joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bb54
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x7200
mov dword [rbp - 0x20], 0x722c7222
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x72747222
mov dword [rbp - 0x18], 0x72227273
mov dword [rbp - 0x14], 0x7225723a
mov dword [rbp - 0x10], 0x7275726c
mov dword [rbp - 0xc], 0x722c727d
mov dword [rbp - 4], 0x8fc17200
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bbb4
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000bbd4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov ecx, 0x50
mov dword [rbp - 0x60], 0x72b872ab
mov dword [rbp - 0x5c], 0x72927287
mov ebx, 0x72f7
mov dword [rbp - 0x58], 0x72967285
mov dword [rbp - 0x54], 0x72a472d7
mov dword [rbp - 0x50], 0x72917298
mov dword [rbp - 0x4c], 0x72807283
mov dword [rbp - 0x48], 0x72857296
mov dword [rbp - 0x44], 0x72ab7292
mov dword [rbp - 0x40], 0x728772b8
mov dword [rbp - 0x3c], 0x72857292
mov dword [rbp - 0x38], 0x72d77296
mov dword [rbp - 0x34], 0x72af72b0
mov dword [rbp - 0x30], 0x72a472d7
mov dword [rbp - 0x2c], 0x72967283
mov dword [rbp - 0x28], 0x729b7295
mov dword [rbp - 0x24], 0x72ab7292
mov dword [rbp - 0x20], 0x729e72bf
mov dword [rbp - 0x1c], 0x72837284
mov dword [rbp - 0x18], 0x72857298
mov dword [rbp - 0x14], 0x72f7728e
mov dword [rbp - 0x10], 0x8fc172f7
call fcn.1400026b0
lea r9, [rbp - 0x60]
mov rdx, rax
sub r9, rax
mov r8d, 0x28
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bca4
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14000bcd8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72b6
mov dword [rbp - 0x20], 0x72df7294
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x72ce72d3
mov dword [rbp - 0x18], 0x72da72c6
mov dword [rbp - 0x14], 0x72c472d9
mov dword [rbp - 0x10], 0x729472d3
mov dword [rbp - 0xc], 0x72ed728c
mov dword [rbp - 4], 0x8fc172b6
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bd38
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000bd58
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72ea
mov dword [rbp - 0x20], 0x72c672c8
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x729e72c8
mov dword [rbp - 0x18], 0x72c87299
mov dword [rbp - 0x14], 0x72cf72d0
mov dword [rbp - 0x10], 0x729f7286
mov dword [rbp - 0xc], 0x72c67297
mov dword [rbp - 4], 0x8fc172ea
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bdb8
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000bdd8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x728d72c0
mov dword [rbp - 0x1c], 0x72877292
mov ebx, 0x72e2
mov dword [rbp - 0x18], 0x72837290
mov dword [rbp - 0x14], 0x72d872c0
mov dword [rbp - 0x10], 0x72e272b9
mov dword [rbp - 0xc], 0x8fc172e2
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000be2e
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000be50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72d4
mov dword [rbp - 0x20], 0x72f872f6
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x72a072f6
mov dword [rbp - 0x18], 0x72f672a7
mov dword [rbp - 0x14], 0x72f172ee
mov dword [rbp - 0x10], 0x72a172b8
mov dword [rbp - 0xc], 0x72f872a9
mov dword [rbp - 4], 0x8fc172d4
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000beb0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000bed0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x72e77283
mov dword [rbp - 0x1c], 0x72d372c8
mov ebx, 0x72a1
mov dword [rbp - 0x18], 0x72c772c4
mov dword [rbp - 0x14], 0x72d972ce
mov dword [rbp - 0x10], 0x729b7283
mov dword [rbp - 0xc], 0x72a172fa
mov dword [rbp - 8], 0x8fc172a1
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bf2d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000bf4c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72be
mov dword [rbp - 0x20], 0x7292729c
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x72ca729c
mov dword [rbp - 0x18], 0x729c72cd
mov dword [rbp - 0x14], 0x729b7284
mov dword [rbp - 0x10], 0x72cb72d2
mov dword [rbp - 0xc], 0x729272c3
mov dword [rbp - 4], 0x8fc172be
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bfac
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000bfcc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x72e1
mov dword [rbp - 0x50], 0x72ae72bd
mov ecx, 0x4a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x4c], 0x72847291
mov dword [rbp - 0x48], 0x72807293
mov dword [rbp - 0x44], 0x72b272c1
mov dword [rbp - 0x40], 0x7287728e
mov dword [rbp - 0x3c], 0x72967295
mov dword [rbp - 0x38], 0x72937280
mov dword [rbp - 0x34], 0x72bd7284
mov dword [rbp - 0x30], 0x729172ae
mov dword [rbp - 0x2c], 0x72937284
mov dword [rbp - 0x28], 0x72c17280
mov dword [rbp - 0x24], 0x729572b2
mov dword [rbp - 0x20], 0x72837280
mov dword [rbp - 0x1c], 0x7284728d
mov dword [rbp - 0x18], 0x72a972bd
mov dword [rbp - 0x14], 0x72927288
mov dword [rbp - 0x10], 0x728e7295
mov dword [rbp - 0xc], 0x72987293
mov dword [rbp - 4], 0x8fc172e1
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x25
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c08e
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14000c0bc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x72cc
mov dword [rbp - 0x30], 0x728972ee
mov ecx, 0x22
mov dword [rbp - 0x10], ebx
mov dword [rbp - 0x2c], 0x72ab72a8
mov dword [rbp - 0x28], 0x728f72a9
mov dword [rbp - 0x24], 0x72be72a4
mov dword [rbp - 0x20], 0x72a172a3
mov dword [rbp - 0x1c], 0x72b972a5
mov dword [rbp - 0x18], 0x72ee72a1
mov dword [rbp - 0x14], 0x729772f6
mov dword [rbp - 0xc], 0x8fc172cc
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x11
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c12a
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000c14c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x38
mov dword [rbp - 0x40], 0x72867297
mov dword [rbp - 0x3c], 0x72a872a2
mov ebx, 0x72cb
mov dword [rbp - 0x38], 0x72a472b9
mov dword [rbp - 0x34], 0x72a472b8
mov dword [rbp - 0x30], 0x72bf72ad
mov dword [rbp - 0x2c], 0x72977297
mov dword [rbp - 0x28], 0x72af728e
mov dword [rbp - 0x24], 0x72ae72ac
mov dword [rbp - 0x20], 0x729e7297
mov dword [rbp - 0x1c], 0x72ae72b8
mov dword [rbp - 0x18], 0x72eb72b9
mov dword [rbp - 0x14], 0x72aa728f
mov dword [rbp - 0x10], 0x72aa72bf
mov dword [rbp - 0xc], 0x72cb7297
mov dword [rbp - 8], 0x8fc172cb
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1c
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c1e1
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000c200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72a8
mov dword [rbp - 0x20], 0x7284728a
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x72dc728a
mov dword [rbp - 0x18], 0x728a72db
mov dword [rbp - 0x14], 0x728d7292
mov dword [rbp - 0x10], 0x72dd72c4
mov dword [rbp - 0xc], 0x728472d5
mov dword [rbp - 4], 0x8fc172a8
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c260
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000c280
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x28
mov dword [rbp - 0x30], 0x72697229
mov dword [rbp - 0x2c], 0x72647279
mov ebx, 0x720b
mov dword [rbp - 0x28], 0x7278727c
mov dword [rbp - 0x24], 0x7279726e
mov dword [rbp - 0x20], 0x72637254
mov dword [rbp - 0x1c], 0x72787262
mov dword [rbp - 0x18], 0x7264727f
mov dword [rbp - 0x14], 0x72727279
mov dword [rbp - 0x10], 0x72317229
mov dword [rbp - 0xc], 0x720b7270
mov dword [rbp - 8], 0x8fc1720b
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c2f9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000c318
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x728c
mov dword [rbp - 0x20], 0x72cf72ae
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x72fe72e4
mov dword [rbp - 0x18], 0x72e172e3
mov dword [rbp - 0x14], 0x72ae72e9
mov dword [rbp - 0x10], 0x72d772b6
mov dword [rbp - 8], 0x8fc1728c
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c371
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000c404
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14000e958
lea rcx, [rbp + 0x18]
call fcn.14000c14c
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14000f99c
test eax, eax
jne 0x14000c53b
lea rcx, [rbp + 0x18]
call fcn.14000c0bc
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e990
test eax, eax
jne 0x14000c51f
mov edi, 0x72d0
mov ecx, 0x12
mov dword [rbp - 0x30], 0x72f272ab
mov dword [rbp - 0x2c], 0x72a272a5
mov dword [rbp - 0x28], 0x72f272bc
mov dword [rbp - 0x24], 0x72f272ea
mov dword [rbp - 0x20], edi
mov dword [rbp - 0x1c], 0x8fc172d0
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 9
mov ecx, edi
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c4b8
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.140001a1c
mov rcx, qword [rbp - 0x40]
call fcn.1400025b4
lea rcx, [rbp + 0x18]
call fcn.14000be50
mov r8d, dword [rbp - 0x38]
mov rdx, rax
mov rcx, rbx
call fcn.140001a70
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e990
test eax, eax
je 0x14000c478
mov edx, 0x2c
mov rcx, rbx
call fcn.140001abc
lea rdx, [0x140011dc4]
mov rcx, rbx
call fcn.140001990
lea rcx, [rbp - 0x18]
call fcn.14000e94c
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000c55c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14000e958
lea rcx, [rbp + 0x18]
call fcn.14000ba28
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14000f99c
test eax, eax
jne 0x14000c693
lea rcx, [rbp + 0x18]
call fcn.14000c318
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e990
test eax, eax
jne 0x14000c677
mov edi, 0x7290
mov ecx, 0x12
mov dword [rbp - 0x30], 0x72b272eb
mov dword [rbp - 0x2c], 0x72e272e5
mov dword [rbp - 0x28], 0x72b272fc
mov dword [rbp - 0x24], 0x72b272aa
mov dword [rbp - 0x20], edi
mov dword [rbp - 0x1c], 0x8fc17290
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 9
mov ecx, edi
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c610
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.140001a1c
mov rcx, qword [rbp - 0x40]
call fcn.1400025b4
lea rcx, [rbp + 0x18]
call fcn.14000b8f8
mov r8d, dword [rbp - 0x38]
mov rdx, rax
mov rcx, rbx
call fcn.140001a70
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e990
test eax, eax
je 0x14000c5d0
mov edx, 0x2c
mov rcx, rbx
call fcn.140001abc
lea rdx, [0x140011dc4]
mov rcx, rbx
call fcn.140001990
lea rcx, [rbp - 0x18]
call fcn.14000e94c
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000c6b4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14000e958
lea rcx, [rbp + 0x18]
call fcn.14000b978
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14000fb4c
test eax, eax
jne 0x14000c7eb
lea rcx, [rbp + 0x18]
call fcn.14000bed0
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e990
test eax, eax
jne 0x14000c7cf
mov edi, 0x72a4
mov ecx, 0x12
mov dword [rbp - 0x30], 0x728672df
mov dword [rbp - 0x2c], 0x72d672d1
mov dword [rbp - 0x28], 0x728672c8
mov dword [rbp - 0x24], 0x7286729e
mov dword [rbp - 0x20], edi
mov dword [rbp - 0x1c], 0x8fc172a4
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 9
mov ecx, edi
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c768
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.140001a1c
mov rcx, qword [rbp - 0x40]
call fcn.1400025b4
lea rcx, [rbp + 0x18]
call fcn.14000c200
mov r8d, dword [rbp - 0x38]
mov rdx, rax
mov rcx, rbx
call fcn.140001a70
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e990
test eax, eax
je 0x14000c728
mov edx, 0x2c
mov rcx, rbx
call fcn.140001abc
lea rdx, [0x140011dc4]
mov rcx, rbx
call fcn.140001990
lea rcx, [rbp - 0x18]
call fcn.14000e94c
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000c80c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14000e958
lea rcx, [rbp - 0x18]
call fcn.14000fc84
test eax, eax
jne 0x14000c937
lea rcx, [rbp + 0x18]
call fcn.14000bcd8
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e990
test eax, eax
jne 0x14000c91b
mov edi, 0x72ba
mov ecx, 0x12
mov dword [rbp - 0x30], 0x729872c1
mov dword [rbp - 0x2c], 0x72c872cf
mov dword [rbp - 0x28], 0x729872d6
mov dword [rbp - 0x24], 0x72987280
mov dword [rbp - 0x20], edi
mov dword [rbp - 0x1c], 0x8fc172ba
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 9
mov ecx, edi
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c8b4
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.140001a1c
mov rcx, qword [rbp - 0x40]
call fcn.1400025b4
lea rcx, [rbp + 0x18]
call fcn.14000bf4c
mov r8d, dword [rbp - 0x38]
mov rdx, rax
mov rcx, rbx
call fcn.140001a70
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e990
test eax, eax
je 0x14000c874
mov edx, 0x2c
mov rcx, rbx
call fcn.140001abc
lea rdx, [0x140011dc4]
mov rcx, rbx
call fcn.140001990
lea rcx, [rbp - 0x18]
call fcn.14000e94c
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000c958
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14000e958
lea rcx, [rbp + 0x18]
call fcn.14000bfcc
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14000fdf4
test eax, eax
jne 0x14000ca8f
lea rcx, [rbp + 0x18]
call fcn.14000bdd8
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e990
test eax, eax
jne 0x14000ca73
mov edi, 0x72e6
mov ecx, 0x12
mov dword [rbp - 0x30], 0x72c4729d
mov dword [rbp - 0x2c], 0x72947293
mov dword [rbp - 0x28], 0x72c4728a
mov dword [rbp - 0x24], 0x72c472dc
mov dword [rbp - 0x20], edi
mov dword [rbp - 0x1c], 0x8fc172e6
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 9
mov ecx, edi
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ca0c
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.140001a1c
mov rcx, qword [rbp - 0x40]
call fcn.1400025b4
lea rcx, [rbp + 0x18]
call fcn.14000bd58
mov r8d, dword [rbp - 0x38]
mov rdx, rax
mov rcx, rbx
call fcn.140001a70
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e990
test eax, eax
je 0x14000c9cc
mov edx, 0x2c
mov rcx, rbx
call fcn.140001abc
lea rdx, [0x140011dc4]
mov rcx, rbx
call fcn.140001990
lea rcx, [rbp - 0x18]
call fcn.14000e94c
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000cab0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14000e958
lea rcx, [rbp + 0x18]
call fcn.14000bbd4
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14000fdf4
test eax, eax
jne 0x14000cbe7
lea rcx, [rbp + 0x18]
call fcn.14000bad8
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e990
test eax, eax
jne 0x14000cbcb
mov edi, 0x72fc
mov ecx, 0x12
mov dword [rbp - 0x30], 0x72de7287
mov dword [rbp - 0x2c], 0x728e7289
mov dword [rbp - 0x28], 0x72de7290
mov dword [rbp - 0x24], 0x72de72c6
mov dword [rbp - 0x20], edi
mov dword [rbp - 0x1c], 0x8fc172fc
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 9
mov ecx, edi
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000cb64
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.140001a1c
mov rcx, qword [rbp - 0x40]
call fcn.1400025b4
lea rcx, [rbp + 0x18]
call fcn.14000bb54
mov r8d, dword [rbp - 0x38]
mov rdx, rax
mov rcx, rbx
call fcn.140001a70
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e990
test eax, eax
je 0x14000cb24
mov edx, 0x2c
mov rcx, rbx
call fcn.140001abc
lea rdx, [0x14001151c]
mov rcx, rbx
call fcn.140001990
lea rcx, [rbp - 0x18]
call fcn.14000e94c
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14000cc08
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x168]
sub rsp, 0x260
mov rsi, r9
mov dword [rsp + 0x40], 0xff
mov r14, r8
lea rax, [rsp + 0x48]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000cceb
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], rbx
lea r8, [rsp + 0x60]
and qword [rsp + 0x28], rbx
xor edx, edx
and qword [rsp + 0x20], rbx
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000cce0
lea ebx, [rdi + 1]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call r14
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x60]
and qword [rsp + 0x28], 0
add edi, ebx
and qword [rsp + 0x20], 0
mov edx, edi
mov dword [rsp + 0x40], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14000cc94
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x260]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret