joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ad54
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x28
mov dword [rbp - 0x30], 0x700030
mov dword [rbp - 0x2c], 0x7d0060
mov dword [rbp - 0x28], 0x610065
mov dword [rbp - 0x24], 0x600077
lea ebx, [rcx - 0x16]
mov dword [rbp - 0x20], 0x7a004d
mov dword [rbp - 0x1c], 0x61007b
mov dword [rbp - 0x18], 0x7d0066
mov dword [rbp - 0x14], 0x6b0060
mov dword [rbp - 0x10], 0x280030
mov dword [rbp - 0xc], 0x120069
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000adc2
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000ade4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x12
mov dword [rbp - 0x50], 0x5d004e
mov dword [rbp - 0x4c], 0x770062
mov dword [rbp - 0x48], 0x730060
mov dword [rbp - 0x44], 0x410032
lea ecx, [rbx + 0x38]
mov dword [rbp - 0x40], 0x74007d
mov dword [rbp - 0x3c], 0x650066
mov dword [rbp - 0x38], 0x600073
mov dword [rbp - 0x34], 0x4e0077
mov dword [rbp - 0x30], 0x62005d
mov dword [rbp - 0x2c], 0x600077
mov dword [rbp - 0x28], 0x320073
mov dword [rbp - 0x24], 0x660041
mov dword [rbp - 0x20], 0x700073
mov dword [rbp - 0x1c], 0x77007e
mov dword [rbp - 0x18], 0x5a004e
mov dword [rbp - 0x14], 0x61007b
mov dword [rbp - 0x10], 0x7d0066
mov dword [rbp - 0xc], 0x6b0060
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0x13]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ae9c
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14000aecc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x55004e
mov dword [rbp - 0x3c], 0x7d007d
mov dword [rbp - 0x38], 0x7e0075
mov dword [rbp - 0x34], 0x4e0077
lea ecx, [rbx + 0x22]
mov dword [rbp - 0x30], 0x7a0051
mov dword [rbp - 0x2c], 0x7d0060
mov dword [rbp - 0x28], 0x77007f
mov dword [rbp - 0x24], 0x47004e
mov dword [rbp - 0x20], 0x770061
mov dword [rbp - 0x1c], 0x320060
mov dword [rbp - 0x18], 0x730056
mov dword [rbp - 0x14], 0x730066
mov dword [rbp - 0x10], 0x12004e
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 8]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000af4f
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x14000af70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x570030
mov dword [rbp - 0x2c], 0x750076
mov dword [rbp - 0x28], 0x510077
mov dword [rbp - 0x24], 0x60007a
lea ecx, [rbx + 0x10]
mov dword [rbp - 0x20], 0x7f007d
mov dword [rbp - 0x1c], 0x67007b
mov dword [rbp - 0x18], 0x30007f
mov dword [rbp - 0x14], 0x490028
mov word [rbp - 0x10], bx
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 1]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000afd4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000aff4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x5f004e
mov dword [rbp - 0x3c], 0x71007b
mov dword [rbp - 0x38], 0x7d0060
mov dword [rbp - 0x34], 0x7d0061
lea ecx, [rbx + 0x26]
mov dword [rbp - 0x30], 0x660074
mov dword [rbp - 0x2c], 0x4e004e
mov dword [rbp - 0x28], 0x760057
mov dword [rbp - 0x24], 0x770075
mov dword [rbp - 0x20], 0x47004e
mov dword [rbp - 0x1c], 0x770061
mov dword [rbp - 0x18], 0x320060
mov dword [rbp - 0x14], 0x730056
mov dword [rbp - 0x10], 0x730066
mov dword [rbp - 0xc], 0x12004e
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xa]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b07e
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000b1dc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.140017710
lea rcx, [rbp + 0x18]
call fcn.14000aecc
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14001a4a8
test eax, eax
jne 0x14000b2e2
lea edi, [rax + 0x12]
mov dword [rbp - 0x30], 0x510030
lea ecx, [rax + 0x16]
mov word [rbp - 0x1c], di
mov dword [rbp - 0x2c], 0x60007a
mov dword [rbp - 0x28], 0x7f007d
mov dword [rbp - 0x24], 0x300077
mov dword [rbp - 0x20], 0x490028
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 7]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b257
mov rdx, rax
mov rcx, rbx
call fcn.140001930
mov edi, 0x10
jmp 0x14000b2b2
lea rdx, str._url_:_
call fcn.140001930
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.1400019bc
mov rcx, qword [rbp - 0x40]
call fcn.140002438
mov r8d, dword [rbp - 0x38]
lea rdx, str.___ts_:_lu_
mov rcx, rbx
call fcn.140001a10
mov r8, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.140017748
mov rcx, rbx
test eax, eax
je 0x14000b27e
mov edx, 0x2c
call fcn.140001a5c
lea rdx, [0x14001be7c]
mov rcx, rbx
call fcn.140001930
lea rcx, [rbp - 0x18]
call fcn.140017704
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14000b300
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.140017710
lea rcx, [rbp + 0x18]
call fcn.14000ab40
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14001a658
test eax, eax
jne 0x14000b409
lea ecx, [rax + 0x18]
mov dword [rbp - 0x30], 0x540030
mov dword [rbp - 0x2c], 0x60007b
lea edi, [rax + 0x12]
mov dword [rbp - 0x28], 0x740077
mov dword [rbp - 0x24], 0x6a007d
mov dword [rbp - 0x20], 0x280030
mov dword [rbp - 0x1c], 0x120049
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 6]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b37e
mov rdx, rax
mov rcx, rbx
call fcn.140001930
mov edi, 0x10
jmp 0x14000b3d9
lea rdx, str._url_:_
call fcn.140001930
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.1400019bc
mov rcx, qword [rbp - 0x40]
call fcn.140002438
mov r8d, dword [rbp - 0x38]
lea rdx, str.___ts_:_lu_
mov rcx, rbx
call fcn.140001a10
mov r8, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.140017748
mov rcx, rbx
test eax, eax
je 0x14000b3a5
mov edx, 0x2c
call fcn.140001a5c
lea rdx, [0x14001be7c]
mov rcx, rbx
call fcn.140001930
lea rcx, [rbp - 0x18]
call fcn.140017704
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14000b4e4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.140017710
lea rcx, [rbp + 0x18]
call fcn.14000ade4
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14001a900
test eax, eax
jne 0x14000b5e6
lea ecx, [rax + 0x14]
mov dword [rbp - 0x30], 0x7d0030
mov dword [rbp - 0x2c], 0x770062
lea edi, [rax + 0x12]
mov dword [rbp - 0x28], 0x730060
mov dword [rbp - 0x24], 0x280030
mov dword [rbp - 0x20], 0x120049
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 8]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b55b
mov rdx, rax
mov rcx, rbx
call fcn.140001930
mov edi, 0x10
jmp 0x14000b5b6
lea rdx, str._url_:_
call fcn.140001930
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.1400019bc
mov rcx, qword [rbp - 0x40]
call fcn.140002438
mov r8d, dword [rbp - 0x38]
lea rdx, str.___ts_:_lu_
mov rcx, rbx
call fcn.140001a10
mov r8, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.140017748
mov rcx, rbx
test eax, eax
je 0x14000b582
mov edx, 0x2c
call fcn.140001a5c
lea rdx, [0x14001be7c]
mov rcx, rbx
call fcn.140001930
lea rcx, [rbp - 0x18]
call fcn.140017704
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14000b604
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.140017710
lea rcx, [rbp + 0x18]
call fcn.14000ac60
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14001a900
test eax, eax
jne 0x14000b70d
lea ecx, [rax + 0x18]
mov dword [rbp - 0x30], 0x7d0030
mov dword [rbp - 0x2c], 0x770062
lea edi, [rax + 0x12]
mov dword [rbp - 0x28], 0x730060
mov dword [rbp - 0x24], 0x4a0055
mov dword [rbp - 0x20], 0x280030
mov dword [rbp - 0x1c], 0x120049
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 6]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b682
mov rdx, rax
mov rcx, rbx
call fcn.140001930
mov edi, 0x10
jmp 0x14000b6dd
lea rdx, str._url_:_
call fcn.140001930
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.1400019bc
mov rcx, qword [rbp - 0x40]
call fcn.140002438
mov r8d, dword [rbp - 0x38]
lea rdx, str.___ts_:_lu_
mov rcx, rbx
call fcn.140001a10
mov r8, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.140017748
mov rcx, rbx
test eax, eax
je 0x14000b6a9
mov edx, 0x2c
call fcn.140001a5c
lea rdx, [0x14001b6f0]
mov rcx, rbx
call fcn.140001930
lea rcx, [rbp - 0x18]
call fcn.140017704
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14000b72c
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x168]
sub rsp, 0x260
mov rsi, r9
mov dword [rsp + 0x40], 0xff
mov r14, r8
lea rax, [rsp + 0x48]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000b80f
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], rbx
lea r8, [rsp + 0x60]
and qword [rsp + 0x28], rbx
xor edx, edx
and qword [rsp + 0x20], rbx
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000b804
lea ebx, [rdi + 1]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call r14
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x60]
and qword [rsp + 0x28], 0
add edi, ebx
and qword [rsp + 0x20], 0
mov edx, edi
mov dword [rsp + 0x40], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14000b7b8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x260]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000b830
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x50
lea rax, [r11 - 0x18]
xor ebx, ebx
mov qword [r11 - 0x28], rax
mov rdi, r9
lea rax, [r11 - 0x14]
mov qword [r11 - 0x30], rbx
mov rsi, r8
mov qword [r11 - 0x38], rax
lea r9d, [rbx + 2]
mov rbp, rdx
mov r14, rcx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000b8c5
mov ecx, dword [rsp + 0x40]
lea edx, [rbx + 1]
call fcn.14000240c
lea rcx, [rsp + 0x40]
mov qword [rdi], rax
mov qword [rsp + 0x30], rcx
lea r9d, [rbx + 2]
mov qword [rsp + 0x28], rax
mov r8, rsi
lea rax, [rsp + 0x44]
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000b8bd
lea ebx, [rax + 1]
jmp 0x14000b8c5
mov rcx, qword [rdi]
call fcn.140002438
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x14000baa0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov ebx, 0x12
mov dword [rbp - 0x60], 0x670042
mov dword [rbp - 0x5c], 0x61007e
mov dword [rbp - 0x58], 0x320077
mov dword [rbp - 0x54], 0x770041
lea ecx, [rbx + 0x44]
mov dword [rbp - 0x50], 0x670071
mov dword [rbp - 0x4c], 0x770060
mov dword [rbp - 0x48], 0x51004e
mov dword [rbp - 0x44], 0x7c007d
mov dword [rbp - 0x40], 0x77007c
mov dword [rbp - 0x3c], 0x660071
mov dword [rbp - 0x38], 0x7d007b
mov dword [rbp - 0x34], 0x41007c
mov dword [rbp - 0x30], 0x7d0066
mov dword [rbp - 0x2c], 0x770060
mov dword [rbp - 0x28], 0x71004e
mov dword [rbp - 0x24], 0x7c007d
mov dword [rbp - 0x20], 0x61007c
mov dword [rbp - 0x1c], 0x7d0066
mov dword [rbp - 0x18], 0x770060
mov dword [rbp - 0x14], 0x76003c
mov dword [rbp - 0x10], 0x660073
mov word [rbp - 0xc], bx
call fcn.140002534
lea r9, [rbp - 0x60]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0x19]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bb6c
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14000bb9c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x600030
mov dword [rbp - 0x2c], 0x620076
mov dword [rbp - 0x28], 0x280030
mov dword [rbp - 0x24], 0x300069
lea ecx, [rbx + 0x14]
mov dword [rbp - 0x20], 0x770061
mov dword [rbp - 0x1c], 0x640060
mov dword [rbp - 0x18], 0x600077
mov dword [rbp - 0x14], 0x300061
mov dword [rbp - 0x10], 0x490028
mov word [rbp - 0xc], bx
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 1]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bc07
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000bc28
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x710030
mov dword [rbp - 0x2c], 0x7c007d
mov dword [rbp - 0x28], 0x61007c
mov dword [rbp - 0x24], 0x7d0066
lea ecx, [rbx + 0x14]
mov dword [rbp - 0x20], 0x770060
mov dword [rbp - 0x1c], 0x76003c
mov dword [rbp - 0x18], 0x660073
mov dword [rbp - 0x14], 0x280030
mov dword [rbp - 0x10], 0x300032
mov word [rbp - 0xc], bx
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 1]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bc93
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000bcb4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x30
mov dword [rbp - 0x30], 0x740030
mov dword [rbp - 0x2c], 0x60007d
mov dword [rbp - 0x28], 0x7b0066
mov dword [rbp - 0x24], 0x77007c
lea ebx, [rcx - 0x1e]
mov dword [rbp - 0x20], 0x300066
mov dword [rbp - 0x1c], 0x690028
mov dword [rbp - 0x18], 0x660030
mov dword [rbp - 0x14], 0x7c0067
mov dword [rbp - 0x10], 0x77007c
mov dword [rbp - 0xc], 0x61007e
mov dword [rbp - 8], 0x280030
mov dword [rbp - 4], 0x120049
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 6]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bd30
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000bd50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov ecx, 0x7c
mov dword [rbp - 0x39], 0x7b0051
mov dword [rbp - 0x35], 0x710061
mov dword [rbp - 0x31], 0x4e007d
mov dword [rbp - 0x2d], 0x7b0051
lea ebx, [rcx - 0x6a]
mov dword [rbp - 0x29], 0x710061
mov dword [rbp - 0x25], 0x32007d
mov dword [rbp - 0x21], 0x7c0053
mov dword [rbp - 0x1d], 0x51006b
mov dword [rbp - 0x19], 0x7c007d
mov dword [rbp - 0x15], 0x77007c
mov dword [rbp - 0x11], 0x660071
mov dword [rbp - 0xd], 0x410032
mov dword [rbp - 9], 0x710077
mov dword [rbp - 5], 0x600067
mov dword [rbp - 1], 0x320077
mov dword [rbp + 3], 0x7d005f
mov dword [rbp + 7], 0x7b0070
mov dword [rbp + 0xb], 0x7b007e
mov dword [rbp + 0xf], 0x6b0066
mov dword [rbp + 0x13], 0x510032
mov dword [rbp + 0x17], 0x7b007e
mov dword [rbp + 0x1b], 0x7c0077
mov dword [rbp + 0x1f], 0x4e0066
mov dword [rbp + 0x23], 0x600062
mov dword [rbp + 0x27], 0x740077
mov dword [rbp + 0x2b], 0x600077
mov dword [rbp + 0x2f], 0x7c0077
mov dword [rbp + 0x33], 0x770071
mov dword [rbp + 0x37], 0x3c0061
mov dword [rbp + 0x3b], 0x7f006a
mov dword [rbp + 0x3f], 0x12007e
call fcn.140002534
lea r9, [rbp - 0x39]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0x2c]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000be67
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14000bea0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x620030
mov dword [rbp - 0x1c], 0x7e0067
mov dword [rbp - 0x18], 0x770061
mov dword [rbp - 0x14], 0x770061
lea ecx, [rbx + 0xe]
mov dword [rbp - 0x10], 0x670071
mov dword [rbp - 0xc], 0x770060
mov dword [rbp - 8], 0x280030
mov dword [rbp - 4], 0x120069
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bf00
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000bf20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x600030
mov dword [rbp - 0x2c], 0x750077
mov dword [rbp - 0x28], 0x61007b
mov dword [rbp - 0x24], 0x600066
lea ecx, [rbx + 0x1a]
mov dword [rbp - 0x20], 0x4d006b
mov dword [rbp - 0x1c], 0x600062
mov dword [rbp - 0x18], 0x74007d
mov dword [rbp - 0x14], 0x7e007b
mov dword [rbp - 0x10], 0x610077
mov dword [rbp - 0xc], 0x280030
mov dword [rbp - 8], 0x120049
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bf95
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000bfb8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x710030
mov dword [rbp - 0x3c], 0x61007b
mov dword [rbp - 0x38], 0x7d0071
mov dword [rbp - 0x34], 0x280030
lea ecx, [rbx + 0x2c]
mov dword [rbp - 0x30], 0x320069
mov dword [rbp - 0x2c], 0x620030
mov dword [rbp - 0x28], 0x770060
mov dword [rbp - 0x24], 0x770074
mov dword [rbp - 0x20], 0x770060
mov dword [rbp - 0x1c], 0x71007c
mov dword [rbp - 0x18], 0x610077
mov dword [rbp - 0x14], 0x6a003c
mov dword [rbp - 0x10], 0x7e007f
mov dword [rbp - 0xc], 0x280030
mov dword [rbp - 8], 0x690032
mov word [rbp - 4], bx
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xd]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c052
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret

Function at 0x14000c078
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x610030
mov dword [rbp - 0x3c], 0x7c007d
mov dword [rbp - 0x38], 0x71007b
mov dword [rbp - 0x34], 0x730065
lea ecx, [rbx + 0x2a]
mov dword [rbp - 0x30], 0x7e007e
mov dword [rbp - 0x2c], 0x280030
mov dword [rbp - 0x28], 0x300069
mov dword [rbp - 0x24], 0x7f0071
mov dword [rbp - 0x20], 0x4d0076
mov dword [rbp - 0x1c], 0x600062
mov dword [rbp - 0x18], 0x74007d
mov dword [rbp - 0x14], 0x7e007b
mov dword [rbp - 0x10], 0x610077
mov dword [rbp - 0xc], 0x280030
mov dword [rbp - 8], 0x120049
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xc]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c109
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000c12c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x760032
mov dword [rbp - 0x1c], 0x61007b
mov dword [rbp - 0x18], 0x7e0062
mov dword [rbp - 0x14], 0x6b0073
lea ecx, [rbx + 0xe]
mov dword [rbp - 0x10], 0x600062
mov dword [rbp - 0xc], 0x74007d
mov dword [rbp - 8], 0x7e007b
mov dword [rbp - 4], 0x120077
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c18c
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret