joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004fad0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
movdqa xmm0, xmmword [0x140061bf0]
mov rsi, r8
movdqu xmmword [rbp - 0x20], xmm0
mov rdi, r9
mov dword [rbp - 0x10], 0x716471
mov r14, rdx
mov rbx, rcx
xor r8d, r8d
mov al, byte [rbp - 0x20]
xor byte [rbp + r8 - 0x1f], al
inc r8
cmp r8, 0x12
jb 0x14004fb0e
xor eax, eax
mov byte [rbp - 0xd], 0
mov byte [rbp - 0x24], al
mov cl, 5
mov dword [rbp - 0x30], 0x7c774605
mov dword [rbp - 0x2c], 0x37367175
mov dword [rbp - 0x28], 0x6969612b
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xb
jae 0x14004fb51
mov cl, byte [rbp - 0x30]
jmp 0x14004fb3f
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x24], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rcx, qword [rbp + 0x48]
mov r8, rdi
mov r9, qword [rbp + 0x30]
mov rdx, rsi
mov qword [rsp + 0x30], rcx
mov ecx, dword [rbp + 0x40]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp + 0x38]
mov qword [rsp + 0x20], rcx
mov rcx, r14
call rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14004fbb4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
mov dword [rbp - 0x20], 0x8012064
mov byte [rbp - 0x14], al
mov rdi, rdx
mov rbx, rcx
mov dword [rbp - 0x1c], 0x22011001
mov r8b, 0x64
mov dword [rbp - 0x18], 0x2501080d
xor byte [rbp + rax - 0x1f], r8b
inc rax
cmp rax, 0xb
jae 0x14004fbfd
mov r8b, byte [rbp - 0x20]
jmp 0x14004fbe9
mov byte [rbp - 0x14], 0
mov cl, 0x12
mov dword [rbp - 0x10], 0x60775912
xor eax, eax
mov dword [rbp - 0xc], 0x217e777c
mov dword [rbp - 8], 0x7e763c20
mov word [rbp - 4], 0x7e
xor byte [rbp + rax - 0xf], cl
inc rax
cmp rax, 0xc
jae 0x14004fc32
mov cl, byte [rbp - 0x10]
jmp 0x14004fc20
lea rdx, [rbp - 0xf]
mov byte [rbp - 3], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x14004fc68
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x140061c50]
xor eax, eax
mov r14, rdx
mov byte [rbp - 0xc], al
movdqu xmmword [rbp - 0x20], xmm0
xor edx, edx
mov dword [rbp - 0x10], 0x53617771
mov rdi, r9
mov esi, r8d
mov rbx, rcx
mov al, byte [rbp - 0x20]
xor byte [rbp + rdx - 0x1f], al
inc rdx
cmp rdx, 0x13
jb 0x14004fcaa
mov byte [rbp - 0xc], 0
mov cl, 6
mov dword [rbp - 0x30], 0x63755306
xor eax, eax
mov dword [rbp - 0x2c], 0x28343574
mov dword [rbp - 0x28], 0x6a6a62
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xa
jae 0x14004fce9
mov cl, byte [rbp - 0x30]
jmp 0x14004fcd7
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x25], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov r9d, dword [rbp + 0x30]
mov r8, rdi
mov edx, esi
mov rcx, r14
call rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x14004fd30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
mov dword [rbp - 0x20], 0x26370a4f
mov byte [rbp - 0x14], al
mov edi, edx
mov rbx, rcx
mov dword [rbp - 0x1c], 0x203d1f3b
mov r8b, 0x4f
mov dword [rbp - 0x18], 0x3c3c2a2c
xor byte [rbp + rax - 0x1f], r8b
inc rax
cmp rax, 0xb
jae 0x14004fd78
mov r8b, byte [rbp - 0x20]
jmp 0x14004fd64
mov byte [rbp - 0x14], 0
mov cl, 0x4a
mov dword [rbp - 0x10], 0x382f014a
xor eax, eax
mov dword [rbp - 0xc], 0x79262f24
mov dword [rbp - 8], 0x262e6478
mov word [rbp - 4], 0x26
xor byte [rbp + rax - 0xf], cl
inc rax
cmp rax, 0xc
jae 0x14004fdad
mov cl, byte [rbp - 0x10]
jmp 0x14004fd9b
lea rdx, [rbp - 0xf]
mov byte [rbp - 3], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov ecx, edi
call rax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x14004fde0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
mov dword [rbp - 0x20], 0x3c3b1452
mov byte [rbp - 0x16], al
mov rdi, rdx
mov rbx, rcx
mov dword [rbp - 0x1c], 0x3d3e1136
mov r8b, 0x52
mov word [rbp - 0x18], 0x3721
xor byte [rbp + rax - 0x1f], r8b
inc rax
cmp rax, 9
jae 0x14004fe28
mov r8b, byte [rbp - 0x20]
jmp 0x14004fe14
mov byte [rbp - 0x16], 0
mov cl, 0x46
mov dword [rbp - 0x10], 0x34230d46
xor eax, eax
mov dword [rbp - 0xc], 0x752a2328
mov dword [rbp - 8], 0x2a226874
mov word [rbp - 4], 0x2a
xor byte [rbp + rax - 0xf], cl
inc rax
cmp rax, 0xc
jae 0x14004fe5d
mov cl, byte [rbp - 0x10]
jmp 0x14004fe4b
lea rdx, [rbp - 0xf]
mov byte [rbp - 3], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x14004fe94
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [str.8QVQJKLQT_y]
mov rdi, r8
movdqu xmmword [rbp - 0x10], xmm0
mov rsi, rdx
mov rbx, rcx
xor r9d, r9d
mov al, byte [rbp - 0x10]
xor byte [rbp + r9 - 0xf], al
inc r9
cmp r9, 0xe
jb 0x14004fec4
mov byte [rbp - 1], 0
mov cl, 0x26
mov dword [rbp - 0x20], 0x54436d26
xor eax, eax
mov dword [rbp - 0x1c], 0x154a4348
mov dword [rbp - 0x18], 0x4a420814
mov word [rbp - 0x14], 0x4a
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x14004ff0a
mov cl, byte [rbp - 0x20]
jmp 0x14004fef8
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x14004ff48
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
mov dword [rbp - 0x10], 0x64634c0a
mov byte [rbp - 2], al
mov rdi, r8
mov rsi, rdx
mov dword [rbp - 0xc], 0x726f446e
mov rbx, rcx
mov dword [rbp - 8], 0x66634c7e
mov r9b, 0xa
mov word [rbp - 4], 0x4b6f
xor byte [rbp + rax - 0xf], r9b
inc rax
cmp rax, 0xd
jae 0x14004ff9f
mov r9b, byte [rbp - 0x10]
jmp 0x14004ff8b
mov byte [rbp - 2], 0
mov cl, 0x10
mov dword [rbp - 0x20], 0x62755b10
xor eax, eax
mov dword [rbp - 0x1c], 0x237c757e
mov dword [rbp - 0x18], 0x7c743e22
mov word [rbp - 0x14], 0x7c
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x14004ffd4
mov cl, byte [rbp - 0x20]
jmp 0x14004ffc2
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1400500c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x140061b80]
mov edi, edx
movdqu xmmword [rbp - 0x20], xmm0
mov rbx, rcx
mov word [rbp - 0x10], 1
xor r8d, r8d
mov al, byte [rbp - 0x20]
xor byte [rbp + r8 - 0x1f], al
inc r8
cmp r8, 0x10
jb 0x1400500f1
mov byte [rbp - 0xf], 0
mov cl, 0x37
mov dword [rbp - 0x30], 0x52446237
xor eax, eax
mov dword [rbp - 0x2c], 0x19050445
mov dword [rbp - 0x28], 0x5b5b53
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xa
jae 0x140050131
mov cl, byte [rbp - 0x30]
jmp 0x14005011f
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x25], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov ecx, edi
call rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140050164
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x140061c00]
mov rdi, r8
movdqu xmmword [rbp - 0x20], xmm0
mov rsi, rdx
mov word [rbp - 0x10], 0x7a
mov rbx, rcx
xor r9d, r9d
mov al, byte [rbp - 0x20]
xor byte [rbp + r9 - 0x1f], al
inc r9
cmp r9, 0x10
jb 0x14005019a
mov byte [rbp - 0xf], 0
mov cl, 0x21
mov dword [rbp - 0x30], 0x53446a21
xor eax, eax
mov dword [rbp - 0x2c], 0x124d444f
mov dword [rbp - 0x28], 0x4d450f13
mov word [rbp - 0x24], 0x4d
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xc
jae 0x1400501e0
mov cl, byte [rbp - 0x30]
jmp 0x1400501ce
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x23], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret

Function at 0x14005021c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x140061bb0]
mov rbx, rcx
movdqu xmmword [rbp - 0x20], xmm0
mov rdi, rdx
mov dword [rbp - 0x10], 0x20292c23
mov word [rbp - 0xc], 4
xor ecx, ecx
mov al, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1f], al
inc rcx
cmp rcx, 0x14
jb 0x140050250
mov byte [rbp - 0xb], 0
mov cl, 0xe
mov dword [rbp - 0x30], 0x786a4f0e
xor eax, eax
mov dword [rbp - 0x2c], 0x3d677e6f
mov dword [rbp - 0x28], 0x626a203c
mov word [rbp - 0x24], 0x62
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xc
jae 0x140050295
mov cl, byte [rbp - 0x30]
jmp 0x140050283
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x23], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x1400502cc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x140061bc0]
mov rbx, rcx
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x35
xor edx, edx
mov al, byte [rbp - 0x20]
xor byte [rbp + rdx - 0x1f], al
inc rdx
cmp rdx, 0x10
jb 0x1400502f1
mov byte [rbp - 0xf], 0
mov cl, 0x67
mov dword [rbp - 0x30], 0x2143267
xor eax, eax
mov dword [rbp - 0x2c], 0x49555415
mov dword [rbp - 0x28], 0xb0b03
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xa
jae 0x140050330
mov cl, byte [rbp - 0x30]
jmp 0x14005031e
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x25], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
call rax
mov rbx, qword [rsp + 0x60]
cdqe
add rsp, 0x50
pop rbp
ret
Function at 0x140050360
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x140061c60]
xor eax, eax
mov rbx, rcx
mov byte [rbp - 8], al
movdqu xmmword [rbp - 0x20], xmm0
xor ecx, ecx
mov dword [rbp - 0x10], 0x49415a49
mov edi, r9d
mov dword [rbp - 0xc], 0x694d444a
mov rsi, r8
mov r14, rdx
mov al, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1f], al
inc rcx
cmp rcx, 0x17
jb 0x1400503a9
mov byte [rbp - 8], 0
mov cl, 0x78
mov dword [rbp - 0x30], 0xa1d3378
xor eax, eax
mov dword [rbp - 0x2c], 0x4b141d16
mov dword [rbp - 0x28], 0x141c564a
mov word [rbp - 0x24], 0x14
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xc
jae 0x1400503ee
mov cl, byte [rbp - 0x30]
jmp 0x1400503dc
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x23], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x140050434
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x140061ae0]
mov rdi, r9
movdqu xmmword [rbp - 0x10], xmm0
mov esi, r8d
mov r14d, edx
mov rbx, rcx
xor r10d, r10d
mov al, byte [rbp - 0x10]
xor byte [rbp + r10 - 0xf], al
inc r10
cmp r10, 0xe
jb 0x14005046b
mov byte [rbp - 1], 0
mov cl, 0x16
mov dword [rbp - 0x20], 0x64735d16
xor eax, eax
mov dword [rbp - 0x1c], 0x257a7378
mov dword [rbp - 0x18], 0x7a723824
mov word [rbp - 0x14], 0x7a
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x1400504b1
mov cl, byte [rbp - 0x20]
jmp 0x14005049f
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov r9d, dword [rbp + 0x30]
mov r8, rdi
mov edx, esi
mov ecx, r14d
call rax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x1400504f8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x140061b90]
mov rsi, r8
movdqu xmmword [rbp - 0x20], xmm0
mov edi, r9d
mov dword [rbp - 0x10], 0x36121a
mov r14, rdx
mov rbx, rcx
xor r8d, r8d
mov al, byte [rbp - 0x20]
xor byte [rbp + r8 - 0x1f], al
inc r8
cmp r8, 0x12
jb 0x140050536
mov byte [rbp - 0xd], 0
mov cl, 0x1b
mov dword [rbp - 0x30], 0x697e501b
xor eax, eax
mov dword [rbp - 0x2c], 0x28777e75
mov dword [rbp - 0x28], 0x777f3529
mov word [rbp - 0x24], 0x77
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xc
jae 0x14005057c
mov cl, byte [rbp - 0x30]
jmp 0x14005056a
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x23], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x1400505c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x140061c30]
mov rdi, rdx
movdqu xmmword [rbp - 0x20], xmm0
mov rbx, rcx
mov word [rbp - 0x10], 0x51
xor r8d, r8d
mov al, byte [rbp - 0x20]
xor byte [rbp + r8 - 0x1f], al
inc r8
cmp r8, 0x10
jb 0x1400505ee
mov byte [rbp - 0xf], 0
mov cl, 0x1c
mov dword [rbp - 0x30], 0x6e79571c
xor eax, eax
mov dword [rbp - 0x2c], 0x2f707972
mov dword [rbp - 0x28], 0x7078322e
mov word [rbp - 0x24], 0x70
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xc
jae 0x140050634
mov cl, byte [rbp - 0x30]
jmp 0x140050622
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x23], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x140050720
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x140061b60]
mov rbx, rcx
movdqu xmmword [rbp - 0x20], xmm0
mov rdi, rdx
mov dword [rbp - 0x10], 0x2b2a3f2a
mov word [rbp - 0xc], 0x2d
xor ecx, ecx
mov al, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1f], al
inc rcx
cmp rcx, 0x14
jb 0x140050754
mov byte [rbp - 0xb], 0
mov cl, 0x3d
mov dword [rbp - 0x30], 0x4f58763d
xor eax, eax
mov dword [rbp - 0x2c], 0xe515853
mov dword [rbp - 0x28], 0x5159130f
mov word [rbp - 0x24], 0x51
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xc
jae 0x140050799
mov cl, byte [rbp - 0x30]
jmp 0x140050787
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x23], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x1400507d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [str.o__ne_]
mov rdi, r9
movdqu xmmword [rbp - 0x10], xmm0
mov rsi, r8
mov r14, rdx
mov rbx, rcx
xor r10d, r10d
mov al, byte [rbp - 0x10]
xor byte [rbp + r10 - 0xf], al
inc r10
cmp r10, 0xe
jb 0x140050807
mov byte [rbp - 1], 0
mov cl, 0x63
mov dword [rbp - 0x20], 0x11062863
xor eax, eax
mov dword [rbp - 0x1c], 0x500f060d
mov dword [rbp - 0x18], 0xf074d51
mov word [rbp - 0x14], 0xf
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x14005084d
mov cl, byte [rbp - 0x20]
jmp 0x14005083b
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140050ac4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x140061c20]
mov rbx, rcx
xor ecx, ecx
mov dword [rbp - 0x10], 0x50666061
mov rdi, rdx
mov word [rbp - 0xc], 0x6d
movdqu xmmword [rbp - 0x20], xmm0
lea edx, [rcx + 0x14]
mov al, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1f], al
inc rcx
cmp rcx, rdx
jb 0x140050afb
mov byte [rbp - 0xb], 0
xor eax, eax
mov dword [rbp - 0x30], 0x66715f14
mov dword [rbp - 0x2c], 0x2778717a
mov dword [rbp - 0x28], 0x78703a26
mov word [rbp - 0x24], 0x78
xor byte [rbp + rax - 0x2f], dl
inc rax
cmp rax, 0xc
jae 0x140050b3d
mov dl, byte [rbp - 0x30]
jmp 0x140050b2b
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x23], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x140050b74
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp - 0x10], 0x56557e39
mov rbx, rcx
mov dword [rbp - 0xc], 0x6c55585b
mov r8b, 0x39
mov dword [rbp - 8], 0x5a565557
mov word [rbp - 4], 0x52
xor eax, eax
xor byte [rbp + rax - 0xf], r8b
inc rax
cmp rax, 0xc
jae 0x140050bc0
mov r8b, byte [rbp - 0x10]
jmp 0x140050bac
mov byte [rbp - 3], 0
mov cl, 0x67
mov dword [rbp - 0x20], 0x15022c67
xor eax, eax
mov dword [rbp - 0x1c], 0x540b0209
mov dword [rbp - 0x18], 0xb034955
mov word [rbp - 0x14], 0xb
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x140050bf5
mov cl, byte [rbp - 0x20]
jmp 0x140050be3
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x140050c2c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x140061b50]
mov rbx, rcx
movdqu xmmword [rbp - 0x20], xmm0
mov edi, r9d
mov dword [rbp - 0x10], 0x90f0404
mov esi, r8d
mov dword [rbp - 0xc], 0x405031e
mov r14, rdx
mov word [rbp - 8], 0x2b
xor ecx, ecx
mov al, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1f], al
inc rcx
cmp rcx, 0x18
jb 0x140050c76
xor eax, eax
mov byte [rbp - 7], 0
mov byte [rbp - 0x24], al
mov cl, 0x56
mov dword [rbp - 0x30], 0x383f2156
mov dword [rbp - 0x2c], 0x2233383f
mov dword [rbp - 0x28], 0x3a3a3278
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xb
jae 0x140050cb8
mov cl, byte [rbp - 0x30]
jmp 0x140050ca6
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x24], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov r8d, edi
mov edx, esi
mov rcx, r14
call rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x140050cfc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x140061be0]
xor eax, eax
mov rdi, rdx
mov byte [rbp - 0xc], al
movdqu xmmword [rbp - 0x20], xmm0
xor edx, edx
mov dword [rbp - 0x10], 0x424b4349
mov rbx, rcx
mov al, byte [rbp - 0x20]
xor byte [rbp + rdx - 0x1f], al
inc rdx
cmp rdx, 0x13
jb 0x140050d2f
xor eax, eax
mov byte [rbp - 0xc], 0
mov byte [rbp - 0x24], al
mov cl, 0x36
mov dword [rbp - 0x30], 0x585f4136
mov dword [rbp - 0x2c], 0x4253585f
mov dword [rbp - 0x28], 0x5a5a5218
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xb
jae 0x140050d71
mov cl, byte [rbp - 0x30]
jmp 0x140050d5f
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x24], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140050e88
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
movdqa xmm0, xmmword [0x140061c40]
mov rdi, r9
movdqu xmmword [rbp - 0x20], xmm0
mov rsi, r8
mov word [rbp - 0x10], 0x54
mov r14, rdx
mov rbx, rcx
xor r10d, r10d
mov al, byte [rbp - 0x20]
xor byte [rbp + r10 - 0x1f], al
inc r10
cmp r10, 0x10
jb 0x140050ec5
xor eax, eax
mov byte [rbp - 0xf], 0
mov byte [rbp - 0x24], al
mov cl, 0x60
mov dword [rbp - 0x30], 0xe091760
mov dword [rbp - 0x2c], 0x14050e09
mov dword [rbp - 0x28], 0xc0c044e
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xb
jae 0x140050f08
mov cl, byte [rbp - 0x30]
jmp 0x140050ef6
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x24], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rcx, qword [rbp + 0x40]
mov r8, rdi
mov r9d, dword [rbp + 0x30]
mov rdx, rsi
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x38]
mov dword [rsp + 0x20], ecx
mov rcx, r14
call rax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x140050f60
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x140061bd0]
mov edi, r9d
movdqu xmmword [rbp - 0x20], xmm0
mov rsi, r8
mov word [rbp - 0x10], 0x3f
mov r14, rdx
mov rbx, rcx
xor r10d, r10d
mov al, byte [rbp - 0x20]
xor byte [rbp + r10 - 0x1f], al
inc r10
cmp r10, 0x10
jb 0x140050f9d
xor eax, eax
mov byte [rbp - 0xf], 0
mov byte [rbp - 0x24], al
mov cl, 0x39
mov dword [rbp - 0x30], 0x57504e39
mov dword [rbp - 0x2c], 0x4d5c5750
mov dword [rbp - 0x28], 0x55555d17
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xb
jae 0x140050fe0
mov cl, byte [rbp - 0x30]
jmp 0x140050fce
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x24], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov r9, qword [rbp + 0x30]
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret