joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007090
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400ead30]
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400eae60]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400eae50]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400ead10]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400eaf60]
movdqa xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x35402543
xor eax, eax
mov byte [rbp - 5], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rcx - 0x58], al
inc rcx
cmp rcx, 0x53
jb 0x140007110
mov byte [rbp - 5], bl
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x58]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140007141
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 7]
call fcn.140004100
nop
movdqa xmm0, xmmword [0x1400eadf0]
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400eaf20]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400eaf10]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400eade0]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400eaec0]
movdqa xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x3d482d4b
xor eax, eax
mov byte [rbp - 5], al
nop word [rax + rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x53
jb 0x1400071b0
mov byte [rbp - 5], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400071e0
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x27]
call fcn.140004100
nop
cmp byte [0x1400ff4dd], 0
je 0x140007219
lea r8, [0x1400ffc60]
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.140004e60
jmp 0x14000722a
lea rdx, [rbp + 7]
lea rcx, [0x1400ffc60]
call fcn.1400056e0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140007269
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007263
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007263
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c38
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x1400072a7
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400072a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400072a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c38
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c10
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400075a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400eb0a0]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400ead80]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400eb1a0]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x4e2b5d4e
mov dword [rbp + 0x1b], 0x5e4e5e5e
mov dword [rbp + 0x1f], 0x2f5e4e5e
xor eax, eax
mov byte [rbp + 0x23], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x140007610
mov byte [rbp + 0x23], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140007641
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.140004100
nop
movdqa xmm0, xmmword [0x1400eb040]
movdqu xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400ead60]
movdqu xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400eb0d0]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x42275142
mov dword [rbp - 0x25], 0x52425252
mov dword [rbp - 0x21], 0x23524252
xor eax, eax
mov byte [rbp - 0x1d], al
nop dword [rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x3b
jb 0x1400076a0
mov byte [rbp - 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400076d0
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x19]
call fcn.140004100
nop
cmp byte [0x1400ff4da], 0
je 0x140007709
lea r8, [0x1400ffc18]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.140004e60
jmp 0x14000771a
lea rdx, [rbp + 0x27]
lea rcx, [0x1400ffc18]
call fcn.1400056e0
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x140007759
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007753
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007753
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c38
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140007797
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007792
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007792
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c38
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c10
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400077c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400eae80]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [str.V_2V2W_2_2P2_V2WV22V_2V2W__5_5P_5_5__5__6__6S6__6__6__6_6S666_]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [0x1400eaca0]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400eae70]
movdqa xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x5332222a
mov dword [rbp - 5], 0x23573222
xor eax, eax
mov byte [rbp - 1], al
xor ebx, ebx
mov ecx, ebx
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rcx - 0x48], al
inc rcx
cmp rcx, 0x47
jb 0x140007830
mov byte [rbp - 1], bl
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x48]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140007861
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 7]
call fcn.140004100
nop
movdqa xmm0, xmmword [0x1400eaa90]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400eabb0]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [str.o_vno_v]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400eaa70]
movdqa xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x6a0b1b13
mov dword [rbp - 5], 0x1a6e0b1b
xor eax, eax
mov byte [rbp - 1], al
nop
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rbx - 0x48], al
inc rbx
cmp rbx, 0x47
jb 0x1400078c0
mov byte [rbp - 1], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x48]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400078f0
mov r8, rdi
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x27]
call fcn.140004100
nop
cmp byte [0x1400ff4c3], 0
je 0x140007929
lea r8, [0x1400ffc30]
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.140004e60
jmp 0x14000793a
lea rdx, [rbp + 7]
lea rcx, [0x1400ffc30]
call fcn.1400056e0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140007979
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007973
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007973
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c38
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x1400079b7
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400079b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400079b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c38
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c10
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400079e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400eb1e0]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400eb310]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400eb330]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x62727262
mov dword [rbp + 0x1b], 0x77627272
mov dword [rbp + 0x1f], 0x71076272
xor eax, eax
mov byte [rbp + 0x23], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x140007a50
mov byte [rbp + 0x23], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140007a81
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.140004100
nop
movdqa xmm0, xmmword [0x1400eb020]
movdqu xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400eb0b0]
movdqu xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400eb160]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x42525242
mov dword [rbp - 0x25], 0x57425252
mov dword [rbp - 0x21], 0x51274252
xor eax, eax
mov byte [rbp - 0x1d], al
nop dword [rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x3b
jb 0x140007ae0
mov byte [rbp - 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140007b10
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x19]
call fcn.140004100
nop
cmp byte [0x1400ff4b4], 0
je 0x140007b49
lea r8, [0x1400ffc48]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.140004e60
jmp 0x140007b5a
lea rdx, [rbp + 0x27]
lea rcx, [0x1400ffc48]
call fcn.1400056e0
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x140007b99
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007b93
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c38
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140007bd7
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007bd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007bd2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c38
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c10
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400083c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [0x1400eace0]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400eaea0]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x1400eae30]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x24404224
mov word [rsp + 0x54], 0x3242
xor eax, eax
mov byte [rsp + 0x56], al
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x35
jb 0x140008420
mov byte [rsp + 0x56], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
lea rax, [rsp + 0x21]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140008454
lea rdx, [rsp + 0x21]
lea rcx, [rsp + 0x58]
call fcn.140004100
nop
lea rdx, [rsp + 0x58]
lea rcx, [0x1400ffcc0]
call fcn.1400056e0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400084c0
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400084bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400084bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c38
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400c7c10
add rsp, 0x88
ret

Function at 0x1400084e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400ea9d0]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400eab60]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400eb1f0]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x5161c05
mov dword [rbp + 0x1b], 0x13051567
mov dword [rbp + 0x1f], 0x13110566
xor eax, eax
mov byte [rbp + 0x23], al
xor ecx, ecx
nop
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x140008540
mov byte [rbp + 0x23], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140008570
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.140004100
nop
lea rdx, [rbp + 0x27]
lea rcx, [0x1400ffc78]
call fcn.1400056e0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x1400085d7
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400085d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400085d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c38
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c10
add rsp, 0x90
pop rbp
ret
Function at 0x1400085f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400eac50]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400eaa80]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm0, xmmword [0x1400eb380]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm1, xmmword [0x1400eac60]
movdqa xmmword [rbp + 7], xmm1
mov dword [rbp + 0x17], 0x7c1e0e06
mov dword [rbp + 0x1b], 0x67b1e7a
xor eax, eax
mov byte [rbp + 0x1f], al
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 0x47
jb 0x140008660
mov byte [rbp + 0x1f], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x28]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140008690
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x27]
call fcn.140004100
nop
lea rdx, [rbp + 0x27]
lea rcx, [0x1400ffcd8]
call fcn.1400056e0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x1400086f7
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400086f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400086f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c38
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c10
add rsp, 0xa0
pop rbp
ret

Function at 0x140008710
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xb8
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movdqa xmm0, xmmword [0x1400eab70]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400ea9a0]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x1400ea9b0]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1400eab80]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x1400eab00]
movdqa xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x6731670
xor eax, eax
mov byte [rsp + 0x74], al
xor ecx, ecx
nop
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x53
jb 0x140008780
mov byte [rsp + 0x74], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x90], xmm1
lea rax, [rsp + 0x21]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400087c0
lea rdx, [rsp + 0x21]
lea rcx, [rsp + 0x80]
call fcn.140004100
nop
lea rdx, [rsp + 0x80]
lea rcx, [0x1400ffc60]
call fcn.1400056e0
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x140008838
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008833
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008833
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c38
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400c7c10
add rsp, 0xb8
ret
Function at 0x1400089c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400eadd0]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400eaf70]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400eaf30]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x2c3c3c2c
mov dword [rbp + 0x1b], 0x392c3c3c
mov dword [rbp + 0x1f], 0x3f492c3c
xor eax, eax
mov byte [rbp + 0x23], al
xor ecx, ecx
nop
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x140008a20
mov byte [rbp + 0x23], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140008a50
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.140004100
nop
lea rdx, [rbp + 0x27]
lea rcx, [0x1400ffc48]
call fcn.1400056e0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140008ab7
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ab2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008ab2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c38
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c10
add rsp, 0x90
pop rbp
ret

Function at 0x140008ad0
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400eb390]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400eb2d0]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm0, xmmword [0x1400eb2b0]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm1, xmmword [0x1400eb3a0]
movdqa xmmword [rbp + 7], xmm1
mov dword [rbp + 0x17], 0x1e7f6f67
mov dword [rbp + 0x1b], 0x6e1a7f6f
xor eax, eax
mov byte [rbp + 0x1f], al
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 0x47
jb 0x140008b40
mov byte [rbp + 0x1f], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x28]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140008b70
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x27]
call fcn.140004100
nop
lea rdx, [rbp + 0x27]
lea rcx, [0x1400ffc30]
call fcn.1400056e0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140008bd7
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008bd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008bd2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c38
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c10
add rsp, 0xa0
pop rbp
ret
Function at 0x140008bf0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400eaf40]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400eb1b0]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400ead70]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x3a5f293a
mov dword [rbp + 0x1b], 0x2a3a2a2a
mov dword [rbp + 0x1f], 0x5b2a3a2a
xor eax, eax
mov byte [rbp + 0x23], al
xor ecx, ecx
nop
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x140008c50
mov byte [rbp + 0x23], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140008c80
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.140004100
nop
lea rdx, [rbp + 0x27]
lea rcx, [0x1400ffc18]
call fcn.1400056e0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140008ce7
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ce2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008ce2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7c38
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c7c10
add rsp, 0x90
pop rbp
ret