joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400114b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x14010d098]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400f9210]
movdqu xmmword [rbp - 0x11], xmm0
movdqa xmm1, xmmword [0x1400f9050]
movdqu xmmword [rbp - 1], xmm1
movdqa xmm0, xmmword [0x1400f90c0]
movdqu xmmword [rbp + 0xf], xmm0
mov dword [rbp + 0x1f], 0x73171573
mov word [rbp + 0x23], 0x6515
xor eax, eax
mov byte [rbp + 0x25], al
xor ebx, ebx
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp - 0x11]
xor byte [rbp + rcx - 0x10], al
inc rcx
cmp rcx, 0x35
jb 0x140011520
mov byte [rbp + 0x25], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x10]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140011551
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x27]
call fcn.140008c40
nop
movdqa xmm0, xmmword [0x1400f8700]
movdqu xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400f88a0]
movdqu xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [0x1400f8930]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0xa6e6c0a
mov word [rbp - 0x15], 0x1c6c
xor eax, eax
mov byte [rbp - 0x13], al
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rbx - 0x48], al
inc rbx
cmp rbx, 0x35
jb 0x1400115a1
mov byte [rbp - 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 1], xmm1
lea rax, [rbp - 0x48]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400115d0
mov r8, rdi
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x11]
call fcn.140008c40
nop
cmp byte [0x14010e55a], 0
je 0x140011625
lea r8, [0x14010ef00]
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0x27]
call fcn.14000fac0
mov byte [0x14010e5c5], 0
mov byte [0x14010e5c4], 0
mov byte [0x14010e5c7], 0
mov byte [0x14010e5d7], 0
jmp 0x140011636
lea rdx, [rbp + 0x27]
lea rcx, [0x14010ef00]
call fcn.140010380
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x140011675
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001166f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001166f
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x1400116b3
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400116ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400116ae
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400d2320
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400116e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x14010d098]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400f8670]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400f8800]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400f90a0]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x3101a03
mov dword [rbp + 0x1b], 0x15031361
mov dword [rbp + 0x1f], 0x15170360
xor eax, eax
mov byte [rbp + 0x23], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x140011750
mov byte [rbp + 0x23], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140011781
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.140008c40
nop
movdqa xmm0, xmmword [0x1400f8810]
movdqu xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400f8660]
movdqu xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400f9250]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x13000a13
mov dword [rbp - 0x25], 0x5130371
mov dword [rbp - 0x21], 0x5071370
xor eax, eax
mov byte [rbp - 0x1d], al
nop dword [rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x3b
jb 0x1400117e0
mov byte [rbp - 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140011810
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x19]
call fcn.140008c40
nop
cmp byte [0x14010e5d6], 0
je 0x140011850
lea r8, [0x14010ee28]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.14000fac0
mov byte [0x14010e55b], 0
jmp 0x140011861
lea rdx, [rbp + 0x27]
lea rcx, [0x14010ee28]
call fcn.140010380
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x1400118a0
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001189a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001189a
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x1400118de
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400118d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400118d9
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400d2320
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140011900
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x14010d098]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400f90b0]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400f9290]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400f8600]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x66757f66
mov dword [rbp + 0x1b], 0x70667604
mov dword [rbp + 0x1f], 0x70726605
xor eax, eax
mov byte [rbp + 0x23], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x140011970
mov byte [rbp + 0x23], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x1400119a1
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.140008c40
nop
movdqa xmm0, xmmword [0x1400f88d0]
movdqu xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400f8760]
movdqu xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400f92e0]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x1c0f051c
mov dword [rbp - 0x25], 0xa1c0c7e
mov dword [rbp - 0x21], 0xa081c7f
xor eax, eax
mov byte [rbp - 0x1d], al
nop dword [rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x3b
jb 0x140011a00
mov byte [rbp - 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140011a30
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x19]
call fcn.140008c40
nop
cmp byte [0x14010e55b], 0
je 0x140011a70
lea r8, [0x14010ee28]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.14000fac0
mov byte [0x14010e5d6], 0
jmp 0x140011a81
lea rdx, [rbp + 0x27]
lea rcx, [0x14010ee28]
call fcn.140010380
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x140011ac0
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011aba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011aba
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140011afe
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011af9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011af9
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400d2320
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140011e90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x14010d098]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400f8a70]
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400f8ca0]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400f8cd0]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400f8a80]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400f8b90]
movdqa xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x3a4f2a4c
xor eax, eax
mov byte [rbp - 5], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rcx - 0x58], al
inc rcx
cmp rcx, 0x53
jb 0x140011f10
mov byte [rbp - 5], bl
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x58]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140011f41
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 7]
call fcn.140008c40
nop
movdqa xmm0, xmmword [0x1400f8c00]
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400f8ab0]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400f8b10]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400f8bf0]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400f89a0]
movdqa xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x285d385e
xor eax, eax
mov byte [rbp - 5], al
nop word [rax + rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x53
jb 0x140011fb0
mov byte [rbp - 5], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140011fe0
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x27]
call fcn.140008c40
nop
cmp byte [0x14010e5d4], 0
je 0x140012019
lea r8, [0x14010ee10]
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.14000fac0
jmp 0x14001202a
lea rdx, [rbp + 7]
lea rcx, [0x14010ee10]
call fcn.140010380
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140012069
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012063
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012063
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x1400120a7
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400120a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400120a2
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400d2320
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400120d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x14010d098]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400f92c0]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [str.jjzjjzjeznjzjjz]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400f90f0]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x7a1f697a
mov dword [rbp + 0x1b], 0x6a7a6a6a
mov dword [rbp + 0x1f], 0x1b6a7a6a
xor eax, eax
mov byte [rbp + 0x23], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x140012140
mov byte [rbp + 0x23], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140012171
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.140008c40
nop
movdqa xmm0, xmmword [0x1400f8c60]
movdqu xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400f9020]
movdqu xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400f8a40]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x3b5e283b
mov dword [rbp - 0x25], 0x2b3b2b2b
mov dword [rbp - 0x21], 0x5a2b3b2b
xor eax, eax
mov byte [rbp - 0x1d], al
nop dword [rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x3b
jb 0x1400121d0
mov byte [rbp - 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140012200
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x19]
call fcn.140008c40
nop
cmp byte [0x14010e5d1], 0
je 0x140012239
lea r8, [0x14010edb0]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.14000fac0
jmp 0x14001224a
lea rdx, [rbp + 0x27]
lea rcx, [0x14010edb0]
call fcn.140010380
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x140012289
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012283
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012283
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x1400122c7
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400122c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400122c2
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400d2320
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400122f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x14010d098]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400f8740]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400f8910]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [str.h_fih_f]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400f8770]
movdqa xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x6d0c1c14
mov dword [rbp - 5], 0x1d690c1c
xor eax, eax
mov byte [rbp - 1], al
xor ebx, ebx
mov ecx, ebx
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rcx - 0x48], al
inc rcx
cmp rcx, 0x47
jb 0x140012360
mov byte [rbp - 1], bl
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x48]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140012391
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 7]
call fcn.140008c40
nop
movdqa xmm0, xmmword [0x1400f8650]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400f87a0]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [0x1400f87b0]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400f8640]
movdqa xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x6302121a
mov dword [rbp - 5], 0x13670212
xor eax, eax
mov byte [rbp - 1], al
nop
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rbx - 0x48], al
inc rbx
cmp rbx, 0x47
jb 0x1400123f0
mov byte [rbp - 1], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x48]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140012420
mov r8, rdi
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x27]
call fcn.140008c40
nop
cmp byte [0x14010e5b6], 0
je 0x140012459
lea r8, [0x14010ede0]
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.14000fac0
jmp 0x14001246a
lea rdx, [rbp + 7]
lea rcx, [0x14010ede0]
call fcn.140010380
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x1400124a9
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400124a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400124a3
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x1400124e7
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400124e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400124e2
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400d2320
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140012510
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x14010d098]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400f8c70]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400f8b30]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400f8a60]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x3c2c2c3c
mov dword [rbp + 0x1b], 0x293c2c2c
mov dword [rbp + 0x1f], 0x2f593c2c
xor eax, eax
mov byte [rbp + 0x23], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x140012580
mov byte [rbp + 0x23], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x1400125b1
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.140008c40
nop
movdqa xmm0, xmmword [0x1400f8db0]
movdqu xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400f8f20]
movdqu xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400f8ea0]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x45555545
mov dword [rbp - 0x25], 0x50455555
mov dword [rbp - 0x21], 0x56204555
xor eax, eax
mov byte [rbp - 0x1d], al
nop dword [rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x3b
jb 0x140012610
mov byte [rbp - 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140012640
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x19]
call fcn.140008c40
nop
cmp byte [0x14010e55e], 0
je 0x140012679
lea r8, [0x14010edf8]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.14000fac0
jmp 0x14001268a
lea rdx, [rbp + 0x27]
lea rcx, [0x14010edf8]
call fcn.140010380
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x1400126c9
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400126c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400126c3
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140012707
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012702
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012702
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400d2320
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140013620
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x14010d098]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400f8ce0]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400f8ff0]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400f8ac0]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x3f2f2f3f
mov dword [rbp + 0x1b], 0x2f3f2f2f
mov dword [rbp + 0x1f], 0x5e2e3f2f
xor eax, eax
mov byte [rbp + 0x23], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x140013690
mov byte [rbp + 0x23], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x1400136c1
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.140008c40
nop
movdqa xmm0, xmmword [0x1400f8960]
movdqu xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400f9310]
movdqu xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400f8780]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x1f0f0f1f
mov dword [rbp - 0x25], 0xf1f0f0f
mov dword [rbp - 0x21], 0x7e0e1f0f
xor eax, eax
mov byte [rbp - 0x1d], al
nop dword [rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x3b
jb 0x140013720
mov byte [rbp - 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140013750
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x19]
call fcn.140008c40
nop
cmp byte [0x14010e56f], 0
je 0x140013789
lea r8, [0x14010eed0]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.14000fac0
jmp 0x14001379a
lea rdx, [rbp + 0x27]
lea rcx, [0x14010eed0]
call fcn.140010380
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x1400137d9
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400137d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400137d3
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140013817
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013812
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013812
call qword [0x1400d8cc0]
int3
call fcn.1400d2348
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400d2320
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret