xor byte [rdx], 0x4a
xor byte [rdx], 0x6d
sub byte [rdx], 0x6c
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b500
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
je 0x14007b579
cmp byte [rcx], 0
je 0x14007b579
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007b531
dec eax
or eax, 0xffff0000
inc eax
xor word [rbx + 2], ax
xor edx, edx
cmp qword [rbx + 8], rdx
jbe 0x14007b55e
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007b546
mov byte [rbx], 0xa
xor byte [rbx], 0x3a
xor byte [rbx], 0x71
add byte [rbx], 0x39
xor byte [rbx], 0x21
sub byte [rbx], 0xe
xor byte [rbx], 0x1f
sub byte [rbx], 0x30
xor byte [rbx], 0x22
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret

Function at 0x14007b590
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rax
mov rsi, qword [rcx + 0x10]
xchg rsi, rax
mov rdx, rcx
test rax, rax
jne 0x14007b5a9
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b5fb
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b5e0
nop dword [rax + rax]
xchg r11, rax
mov r11, qword [rdx + 0x10]
xchg r11, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b5bc
xchg r12, rax
mov r12, qword [rdx + 0x10]
xchg r12, rax
mov byte [rdx], 8
add byte [rdx], 0x6d
xor byte [rdx], 1
sub byte [rdx], 0x3e
xor byte [rdx], 0x64
xor byte [rdx], 0x38
sub byte [rdx], 0xa
sub byte [rdx], 0x4b
xor byte [rdx], 0x14
ret

Function at 0x14007bf00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rcx, rdx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 6]
xchg rbx, rsi
mov rdx, rsi
xchg rsi, rbx
call fcn.14007aa60
nop
xor eax, eax
mov byte [rbx + rax], 0x7b
sub byte [rbx + rax], 0x4a
add byte [rbx + rax], 0x21
sub byte [rbx + rax], 0x42
xor byte [rbx + rax], 0x47
sub byte [rbx + rax], 0x41
xor byte [rbx + rax], 0x16
inc rax
cmp rax, 8
jb 0x14007bf35
xchg r9, rax
mov r9, rdi
xchg r9, rax
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdx, rdi
mov rdx, rcx
xchg rdx, rdi
lea rbx, [rdx + 8]
xchg r14, rbx
mov rdx, r14
xchg r14, rbx
call fcn.14007aa60
nop
xor eax, eax
mov byte [rbx + rax], 9
xor byte [rbx + rax], 0x3b
sub byte [rbx + rax], 0x20
add byte [rbx + rax], 0x3d
xor byte [rbx + rax], 0x72
sub byte [rbx + rax], 0x3d
inc rax
cmp rax, 0xe
jb 0x14007c02d
xchg r8, rax
mov r8, rdi
xchg r8, rax
xchg rbx, r10
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007c070
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r15
mov qword [rsp + 0x10], r15
xchg r15, rdx
push rdi
sub rsp, 0x20
xchg rcx, r10
mov rdi, r10
xchg rcx, r10
lea rbx, [rdx + 0xa]
mov rdx, rbx
call fcn.14007aa60
nop
xor eax, eax
mov byte [rbx + rax], 0x42
sub byte [rbx + rax], 0x1c
xor byte [rbx + rax], 0x78
sub byte [rbx + rax], 6
add byte [rbx + rax], 5
xor byte [rbx + rax], 0xc
xor byte [rbx + rax], 0x57
add byte [rbx + rax], 0xc
xor byte [rbx + rax], 0x12
inc rax
cmp rax, 0x10
jb 0x14007c09d
mov rax, rdi
xchg rbx, r10
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007c0f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rsi
mov qword [rsp + 0x10], rsi
xchg rdx, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xa]
xchg rcx, rbx
mov rdx, rcx
xchg rbx, rcx
call fcn.14007aa60
nop
xor eax, eax
mov byte [rbx + rax], 0x56
add byte [rbx + rax], 0x16
sub byte [rbx + rax], 0x66
add byte [rbx + rax], 0x64
sub byte [rbx + rax], 0x4a
xor byte [rbx + rax], 0x2e
xor byte [rbx + rax], 0x7b
sub byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x51
inc rax
cmp rax, 0x12
jb 0x14007c126
xchg r13, rax
mov r13, rdi
xchg r13, rax
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c210
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x12]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007aa60
nop
xor eax, eax
mov byte [rbx + rax], 0x52
add byte [rbx + rax], 9
add byte [rbx + rax], 0x22
sub byte [rbx + rax], 0xf
xor byte [rbx + rax], 0x28
sub byte [rbx + rax], 0x46
inc rax
cmp rax, 0x20
jb 0x14007c245
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007c280
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x12]
mov rdx, rbx
call fcn.14007aa60
nop
xor eax, eax
mov byte [rbx + rax], 0x78
sub byte [rbx + rax], 0x2a
sub byte [rbx + rax], 9
add byte [rbx + rax], 0x27
xor byte [rbx + rax], 0x3d
sub byte [rbx + rax], 0x51
inc rax
cmp rax, 0x22
jb 0x14007c2b0
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c2f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rsi
mov rsi, rcx
xchg rsi, rdi
lea rbx, [rdx + 0x14]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007aa60
nop
xor eax, eax
mov byte [rbx + rax], 0x7b
xor byte [rbx + rax], 0x29
sub byte [rbx + rax], 0x37
xor byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x33
sub byte [rbx + rax], 0x17
inc rax
cmp rax, 0x24
jb 0x14007c325
xchg rdx, rax
mov rdx, rdi
xchg rdx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rbx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c400
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rbx, rcx
xchg r10, rdx
mov qword [rsp + 0x10], r10
xchg rdx, r10
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r14, rcx
mov rdi, r14
xchg rcx, r14
lea rbx, [rdx + 0x16]
xchg r11, rdx
mov r11, rbx
xchg rdx, r11
call fcn.14007aa60
nop
xor eax, eax
mov byte [rbx + rax], 0x4f
xor byte [rbx + rax], 0x29
xor byte [rbx + rax], 0x3c
xor byte [rbx + rax], 0x43
xor byte [rbx + rax], 0x45
xor byte [rbx + rax], 0x5c
inc rax
cmp rax, 0x28
jb 0x14007c441
xchg rdi, r12
mov rax, r12
xchg rdi, r12
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c490
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x16]
xchg r12, rdx
mov r12, rbx
xchg r12, rdx
call fcn.14007aa60
nop
xor eax, eax
mov byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x65
sub byte [rbx + rax], 5
xor byte [rbx + rax], 0x42
xor byte [rbx + rax], 0x7b
add byte [rbx + rax], 0x37
sub byte [rbx + rax], 0x78
inc rax
cmp rax, 0x2a
jb 0x14007c4c5
xchg rcx, rax
mov rcx, rdi
xchg rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rbx
push rdx
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
nop
add rsp, 8
jmp qword [rsp - 8]