joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004438
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x71f671dd
mov dword [rbp - 0x2c], 0x71d071e7
mov ebx, 0x7193
mov dword [rbp - 0x28], 0x71fd71fc
mov dword [rbp - 0x24], 0x71f671fd
mov dword [rbp - 0x20], 0x71e771f0
mov dword [rbp - 0x1c], 0x71fc71fa
mov dword [rbp - 0x18], 0x71da71fd
mov dword [rbp - 0x14], 0x719371d7
mov dword [rbp - 0x10], 0x8cc67193
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400044a3
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400044c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x1c
mov dword [rbp - 0x20], 0x72fd72c3
mov dword [rbp - 0x1c], 0x72a772fa
mov ebx, 0x7294
mov dword [rbp - 0x18], 0x72cb72a6
mov dword [rbp - 0x14], 0x72e672c4
mov dword [rbp - 0x10], 0x72f072fb
mov dword [rbp - 0xc], 0x72f772e1
mov dword [rbp - 8], 0x729472e0
mov dword [rbp - 4], 0x8cc67294
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xe
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004528
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140004548
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x7122
mov dword [rbp - 0x30], 0x71507172
mov ecx, 0x22
mov dword [rbp - 0x10], ebx
mov dword [rbp - 0x2c], 0x714f714b
mov dword [rbp - 0x28], 0x71507143
mov dword [rbp - 0x24], 0x716d715b
mov dword [rbp - 0x20], 0x714c7155
mov dword [rbp - 0x1c], 0x71507147
mov dword [rbp - 0x18], 0x7143716c
mov dword [rbp - 0x14], 0x7147714f
mov dword [rbp - 0xc], 0x8cc67122
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x11
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400045b6
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400045d8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x71ff71dd
mov dword [rbp - 0x1c], 0x71e971e2
mov ebx, 0x718d
mov dword [rbp - 0x18], 0x71ee71f8
mov dword [rbp - 0x14], 0x71c371f9
mov dword [rbp - 0x10], 0x71e071ec
mov dword [rbp - 0xc], 0x718d71e8
mov dword [rbp - 8], 0x8cc6718d
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004635
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140004654
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x71bb7191
mov dword [rbp - 0x2c], 0x71b671b1
mov ebx, 0x71c2
mov dword [rbp - 0x28], 0x71af71a7
mov dword [rbp - 0x24], 0x71ab7186
mov dword [rbp - 0x20], 0x71a771b0
mov dword [rbp - 0x1c], 0x71b671a1
mov dword [rbp - 0x18], 0x71b071ad
mov dword [rbp - 0x14], 0x71c271bb
mov dword [rbp - 0x10], 0x8cc671c2
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400046bf
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400046e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x1c
mov dword [rbp - 0x20], 0x72f172cf
mov dword [rbp - 0x1c], 0x72ab72f6
mov ebx, 0x7298
mov dword [rbp - 0x18], 0x72c772aa
mov dword [rbp - 0x14], 0x72ea72c8
mov dword [rbp - 0x10], 0x72fb72f7
mov dword [rbp - 0xc], 0x72eb72fd
mov dword [rbp - 8], 0x729872eb
mov dword [rbp - 4], 0x8cc67298
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xe
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004744
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140004764
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x714e
mov dword [rbp - 0x20], 0x712f7103
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x713b7120
mov dword [rbp - 0x18], 0x712f7128
mov dword [rbp - 0x14], 0x713a712d
mov dword [rbp - 0x10], 0x713c713b
mov dword [rbp - 0xc], 0x713c712b
mov dword [rbp - 4], 0x8cc6714e
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400047c4
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400047e4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x70dd
mov dword [rbp - 0x30], 0x70f870ff
mov ecx, 0x26
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x2c], 0x708270ae
mov dword [rbp - 0x28], 0x708f7098
mov dword [rbp - 0x24], 0x7092708f
mov dword [rbp - 0x20], 0x70ff708f
mov dword [rbp - 0x1c], 0x70ff70e7
mov dword [rbp - 0x18], 0x70ed70f8
mov dword [rbp - 0x14], 0x708570e5
mov dword [rbp - 0x10], 0x70d770ff
mov dword [rbp - 8], 0x8cc670dd
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004859
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140004878
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x71d571f2
mov dword [rbp - 0x1c], 0x71cf71c8
mov ebx, 0x71bb
mov dword [rbp - 0x18], 0x71d771da
mov dword [rbp - 0x14], 0x71ff71d7
mov dword [rbp - 0x10], 0x71cf71da
mov dword [rbp - 0xc], 0x71bb71de
mov dword [rbp - 8], 0x8cc671bb
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400048d5
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400048f4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x71b8
mov dword [rbp - 0x30], 0x71d971f4
mov ecx, 0x1e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x2c], 0x71cc71cb
mov dword [rbp - 0x28], 0x71d771fa
mov dword [rbp - 0x24], 0x71cc71d7
mov dword [rbp - 0x20], 0x71c871ed
mov dword [rbp - 0x1c], 0x71d171ec
mov dword [rbp - 0x18], 0x71dd71d5
mov dword [rbp - 0x10], 0x8cc671b8
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0xf
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000495b
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000497c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x7290
mov dword [rbp - 0x50], 0x72d572c3
mov ecx, 0x42
mov dword [rbp - 0x10], ebx
mov dword [rbp - 0x4c], 0x72d572dc
mov dword [rbp - 0x48], 0x72c472d3
mov dword [rbp - 0x44], 0x72ba72b0
mov dword [rbp - 0x40], 0x72d672b0
mov dword [rbp - 0x3c], 0x72df72c2
mov dword [rbp - 0x38], 0x72b072dd
mov dword [rbp - 0x34], 0x72fe72d1
mov dword [rbp - 0x30], 0x72f972e4
mov dword [rbp - 0x2c], 0x72e072c3
mov dword [rbp - 0x28], 0x72e772e9
mov dword [rbp - 0x24], 0x72e272f1
mov dword [rbp - 0x20], 0x72c072f5
mov dword [rbp - 0x1c], 0x72ff72e2
mov dword [rbp - 0x18], 0x72e572f4
mov dword [rbp - 0x14], 0x72e472f3
mov dword [rbp - 0xc], 0x8cc67290
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x21
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004a22
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x140004a44
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x700b7006
mov dword [rbp - 0x1c], 0x70127011
mov ebx, 0x7062
mov dword [rbp - 0x18], 0x7003700e
mov dword [rbp - 0x14], 0x702c701b
mov dword [rbp - 0x10], 0x700f7003
mov dword [rbp - 0xc], 0x70627007
mov dword [rbp - 8], 0x8cc67062
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004aa1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140004ac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x729a
mov dword [rbp - 0x50], 0x72df72c9
mov ecx, 0x46
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x4c], 0x72df72d6
mov dword [rbp - 0x48], 0x72ce72d9
mov dword [rbp - 0x44], 0x72b072ba
mov dword [rbp - 0x40], 0x72dc72ba
mov dword [rbp - 0x3c], 0x72d572c8
mov dword [rbp - 0x38], 0x72ba72d7
mov dword [rbp - 0x34], 0x72f372cd
mov dword [rbp - 0x30], 0x72a972f4
mov dword [rbp - 0x2c], 0x72c572a8
mov dword [rbp - 0x28], 0x72ee72c9
mov dword [rbp - 0x24], 0x72e872fb
mov dword [rbp - 0x20], 0x72ef72ee
mov dword [rbp - 0x1c], 0x72d972ea
mov dword [rbp - 0x18], 0x72f772f5
mov dword [rbp - 0x14], 0x72fb72f7
mov dword [rbp - 0x10], 0x72fe72f4
mov dword [rbp - 8], 0x8cc6729a
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x23
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004b6d
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x140004b90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x71ba7196
mov dword [rbp - 0x1c], 0x71b871b8
mov ebx, 0x71d5
mov dword [rbp - 0x18], 0x71bb71b4
mov dword [rbp - 0x14], 0x719971b1
mov dword [rbp - 0x10], 0x71bb71bc
mov dword [rbp - 0xc], 0x71d571b0
mov dword [rbp - 8], 0x8cc671d5
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004bed
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140004c0c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x71bf
mov dword [rbp - 0x20], 0x71ec71f0
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x71de71f3
mov dword [rbp - 0x18], 0x71d871d1
mov dword [rbp - 0x14], 0x71de71ca
mov dword [rbp - 0x10], 0x71da71d8
mov dword [rbp - 8], 0x8cc671bf
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004c65
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140004c84
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov ecx, 0x7c
mov dword [rbp - 0x49], 0x72d072c6
mov dword [rbp - 0x45], 0x72d072d9
mov ebx, 0x7295
mov dword [rbp - 0x41], 0x72c172d6
mov dword [rbp - 0x3d], 0x72bf72b5
mov dword [rbp - 0x39], 0x72d372b5
mov dword [rbp - 0x35], 0x72da72c7
mov dword [rbp - 0x31], 0x72b572d8
mov dword [rbp - 0x2d], 0x72fc72c2
mov dword [rbp - 0x29], 0x72a672fb
mov dword [rbp - 0x25], 0x72ca72a7
mov dword [rbp - 0x21], 0x72f072db
mov dword [rbp - 0x1d], 0x72e272e1
mov dword [rbp - 0x19], 0x72e772fa
mov dword [rbp - 0x15], 0x72d472fe
mov dword [rbp - 0x11], 0x72f472f1
mov dword [rbp - 0xd], 0x72e172e5
mov dword [rbp - 9], 0x72e772f0
mov dword [rbp - 5], 0x72c272b5
mov dword [rbp - 1], 0x72d072dd
mov dword [rbp + 3], 0x72d072c7
mov dword [rbp + 7], 0x72c572b5
mov dword [rbp + 0xb], 0x72ec72fd
mov dword [rbp + 0xf], 0x72fc72e6
mov dword [rbp + 0x13], 0x72f472f6
mov dword [rbp + 0x17], 0x72d472f9
mov dword [rbp + 0x1b], 0x72f472f1
mov dword [rbp + 0x1f], 0x72e172e5
mov dword [rbp + 0x23], 0x72e772f0
mov dword [rbp + 0x27], 0x72c172a8
mov dword [rbp + 0x2b], 0x72c072c7
mov dword [rbp + 0x2f], 0x729572d0
mov dword [rbp + 0x33], 0x8cc67295
call fcn.1400026b0
lea r9, [rbp - 0x49]
mov rdx, rax
sub r9, rax
mov r8d, 0x3e
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004da6
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret

Function at 0x140004ddc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x3c
mov dword [rbp - 0x40], 0x72d272c4
mov dword [rbp - 0x3c], 0x72d272db
mov ebx, 0x7297
mov dword [rbp - 0x38], 0x72c372d4
mov dword [rbp - 0x34], 0x72bd72b7
mov dword [rbp - 0x30], 0x72d172b7
mov dword [rbp - 0x2c], 0x72d872c5
mov dword [rbp - 0x28], 0x72b772da
mov dword [rbp - 0x24], 0x72fe72c0
mov dword [rbp - 0x20], 0x72a472f9
mov dword [rbp - 0x1c], 0x72c872a5
mov dword [rbp - 0x18], 0x72e572c7
mov dword [rbp - 0x14], 0x72f472f8
mov dword [rbp - 0x10], 0x72e472f2
mov dword [rbp - 0xc], 0x72f872e4
mov dword [rbp - 8], 0x729772e5
mov dword [rbp - 4], 0x8cc67297
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1e
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004e78
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140004e98
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x2c
mov dword [rbp - 0x30], 0x72f272cc
mov dword [rbp - 0x2c], 0x72a872f5
mov ebx, 0x729b
mov dword [rbp - 0x28], 0x72c472a9
mov dword [rbp - 0x24], 0x72eb72d4
mov dword [rbp - 0x20], 0x72e972fe
mov dword [rbp - 0x1c], 0x72ef72fa
mov dword [rbp - 0x18], 0x72f572f2
mov dword [rbp - 0x14], 0x72c872fc
mov dword [rbp - 0x10], 0x72e872e2
mov dword [rbp - 0xc], 0x72fe72ef
mov dword [rbp - 8], 0x729b72f6
mov dword [rbp - 4], 0x8cc6729b
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004f18
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140004f38
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x72fe72c0
mov dword [rbp - 0x2c], 0x72a472f9
mov ebx, 0x7297
mov dword [rbp - 0x28], 0x72c872a5
mov dword [rbp - 0x24], 0x72e572c7
mov dword [rbp - 0x20], 0x72f472f8
mov dword [rbp - 0x1c], 0x72e472f2
mov dword [rbp - 0x18], 0x72f872e4
mov dword [rbp - 0x14], 0x729772e5
mov dword [rbp - 0x10], 0x8cc67297
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004fa3
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140004fc4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x728d
mov dword [rbp - 0x30], 0x72e272ff
mov ecx, 0x2a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x2c], 0x72f972e2
mov dword [rbp - 0x28], 0x72de72d1
mov dword [rbp - 0x24], 0x72ee72e8
mov dword [rbp - 0x20], 0x72ff72f8
mov dword [rbp - 0x1c], 0x72f972e4
mov dword [rbp - 0x18], 0x72ce72f4
mov dword [rbp - 0x14], 0x72e372e8
mov dword [rbp - 0x10], 0x72e872f9
mov dword [rbp - 0xc], 0x72bf72ff
mov dword [rbp - 4], 0x8cc6728d
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005040
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140005060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x71b1
mov dword [rbp - 0x20], 0x71e271f2
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x71e771f5
mov dword [rbp - 0x18], 0x71c371d4
mov dword [rbp - 0x14], 0x71d871c2
mov dword [rbp - 0x10], 0x71df71de
mov dword [rbp - 8], 0x8cc671b1
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400050b9
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400050d8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x1c
mov dword [rbp - 0x20], 0x7005703e
mov dword [rbp - 0x1c], 0x7012701d
mov ebx, 0x7070
mov dword [rbp - 0x18], 0x70027015
mov dword [rbp - 0x14], 0x7016703f
mov dword [rbp - 0x10], 0x701f7033
mov dword [rbp - 0xc], 0x70157002
mov dword [rbp - 8], 0x70707003
mov dword [rbp - 4], 0x8cc67070
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xe
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000513c
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000515c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x7295
mov dword [rbp - 0x30], 0x72fc72c2
mov ecx, 0x2a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x2c], 0x72a672fb
mov dword [rbp - 0x28], 0x72ca72a7
mov dword [rbp - 0x24], 0x72f072db
mov dword [rbp - 0x20], 0x72e272e1
mov dword [rbp - 0x1c], 0x72e772fa
mov dword [rbp - 0x18], 0x72d472fe
mov dword [rbp - 0x14], 0x72f472f1
mov dword [rbp - 0x10], 0x72e172e5
mov dword [rbp - 0xc], 0x72e772f0
mov dword [rbp - 4], 0x8cc67295
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400051d8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400051f8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x71da71f6
mov dword [rbp - 0x1c], 0x71db71c0
mov ebx, 0x71b5
mov dword [rbp - 0x18], 0x71c771c1
mov dword [rbp - 0x14], 0x71f671cc
mov dword [rbp - 0x10], 0x71d171da
mov dword [rbp - 0xc], 0x71b571d0
mov dword [rbp - 8], 0x8cc671b5
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005255
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140005274
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x3c
mov dword [rbp - 0x40], 0x72da72cc
mov dword [rbp - 0x3c], 0x72da72d3
mov ebx, 0x729f
mov dword [rbp - 0x38], 0x72cb72dc
mov dword [rbp - 0x34], 0x72b572bf
mov dword [rbp - 0x30], 0x72d972bf
mov dword [rbp - 0x2c], 0x72d072cd
mov dword [rbp - 0x28], 0x72bf72d2
mov dword [rbp - 0x24], 0x72f672c8
mov dword [rbp - 0x20], 0x72ac72f1
mov dword [rbp - 0x1c], 0x72c072ad
mov dword [rbp - 0x18], 0x72ed72d8
mov dword [rbp - 0x14], 0x72ea72f0
mov dword [rbp - 0x10], 0x72ca72ef
mov dword [rbp - 0xc], 0x72fa72ec
mov dword [rbp - 8], 0x729f72ed
mov dword [rbp - 4], 0x8cc6729f
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1e
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005310
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140005330
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x711d
mov dword [rbp - 0x20], 0x717c7150
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x71687173
mov dword [rbp - 0x18], 0x717c717b
mov dword [rbp - 0x14], 0x7169717e
mov dword [rbp - 0x10], 0x716f7168
mov dword [rbp - 0xc], 0x716f7178
mov dword [rbp - 4], 0x8cc6711d
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005390
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400053b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x712a
mov dword [rbp - 0x20], 0x7145716e
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x714b7147
mov dword [rbp - 0x18], 0x71447143
mov dword [rbp - 0x14], 0x71457178
mov dword [rbp - 0x10], 0x714f7146
mov dword [rbp - 8], 0x8cc6712a
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005409
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140005428
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ecx, 0x40
mov dword [rbp - 0x50], 0x72db72cd
mov dword [rbp - 0x4c], 0x72db72d2
mov ebx, 0x729e
mov dword [rbp - 0x48], 0x72ca72dd
mov dword [rbp - 0x44], 0x72b472be
mov dword [rbp - 0x40], 0x72d872be
mov dword [rbp - 0x3c], 0x72d172cc
mov dword [rbp - 0x38], 0x72be72d3
mov dword [rbp - 0x34], 0x72f772c9
mov dword [rbp - 0x30], 0x72ad72f0
mov dword [rbp - 0x2c], 0x72c172ac
mov dword [rbp - 0x28], 0x72ed72cb
mov dword [rbp - 0x24], 0x72ec72fb
mov dword [rbp - 0x20], 0x72fd72df
mov dword [rbp - 0x1c], 0x72f172fd
mov dword [rbp - 0x18], 0x72f072eb
mov dword [rbp - 0x14], 0x729e72ea
mov dword [rbp - 0x10], 0x8cc6729e
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x20
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400054cb
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x1400054f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x71c1
mov dword [rbp - 0x20], 0x71a47192
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x71a871b3
mov dword [rbp - 0x18], 0x71ad71a0
mov dword [rbp - 0x14], 0x71b4718f
mov dword [rbp - 0x10], 0x71a371ac
mov dword [rbp - 0xc], 0x71b371a4
mov dword [rbp - 4], 0x8cc671c1
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005550
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret