joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004c7c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x7a0044
mov dword [rbp - 0x1c], 0x20007d
mov dword [rbp - 0x18], 0x4c0021
mov dword [rbp - 0x14], 0x7c0045
lea ecx, [rbx + 7]
mov dword [rbp - 0x10], 0x66007f
mov dword [rbp - 0xc], 0x76007e
mov word [rbp - 8], bx
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 6]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004cd2
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140004cf4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x7a0044
mov dword [rbp - 0x2c], 0x20007d
mov dword [rbp - 0x28], 0x4c0021
mov dword [rbp - 0x24], 0x600046
lea ecx, [rbx + 0x11]
mov dword [rbp - 0x20], 0x610076
mov dword [rbp - 0x1c], 0x700052
mov dword [rbp - 0x18], 0x7c0070
mov dword [rbp - 0x14], 0x7d0066
mov dword [rbp - 0x10], 0x130067
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 1]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004d5b
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140004d7c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x7a0044
mov dword [rbp - 0x2c], 0x20007d
mov dword [rbp - 0x28], 0x4c0021
mov dword [rbp - 0x24], 0x670040
lea ecx, [rbx + 0x17]
mov dword [rbp - 0x20], 0x610072
mov dword [rbp - 0x1c], 0x660067
mov dword [rbp - 0x18], 0x500063
mov dword [rbp - 0x14], 0x7e007c
mov dword [rbp - 0x10], 0x72007e
mov dword [rbp - 0xc], 0x77007d
mov word [rbp - 8], bx
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004dee
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140004e10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x610054
mov dword [rbp - 0x1c], 0x66007c
mov dword [rbp - 0x18], 0x500063
mov dword [rbp - 0x14], 0x7e007c
lea ecx, [rbx + 0xb]
mov dword [rbp - 0x10], 0x7c0063
mov dword [rbp - 0xc], 0x76007d
mov dword [rbp - 8], 0x67007d
mov word [rbp - 4], bx
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004e6d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140004e90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x20
mov dword [rbp - 0x20], 0x7a0044
mov dword [rbp - 0x1c], 0x20007d
mov dword [rbp - 0x18], 0x4c0021
mov dword [rbp - 0x14], 0x610054
lea ebx, [rcx - 0xd]
mov dword [rbp - 0x10], 0x66007c
mov dword [rbp - 0xc], 0x460063
mov dword [rbp - 8], 0x760060
mov dword [rbp - 4], 0x130061
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004ef0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140004f10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x7c005f
mov dword [rbp - 0x1c], 0x720070
mov dword [rbp - 0x18], 0x52007f
mov dword [rbp - 0x14], 0x700070
lea ecx, [rbx + 7]
mov dword [rbp - 0x10], 0x66007c
mov dword [rbp - 0xc], 0x67007d
mov word [rbp - 8], bx
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 6]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004f66
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140004f88
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x720031
mov dword [rbp - 0x2c], 0x700061
mov dword [rbp - 0x28], 0x4c007b
mov dword [rbp - 0x24], 0x700060
lea ecx, [rbx + 0x17]
mov dword [rbp - 0x20], 0x66007c
mov dword [rbp - 0x1c], 0x310067
mov dword [rbp - 0x18], 0x310029
mov dword [rbp - 0x14], 0x230036
mov dword [rbp - 0x10], 0x770021
mov dword [rbp - 0xc], 0x3f0031
mov word [rbp - 8], bx
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004ffa
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000501c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x6a0040
mov dword [rbp - 0x1c], 0x670060
mov dword [rbp - 0x18], 0x7e0076
mov dword [rbp - 0x14], 0x7a0057
lea ecx, [rbx + 0xd]
mov dword [rbp - 0x10], 0x760061
mov dword [rbp - 0xc], 0x670070
mov dword [rbp - 8], 0x61007c
mov dword [rbp - 4], 0x13006a
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000507c
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000744c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov ebx, 0xf
mov dword [rbp - 0x10], 0x7c44605a
mov ecx, ebx
mov dword [rbp - 0xc], 0x43272564
mov dword [rbp - 8], 0x76707c61
mov word [rbp - 4], 0x6060
mov byte [rbp - 2], 0x13
call fcn.14000257c
lea r8, [rbp - 0x10]
mov rdi, rax
sub r8, rax
mov rdx, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140007496
mov ebx, 0xd
mov dword [rbp - 0x10], 0x7d617678
mov ecx, ebx
mov dword [rbp - 0xc], 0x21207f76
mov dword [rbp - 8], 0x7f7f773d
mov byte [rbp - 4], 0x13
call fcn.14000257c
lea r8, [rbp - 0x10]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x1400074d7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007526
and dword [rbp + 0x10], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x140007526
cmp dword [rbp + 0x10], 1
sete al
jmp 0x140007528
xor al, al
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x140007538
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x20], 9
je 0x14000755b
cmp word [rsp + 0x20], 6
je 0x14000755b
xor al, al
jmp 0x14000755d
mov al, 1
add rsp, 0x58
ret
Function at 0x140007b04
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
movdqa xmm0, xmmword [0x1400148c0]
mov ebx, 0x120
movdqa xmm1, xmmword [0x140014ad0]
mov ecx, ebx
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x140014d00]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm1, xmmword [0x140014ac0]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x1400149d0]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x140014c50]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x140014ab0]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x140014b00]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x140014d70]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm1, xmmword [0x140014990]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x140014b20]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x140014b70]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x140014aa0]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm1, xmmword [0x140014bd0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm0, xmmword [0x140014cf0]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm1, xmmword [0x140014a70]
movdqa xmmword [rbp], xmm0
movdqa xmm0, xmmword [0x140014d30]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm1, xmmword [str.qva3_uarg_p_e]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmmword [rbp + 0x30], xmm1
call fcn.14000257c
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140007c1d
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rbp
ret

Function at 0x140007c40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
movdqa xmm0, xmmword [0x1400148c0]
mov ebx, 0x7d
movdqa xmm1, xmmword [0x140014ad0]
mov ecx, ebx
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [0x140014cb0]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm0, xmmword [0x140014950]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm1, xmmword [0x140014d50]
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm0, xmmword [0x140014a10]
movdqa xmmword [rbp + 7], xmm1
movdqa xmm1, xmmword [0x140014a50]
movdqa xmmword [rbp + 0x37], xmm0
movdqa xmmword [rbp + 0x27], xmm1
mov dword [rbp + 0x47], 0x7c753c33
mov dword [rbp + 0x4b], 0x67727e61
mov dword [rbp + 0x4f], 0x65607029
mov byte [rbp + 0x53], 0x13
call fcn.14000257c
lea r8, [rbp - 0x29]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140007cdc
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
Function at 0x140007d00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
movdqa xmm0, xmmword [0x1400148c0]
mov ebx, 0x6d
movdqa xmm1, xmmword [0x140014ad0]
mov ecx, ebx
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [0x1400148e0]
movdqa xmmword [rbp - 9], xmm1
movdqa xmm1, xmmword [0x140014d60]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm0, xmmword [0x140014b50]
movdqa xmmword [rbp + 0x17], xmm1
movdqa xmm1, xmmword [0x140014c20]
movdqa xmmword [rbp + 0x27], xmm0
movdqa xmmword [rbp + 0x37], xmm1
mov dword [rbp + 0x47], 0x7c753c33
mov dword [rbp + 0x4b], 0x67727e61
mov dword [rbp + 0x4f], 0x65607029
mov byte [rbp + 0x53], 0x13
call fcn.14000257c
lea r8, [rbp - 0x19]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140007d8f
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret

Function at 0x140007db4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x40], 0x7e0031
mov dword [rbp - 0x3c], 0x670076
mov dword [rbp - 0x38], 0x7c007b
mov dword [rbp - 0x34], 0x560077
lea ecx, [rbx + 0x25]
mov dword [rbp - 0x30], 0x610061
mov dword [rbp - 0x2c], 0x61007c
mov dword [rbp - 0x28], 0x290031
mov dword [rbp - 0x24], 0x500031
mov dword [rbp - 0x20], 0x760061
mov dword [rbp - 0x1c], 0x670072
mov dword [rbp - 0x18], 0x430076
mov dword [rbp - 0x14], 0x63007a
mov dword [rbp - 0x10], 0x310076
mov dword [rbp - 0xc], 0x13003f
call fcn.14000257c
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 9]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140007e3e
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x140007e60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x1400148c0]
mov ebx, 0x5b
movdqa xmm1, xmmword [0x1400149c0]
mov ecx, ebx
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x140014c80]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x140014930]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x1400149f0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x7e617c75
mov dword [rbp - 0xc], 0x70296772
mov word [rbp - 8], 0x6560
mov byte [rbp - 6], 0x13
call fcn.14000257c
lea r8, [rbp - 0x60]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140007edf
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140007f04
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x1400148c0]
mov ebx, 0x58
movdqa xmm1, xmmword [0x1400149c0]
mov ecx, ebx
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x140014bb0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x140014a90]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x140014900]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x2967727e
mov dword [rbp - 0xc], 0x13656070
call fcn.14000257c
lea r8, [rbp - 0x60]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140007f79
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret

Function at 0x140007f9c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
movdqa xmm0, xmmword [0x1400148c0]
mov ebx, 0x9a
movdqa xmm1, xmmword [0x140014ad0]
mov ecx, ebx
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm0, xmmword [0x1400149e0]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [0x140014980]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm1, xmmword [0x140014b10]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm0, xmmword [0x140014d40]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm1, xmmword [0x140014c10]
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm0, xmmword [0x140014b80]
movdqa xmmword [rbp + 7], xmm1
movdqa xmm1, xmmword [0x140014b90]
movdqa xmmword [rbp + 0x37], xmm0
movdqa xmmword [rbp + 0x27], xmm1
mov dword [rbp + 0x47], 0x727e617c
mov dword [rbp + 0x4b], 0x60702967
mov word [rbp + 0x4f], 0x1365
call fcn.14000257c
lea r8, [rbp - 0x49]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x14000804d
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rbp
ret

Function at 0x140008070
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
movdqa xmm0, xmmword [0x1400148c0]
mov ebx, 0xae
movdqa xmm1, xmmword [0x140014ad0]
mov ecx, ebx
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm0, xmmword [0x140014af0]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm1, xmmword [0x140014c60]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [0x1400148d0]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm1, xmmword [str.r___w__quw_dzp3_rv_crpv_w.1hww___qr3Dz__LCapv__33Dz__LCawfpg3dr]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [0x140014a20]
movdqa xmmword [rbp - 9], xmm1
movdqa xmm1, xmmword [0x140014970]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm0, xmmword [0x140014b30]
movdqa xmmword [rbp + 0x17], xmm1
movdqa xmm1, xmmword [0x140014ce0]
movdqa xmmword [rbp + 0x27], xmm0
movdqa xmmword [rbp + 0x37], xmm1
mov dword [rbp + 0x47], 0x753c337d
mov dword [rbp + 0x4b], 0x727e617c
mov dword [rbp + 0x4f], 0x60702967
mov word [rbp + 0x53], 0x1365
call fcn.14000257c
lea r8, [rbp - 0x59]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008135
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rbp
ret
Function at 0x140008158
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xa0
movdqa xmm0, xmmword [0x1400148c0]
mov ebx, 0x80
movdqa xmm1, xmmword [0x140014ad0]
mov ecx, ebx
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x140014a80]
movdqa xmmword [rax - 0x78], xmm1
movdqa xmm1, xmmword [0x140014c70]
movdqa xmmword [rax - 0x58], xmm1
movdqa xmm1, xmmword [0x140014c00]
movdqa xmmword [rax - 0x68], xmm0
movdqa xmm0, xmmword [0x140014940]
movdqa xmmword [rax - 0x38], xmm1
movdqa xmm1, xmmword [str.fc3_uarg_p_e]
movdqa xmmword [rax - 0x48], xmm0
movdqa xmm0, xmmword [0x140014a60]
movdqa xmmword [rax - 0x18], xmm1
movdqa xmmword [rax - 0x28], xmm0
call fcn.14000257c
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x1400081e3
add rsp, 0xa0
pop rbx
ret

Function at 0x140008200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x1400148c0]
mov ebx, 0x59
movdqa xmm1, xmmword [0x1400149c0]
mov ecx, ebx
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x140014c80]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x140014cc0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x140014ae0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x67727e61
mov dword [rbp - 0xc], 0x65607029
mov byte [rbp - 8], 0x13
call fcn.14000257c
lea r8, [rbp - 0x60]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008279
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret

Function at 0x14000829c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xa0
movdqa xmm0, xmmword [0x1400148c0]
mov ebx, 0x80
movdqa xmm1, xmmword [0x140014ad0]
mov ecx, ebx
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x140014a00]
movdqa xmmword [rax - 0x78], xmm1
movdqa xmm1, xmmword [0x140014c40]
movdqa xmmword [rax - 0x58], xmm1
movdqa xmm1, xmmword [0x140014bf0]
movdqa xmmword [rax - 0x68], xmm0
movdqa xmm0, xmmword [0x140014a30]
movdqa xmmword [rax - 0x38], xmm1
movdqa xmm1, xmmword [str.jcv3_uarg_p_e]
movdqa xmmword [rax - 0x48], xmm0
movdqa xmm0, xmmword [0x1400149a0]
movdqa xmmword [rax - 0x18], xmm1
movdqa xmmword [rax - 0x28], xmm0
call fcn.14000257c
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008327
add rsp, 0xa0
pop rbx
ret
Function at 0x140008344
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x1400148c0]
mov ebx, 0x5f
movdqa xmm1, xmmword [0x140014ad0]
mov ecx, ebx
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x140014ba0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x140014be0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x140014ca0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x3c33677d
mov dword [rbp - 0xc], 0x7e617c75
mov dword [rbp - 8], 0x70296772
mov word [rbp - 4], 0x6560
mov byte [rbp - 2], 0x13
call fcn.14000257c
lea r8, [rbp - 0x60]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x1400083ca
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret

Function at 0x1400083f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
movdqa xmm0, xmmword [0x1400148c0]
mov ebx, 0x4d
movdqa xmm1, xmmword [0x140014ad0]
mov ecx, ebx
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x1400148f0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm1, xmmword [0x140014d20]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0x7c753c33
mov dword [rbp - 0xc], 0x67727e61
mov dword [rbp - 8], 0x65607029
mov byte [rbp - 4], 0x13
call fcn.14000257c
lea r8, [rbp - 0x50]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008460
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x140008480
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x1400148c0]
mov ebx, 0x5e
movdqa xmm1, xmmword [0x140014ad0]
mov ecx, ebx
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x140014c90]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x140014bc0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x140014b40]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x753c3360
mov dword [rbp - 0xc], 0x727e617c
mov dword [rbp - 8], 0x60702967
mov word [rbp - 4], 0x1365
call fcn.14000257c
lea r8, [rbp - 0x60]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008502
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140008528
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x700031
mov dword [rbp - 0x1c], 0x7e007c
mov dword [rbp - 0x18], 0x72007e
mov dword [rbp - 0x14], 0x77007d
lea ecx, [rbx + 9]
mov dword [rbp - 0x10], 0x310060
mov dword [rbp - 0xc], 0x330029
mov dword [rbp - 8], 0x130048
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 5]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140008581
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400085a4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x1400148c0]
mov ebx, 0x5d
movdqa xmm1, xmmword [0x140014ad0]
mov ecx, ebx
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x1400149b0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x140014c30]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x140014960]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x7c753c33
mov dword [rbp - 0xc], 0x67727e61
mov dword [rbp - 8], 0x65607029
mov byte [rbp - 4], 0x13
call fcn.14000257c
lea r8, [rbp - 0x60]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008624
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret

Function at 0x140008648
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x40], 0x7e0031
mov dword [rbp - 0x3c], 0x670076
mov dword [rbp - 0x38], 0x7c007b
mov dword [rbp - 0x34], 0x560077
lea ecx, [rbx + 0x2d]
mov dword [rbp - 0x30], 0x610061
mov dword [rbp - 0x2c], 0x61007c
mov dword [rbp - 0x28], 0x290031
mov dword [rbp - 0x24], 0x500031
mov dword [rbp - 0x20], 0x760061
mov dword [rbp - 0x1c], 0x670072
mov dword [rbp - 0x18], 0x430076
mov dword [rbp - 0x14], 0x7c0061
mov dword [rbp - 0x10], 0x760070
mov dword [rbp - 0xc], 0x600060
mov dword [rbp - 8], 0x310044
mov dword [rbp - 4], 0x13003f
call fcn.14000257c
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xd]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400086e0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret