joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004438
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x73f473df
mov dword [rbp - 0x2c], 0x73d273e5
mov ebx, 0x7391
mov dword [rbp - 0x28], 0x73ff73fe
mov dword [rbp - 0x24], 0x73f473ff
mov dword [rbp - 0x20], 0x73e573f2
mov dword [rbp - 0x1c], 0x73fe73f8
mov dword [rbp - 0x18], 0x73d873ff
mov dword [rbp - 0x14], 0x739173d5
mov dword [rbp - 0x10], 0x8ec17391
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400044a3
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400044c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x1c
mov dword [rbp - 0x20], 0x70ff70c1
mov dword [rbp - 0x1c], 0x70a570f8
mov ebx, 0x7096
mov dword [rbp - 0x18], 0x70c970a4
mov dword [rbp - 0x14], 0x70e470c6
mov dword [rbp - 0x10], 0x70f270f9
mov dword [rbp - 0xc], 0x70f570e3
mov dword [rbp - 8], 0x709670e2
mov dword [rbp - 4], 0x8ec17096
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xe
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004528
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140004548
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x7320
mov dword [rbp - 0x30], 0x73527370
mov ecx, 0x22
mov dword [rbp - 0x10], ebx
mov dword [rbp - 0x2c], 0x734d7349
mov dword [rbp - 0x28], 0x73527341
mov dword [rbp - 0x24], 0x736f7359
mov dword [rbp - 0x20], 0x734e7357
mov dword [rbp - 0x1c], 0x73527345
mov dword [rbp - 0x18], 0x7341736e
mov dword [rbp - 0x14], 0x7345734d
mov dword [rbp - 0xc], 0x8ec17320
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x11
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400045b6
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400045d8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x73fd73df
mov dword [rbp - 0x1c], 0x73eb73e0
mov ebx, 0x738f
mov dword [rbp - 0x18], 0x73ec73fa
mov dword [rbp - 0x14], 0x73c173fb
mov dword [rbp - 0x10], 0x73e273ee
mov dword [rbp - 0xc], 0x738f73ea
mov dword [rbp - 8], 0x8ec1738f
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004635
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140004654
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x73b97393
mov dword [rbp - 0x2c], 0x73b473b3
mov ebx, 0x73c0
mov dword [rbp - 0x28], 0x73ad73a5
mov dword [rbp - 0x24], 0x73a97384
mov dword [rbp - 0x20], 0x73a573b2
mov dword [rbp - 0x1c], 0x73b473a3
mov dword [rbp - 0x18], 0x73b273af
mov dword [rbp - 0x14], 0x73c073b9
mov dword [rbp - 0x10], 0x8ec173c0
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400046bf
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400046e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x1c
mov dword [rbp - 0x20], 0x70f370cd
mov dword [rbp - 0x1c], 0x70a970f4
mov ebx, 0x709a
mov dword [rbp - 0x18], 0x70c570a8
mov dword [rbp - 0x14], 0x70e870ca
mov dword [rbp - 0x10], 0x70f970f5
mov dword [rbp - 0xc], 0x70e970ff
mov dword [rbp - 8], 0x709a70e9
mov dword [rbp - 4], 0x8ec1709a
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xe
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004744
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140004764
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x734c
mov dword [rbp - 0x20], 0x732d7301
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x73397322
mov dword [rbp - 0x18], 0x732d732a
mov dword [rbp - 0x14], 0x7338732f
mov dword [rbp - 0x10], 0x733e7339
mov dword [rbp - 0xc], 0x733e7329
mov dword [rbp - 4], 0x8ec1734c
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400047c4
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400047e4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x72df
mov dword [rbp - 0x30], 0x72fa72fd
mov ecx, 0x26
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x2c], 0x728072ac
mov dword [rbp - 0x28], 0x728d729a
mov dword [rbp - 0x24], 0x7290728d
mov dword [rbp - 0x20], 0x72fd728d
mov dword [rbp - 0x1c], 0x72fd72e5
mov dword [rbp - 0x18], 0x72ef72fa
mov dword [rbp - 0x14], 0x728772e7
mov dword [rbp - 0x10], 0x72d572fd
mov dword [rbp - 8], 0x8ec172df
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004859
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140004878
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x73d773f0
mov dword [rbp - 0x1c], 0x73cd73ca
mov ebx, 0x73b9
mov dword [rbp - 0x18], 0x73d573d8
mov dword [rbp - 0x14], 0x73fd73d5
mov dword [rbp - 0x10], 0x73cd73d8
mov dword [rbp - 0xc], 0x73b973dc
mov dword [rbp - 8], 0x8ec173b9
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400048d5
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400048f4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x73ba
mov dword [rbp - 0x30], 0x73db73f6
mov ecx, 0x1e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x2c], 0x73ce73c9
mov dword [rbp - 0x28], 0x73d573f8
mov dword [rbp - 0x24], 0x73ce73d5
mov dword [rbp - 0x20], 0x73ca73ef
mov dword [rbp - 0x1c], 0x73d373ee
mov dword [rbp - 0x18], 0x73df73d7
mov dword [rbp - 0x10], 0x8ec173ba
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0xf
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000495b
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000497c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x7092
mov dword [rbp - 0x50], 0x70d770c1
mov ecx, 0x42
mov dword [rbp - 0x10], ebx
mov dword [rbp - 0x4c], 0x70d770de
mov dword [rbp - 0x48], 0x70c670d1
mov dword [rbp - 0x44], 0x70b870b2
mov dword [rbp - 0x40], 0x70d470b2
mov dword [rbp - 0x3c], 0x70dd70c0
mov dword [rbp - 0x38], 0x70b270df
mov dword [rbp - 0x34], 0x70fc70d3
mov dword [rbp - 0x30], 0x70fb70e6
mov dword [rbp - 0x2c], 0x70e270c1
mov dword [rbp - 0x28], 0x70e570eb
mov dword [rbp - 0x24], 0x70e070f3
mov dword [rbp - 0x20], 0x70c270f7
mov dword [rbp - 0x1c], 0x70fd70e0
mov dword [rbp - 0x18], 0x70e770f6
mov dword [rbp - 0x14], 0x70e670f1
mov dword [rbp - 0xc], 0x8ec17092
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x21
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004a22
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x140004a44
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x72097204
mov dword [rbp - 0x1c], 0x72107213
mov ebx, 0x7260
mov dword [rbp - 0x18], 0x7201720c
mov dword [rbp - 0x14], 0x722e7219
mov dword [rbp - 0x10], 0x720d7201
mov dword [rbp - 0xc], 0x72607205
mov dword [rbp - 8], 0x8ec17260
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004aa1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140004ac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x7098
mov dword [rbp - 0x50], 0x70dd70cb
mov ecx, 0x46
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x4c], 0x70dd70d4
mov dword [rbp - 0x48], 0x70cc70db
mov dword [rbp - 0x44], 0x70b270b8
mov dword [rbp - 0x40], 0x70de70b8
mov dword [rbp - 0x3c], 0x70d770ca
mov dword [rbp - 0x38], 0x70b870d5
mov dword [rbp - 0x34], 0x70f170cf
mov dword [rbp - 0x30], 0x70ab70f6
mov dword [rbp - 0x2c], 0x70c770aa
mov dword [rbp - 0x28], 0x70ec70cb
mov dword [rbp - 0x24], 0x70ea70f9
mov dword [rbp - 0x20], 0x70ed70ec
mov dword [rbp - 0x1c], 0x70db70e8
mov dword [rbp - 0x18], 0x70f570f7
mov dword [rbp - 0x14], 0x70f970f5
mov dword [rbp - 0x10], 0x70fc70f6
mov dword [rbp - 8], 0x8ec17098
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x23
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004b6d
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x140004b90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x73b87394
mov dword [rbp - 0x1c], 0x73ba73ba
mov ebx, 0x73d7
mov dword [rbp - 0x18], 0x73b973b6
mov dword [rbp - 0x14], 0x739b73b3
mov dword [rbp - 0x10], 0x73b973be
mov dword [rbp - 0xc], 0x73d773b2
mov dword [rbp - 8], 0x8ec173d7
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004bed
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140004c0c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x73bd
mov dword [rbp - 0x20], 0x73ee73f2
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x73dc73f1
mov dword [rbp - 0x18], 0x73da73d3
mov dword [rbp - 0x14], 0x73dc73c8
mov dword [rbp - 0x10], 0x73d873da
mov dword [rbp - 8], 0x8ec173bd
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004c65
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140004c84
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov ecx, 0x7c
mov dword [rbp - 0x49], 0x70d270c4
mov dword [rbp - 0x45], 0x70d270db
mov ebx, 0x7097
mov dword [rbp - 0x41], 0x70c370d4
mov dword [rbp - 0x3d], 0x70bd70b7
mov dword [rbp - 0x39], 0x70d170b7
mov dword [rbp - 0x35], 0x70d870c5
mov dword [rbp - 0x31], 0x70b770da
mov dword [rbp - 0x2d], 0x70fe70c0
mov dword [rbp - 0x29], 0x70a470f9
mov dword [rbp - 0x25], 0x70c870a5
mov dword [rbp - 0x21], 0x70f270d9
mov dword [rbp - 0x1d], 0x70e070e3
mov dword [rbp - 0x19], 0x70e570f8
mov dword [rbp - 0x15], 0x70d670fc
mov dword [rbp - 0x11], 0x70f670f3
mov dword [rbp - 0xd], 0x70e370e7
mov dword [rbp - 9], 0x70e570f2
mov dword [rbp - 5], 0x70c070b7
mov dword [rbp - 1], 0x70d270df
mov dword [rbp + 3], 0x70d270c5
mov dword [rbp + 7], 0x70c770b7
mov dword [rbp + 0xb], 0x70ee70ff
mov dword [rbp + 0xf], 0x70fe70e4
mov dword [rbp + 0x13], 0x70f670f4
mov dword [rbp + 0x17], 0x70d670fb
mov dword [rbp + 0x1b], 0x70f670f3
mov dword [rbp + 0x1f], 0x70e370e7
mov dword [rbp + 0x23], 0x70e570f2
mov dword [rbp + 0x27], 0x70c370aa
mov dword [rbp + 0x2b], 0x70c270c5
mov dword [rbp + 0x2f], 0x709770d2
mov dword [rbp + 0x33], 0x8ec17097
call fcn.1400026b0
lea r9, [rbp - 0x49]
mov rdx, rax
sub r9, rax
mov r8d, 0x3e
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004da6
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret

Function at 0x140004ddc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x3c
mov dword [rbp - 0x40], 0x70d070c6
mov dword [rbp - 0x3c], 0x70d070d9
mov ebx, 0x7095
mov dword [rbp - 0x38], 0x70c170d6
mov dword [rbp - 0x34], 0x70bf70b5
mov dword [rbp - 0x30], 0x70d370b5
mov dword [rbp - 0x2c], 0x70da70c7
mov dword [rbp - 0x28], 0x70b570d8
mov dword [rbp - 0x24], 0x70fc70c2
mov dword [rbp - 0x20], 0x70a670fb
mov dword [rbp - 0x1c], 0x70ca70a7
mov dword [rbp - 0x18], 0x70e770c5
mov dword [rbp - 0x14], 0x70f670fa
mov dword [rbp - 0x10], 0x70e670f0
mov dword [rbp - 0xc], 0x70fa70e6
mov dword [rbp - 8], 0x709570e7
mov dword [rbp - 4], 0x8ec17095
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1e
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004e78
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140004e98
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x2c
mov dword [rbp - 0x30], 0x70f070ce
mov dword [rbp - 0x2c], 0x70aa70f7
mov ebx, 0x7099
mov dword [rbp - 0x28], 0x70c670ab
mov dword [rbp - 0x24], 0x70e970d6
mov dword [rbp - 0x20], 0x70eb70fc
mov dword [rbp - 0x1c], 0x70ed70f8
mov dword [rbp - 0x18], 0x70f770f0
mov dword [rbp - 0x14], 0x70ca70fe
mov dword [rbp - 0x10], 0x70ea70e0
mov dword [rbp - 0xc], 0x70fc70ed
mov dword [rbp - 8], 0x709970f4
mov dword [rbp - 4], 0x8ec17099
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004f18
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140004f38
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x70fc70c2
mov dword [rbp - 0x2c], 0x70a670fb
mov ebx, 0x7095
mov dword [rbp - 0x28], 0x70ca70a7
mov dword [rbp - 0x24], 0x70e770c5
mov dword [rbp - 0x20], 0x70f670fa
mov dword [rbp - 0x1c], 0x70e670f0
mov dword [rbp - 0x18], 0x70fa70e6
mov dword [rbp - 0x14], 0x709570e7
mov dword [rbp - 0x10], 0x8ec17095
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004fa3
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140004fc4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x708f
mov dword [rbp - 0x30], 0x70e070fd
mov ecx, 0x2a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x2c], 0x70fb70e0
mov dword [rbp - 0x28], 0x70dc70d3
mov dword [rbp - 0x24], 0x70ec70ea
mov dword [rbp - 0x20], 0x70fd70fa
mov dword [rbp - 0x1c], 0x70fb70e6
mov dword [rbp - 0x18], 0x70cc70f6
mov dword [rbp - 0x14], 0x70e170ea
mov dword [rbp - 0x10], 0x70ea70fb
mov dword [rbp - 0xc], 0x70bd70fd
mov dword [rbp - 4], 0x8ec1708f
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005040
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140005060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x73b3
mov dword [rbp - 0x20], 0x73e073f0
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x73e573f7
mov dword [rbp - 0x18], 0x73c173d6
mov dword [rbp - 0x14], 0x73da73c0
mov dword [rbp - 0x10], 0x73dd73dc
mov dword [rbp - 8], 0x8ec173b3
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400050b9
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400050d8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x1c
mov dword [rbp - 0x20], 0x7207723c
mov dword [rbp - 0x1c], 0x7210721f
mov ebx, 0x7272
mov dword [rbp - 0x18], 0x72007217
mov dword [rbp - 0x14], 0x7214723d
mov dword [rbp - 0x10], 0x721d7231
mov dword [rbp - 0xc], 0x72177200
mov dword [rbp - 8], 0x72727201
mov dword [rbp - 4], 0x8ec17272
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xe
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000513c
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000515c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x7097
mov dword [rbp - 0x30], 0x70fe70c0
mov ecx, 0x2a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x2c], 0x70a470f9
mov dword [rbp - 0x28], 0x70c870a5
mov dword [rbp - 0x24], 0x70f270d9
mov dword [rbp - 0x20], 0x70e070e3
mov dword [rbp - 0x1c], 0x70e570f8
mov dword [rbp - 0x18], 0x70d670fc
mov dword [rbp - 0x14], 0x70f670f3
mov dword [rbp - 0x10], 0x70e370e7
mov dword [rbp - 0xc], 0x70e570f2
mov dword [rbp - 4], 0x8ec17097
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400051d8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400051f8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x73d873f4
mov dword [rbp - 0x1c], 0x73d973c2
mov ebx, 0x73b7
mov dword [rbp - 0x18], 0x73c573c3
mov dword [rbp - 0x14], 0x73f473ce
mov dword [rbp - 0x10], 0x73d373d8
mov dword [rbp - 0xc], 0x73b773d2
mov dword [rbp - 8], 0x8ec173b7
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005255
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140005274
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x3c
mov dword [rbp - 0x40], 0x70d870ce
mov dword [rbp - 0x3c], 0x70d870d1
mov ebx, 0x709d
mov dword [rbp - 0x38], 0x70c970de
mov dword [rbp - 0x34], 0x70b770bd
mov dword [rbp - 0x30], 0x70db70bd
mov dword [rbp - 0x2c], 0x70d270cf
mov dword [rbp - 0x28], 0x70bd70d0
mov dword [rbp - 0x24], 0x70f470ca
mov dword [rbp - 0x20], 0x70ae70f3
mov dword [rbp - 0x1c], 0x70c270af
mov dword [rbp - 0x18], 0x70ef70da
mov dword [rbp - 0x14], 0x70e870f2
mov dword [rbp - 0x10], 0x70c870ed
mov dword [rbp - 0xc], 0x70f870ee
mov dword [rbp - 8], 0x709d70ef
mov dword [rbp - 4], 0x8ec1709d
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1e
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005310
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140005330
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x731f
mov dword [rbp - 0x20], 0x737e7352
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x736a7371
mov dword [rbp - 0x18], 0x737e7379
mov dword [rbp - 0x14], 0x736b737c
mov dword [rbp - 0x10], 0x736d736a
mov dword [rbp - 0xc], 0x736d737a
mov dword [rbp - 4], 0x8ec1731f
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005390
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400053b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x7328
mov dword [rbp - 0x20], 0x7347736c
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x73497345
mov dword [rbp - 0x18], 0x73467341
mov dword [rbp - 0x14], 0x7347737a
mov dword [rbp - 0x10], 0x734d7344
mov dword [rbp - 8], 0x8ec17328
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005409
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140005428
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ecx, 0x40
mov dword [rbp - 0x50], 0x70d970cf
mov dword [rbp - 0x4c], 0x70d970d0
mov ebx, 0x709c
mov dword [rbp - 0x48], 0x70c870df
mov dword [rbp - 0x44], 0x70b670bc
mov dword [rbp - 0x40], 0x70da70bc
mov dword [rbp - 0x3c], 0x70d370ce
mov dword [rbp - 0x38], 0x70bc70d1
mov dword [rbp - 0x34], 0x70f570cb
mov dword [rbp - 0x30], 0x70af70f2
mov dword [rbp - 0x2c], 0x70c370ae
mov dword [rbp - 0x28], 0x70ef70c9
mov dword [rbp - 0x24], 0x70ee70f9
mov dword [rbp - 0x20], 0x70ff70dd
mov dword [rbp - 0x1c], 0x70f370ff
mov dword [rbp - 0x18], 0x70f270e9
mov dword [rbp - 0x14], 0x709c70e8
mov dword [rbp - 0x10], 0x8ec1709c
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x20
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400054cb
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x1400054f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x73c3
mov dword [rbp - 0x20], 0x73a67390
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x73aa73b1
mov dword [rbp - 0x18], 0x73af73a2
mov dword [rbp - 0x14], 0x73b6738d
mov dword [rbp - 0x10], 0x73a173ae
mov dword [rbp - 0xc], 0x73b173a6
mov dword [rbp - 4], 0x8ec173c3
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005550
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret