joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003972
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [rsp + 0x76], ax
movzx eax, word [rsp + 0x26]
add eax, 0x28
xor eax, 0x6c
mov word [rsp + 0x78], ax
movzx eax, word [rsp + 0x26]
add eax, 0x29
xor eax, 0x65
mov word [rsp + 0x7a], ax
movzx eax, word [rsp + 0x26]
add eax, 0x2a
xor eax, 0x72
mov word [rsp + 0x7c], ax
mov word [rsp + 0x7e], 0
mov ecx, 0x58
call fcn.1400018f0
xor ecx, ecx
nop word [rax + rax]
movzx edx, word [rsp + rcx*2 + 0x28]
movzx r8d, word [rsp + 0x26]
add r8d, ecx
xor r8w, dx
mov word [rax + rcx*2], r8w
inc rcx
cmp rcx, 0x2b
jne 0x1400039c0
mov rcx, qword [rsi + 8]
xor edx, edx
nop word cs:[rax + rax]
mov r8, qword [rax + rdx*8]
mov qword [rcx + rdx*8], r8
inc rdx
cmp rdx, 0xb
jne 0x1400039f0
mov rax, rsi
add rsp, 0x80
pop rsi
ret
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov rcx, rdx
mov rdx, r8
call fcn.140009cce
mov r8, qword [rsi + 0x10]
sub r8, rdi
cmp r8, rbx
cmovae r8, rbx
cmp qword [rsi + 0x18], 0x10
jb 0x14000db68
mov rsi, qword [rsi]
add rsi, rdi
mov rcx, r14
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x140003972

Function at 0x140004762
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
push rax
test rcx, rcx
sete al
test rdx, rdx
sete r9b
or r9b, al
jne 0x1400047e4
movzx r9d, word [rcx + 0x14]
add r9, rcx
add r9, 0x18
je 0x1400047e4
movzx r10d, word [rcx + 6]
test r10w, r10w
je 0x1400047e4
mov r11b, 1
xor eax, eax
jmp 0x1400046f1
movzx esi, r11b
inc r11b
cmp r10w, si
jbe 0x1400047e6
lea esi, [r11 - 1]
movzx esi, sil
shl esi, 3
lea rdi, [rsi + rsi*4]
mov byte [rsp + 7], 0x7f
mov byte [rsp + 6], 0x7f
movzx ebx, byte [rsp + 6]
xor bl, byte [rsp + 7]
movzx ebx, bl
mov esi, dword [r9 + rdi + 0xc]
cmp dword [rcx + rbx*8 + 0x88], esi
jb 0x1400046e0
mov byte [rsp + 5], 0x7f
mov byte [rsp + 4], 0x7f
movzx ebx, byte [rsp + 4]
xor bl, byte [rsp + 5]
movzx ebx, bl
mov edi, dword [rdi + r9 + 8]
add edi, esi
cmp dword [rcx + rbx*8 + 0x88], edi
jae 0x1400046e0
lea rax, [rsi + rdx]
mov byte [rsp + 3], 0x81
mov byte [rsp + 2], 0x81
movzx r9d, byte [rsp + 2]
xor r9b, byte [rsp + 3]
movzx r9d, r9b
mov ecx, dword [rcx + r9*8 + 0x88]
add rax, rcx
cmp rax, rsi
je 0x1400047e4
add rcx, rdx
mov r9d, dword [rcx + 0x18]
test r9d, r9d
je 0x1400047e4
mov r11d, dword [rcx + 0x20]
add r11, rdx
xor eax, eax
xor r10d, r10d
nop
movzx r10d, r10w
mov esi, dword [r11 + r10*4]
movzx ebx, byte [rsi + rdx]
test bl, bl
je 0x1400047cc
add rsi, rdx
inc rsi
mov edi, 0xbc62
nop dword [rax + rax]
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x14340e
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400047b0
cmp edi, r8d
jne 0x1400047d6
jmp 0x1400047ee
mov edi, 0xbc62
cmp edi, r8d
je 0x1400047ee
inc r10d
movzx esi, r10w
cmp r9d, esi
ja 0x140004790
jmp 0x1400047e6
xor eax, eax
add rsp, 8
pop rbx
pop rdi
pop rsi
ret
mov eax, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rdx
movzx ecx, word [rcx + r10*2]
add rax, rdx
mov eax, dword [rax + rcx*4]
add rax, rdx
jmp 0x1400047e6
Function at 0x140004786
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
push rax
test rcx, rcx
sete al
test rdx, rdx
sete r9b
or r9b, al
jne 0x1400047e4
movzx r9d, word [rcx + 0x14]
add r9, rcx
add r9, 0x18
je 0x1400047e4
movzx r10d, word [rcx + 6]
test r10w, r10w
je 0x1400047e4
mov r11b, 1
xor eax, eax
jmp 0x1400046f1
movzx esi, r11b
inc r11b
cmp r10w, si
jbe 0x1400047e6
lea esi, [r11 - 1]
movzx esi, sil
shl esi, 3
lea rdi, [rsi + rsi*4]
mov byte [rsp + 7], 0x7f
mov byte [rsp + 6], 0x7f
movzx ebx, byte [rsp + 6]
xor bl, byte [rsp + 7]
movzx ebx, bl
mov esi, dword [r9 + rdi + 0xc]
cmp dword [rcx + rbx*8 + 0x88], esi
jb 0x1400046e0
mov byte [rsp + 5], 0x7f
mov byte [rsp + 4], 0x7f
movzx ebx, byte [rsp + 4]
xor bl, byte [rsp + 5]
movzx ebx, bl
mov edi, dword [rdi + r9 + 8]
add edi, esi
cmp dword [rcx + rbx*8 + 0x88], edi
jae 0x1400046e0
lea rax, [rsi + rdx]
mov byte [rsp + 3], 0x81
mov byte [rsp + 2], 0x81
movzx r9d, byte [rsp + 2]
xor r9b, byte [rsp + 3]
movzx r9d, r9b
mov ecx, dword [rcx + r9*8 + 0x88]
add rax, rcx
cmp rax, rsi
je 0x1400047e4
add rcx, rdx
mov r9d, dword [rcx + 0x18]
test r9d, r9d
je 0x1400047e4
mov r11d, dword [rcx + 0x20]
add r11, rdx
xor eax, eax
xor r10d, r10d
nop
movzx r10d, r10w
mov esi, dword [r11 + r10*4]
movzx ebx, byte [rsi + rdx]
test bl, bl
je 0x1400047cc
add rsi, rdx
inc rsi
mov edi, 0xbc62
nop dword [rax + rax]
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x14340e
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400047b0
cmp edi, r8d
jne 0x1400047d6
jmp 0x1400047ee
mov edi, 0xbc62
cmp edi, r8d
je 0x1400047ee
inc r10d
movzx esi, r10w
cmp r9d, esi
ja 0x140004790
jmp 0x1400047e6
xor eax, eax
add rsp, 8
pop rbx
pop rdi
pop rsi
ret
mov eax, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rdx
movzx ecx, word [rcx + r10*2]
add rax, rdx
mov eax, dword [rax + rcx*4]
add rax, rdx
jmp 0x1400047e6

Function at 0x140004810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov word [rsp + 0x46], 0x76
mov word [rsp + 0x48], 0x70
mov word [rsp + 0x4a], 0x7d
mov word [rsp + 0x4c], 0x79
mov word [rsp + 0x4e], 0x70
and al, 0x4e
jo 0x14000483d
mov word [rsp + 0x50], 0x77
mov word [rsp + 0x52], 0x3e
mov word [rsp + 0x54], 0x3d
mov word [rsp + 0x56], 0x39
mov word [rsp + 0x58], 0x6f
mov word [rsp + 0x5a], 0x77
mov word [rsp + 0x5c], 0x77
mov word [rsp + 0x5e], 0
add byte [rcx + 0x1a], bh
call fcn.1400018f0
mov rdi, rax
xor eax, eax
nop word cs:[rax + rax]
movzx ecx, word [rsp + rax*2 + 0x46]
add ecx, 0xfffffff5
mov word [rdi + rax*2], cx
inc rax
cmp rax, 0xc
jne 0x140004890
mov word [rdi + 0x18], 0
mov word [rsp + 0x28], 0x30fe
movzx eax, word [rsp + 0x28]
xor eax, 0x6b
mov word [rsp + 0x2a], ax
Function at 0x140004cde
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
add eax, 7
xor eax, 0x32
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x2a]
add eax, 8
xor eax, 0x2e
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x2a]
add eax, 9
xor eax, 0x64
mov word [rsp + 0x3e], ax
movzx eax, word [rsp + 0x2a]
add eax, 0xa
xor eax, 0x6c
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x2a]
add eax, 0xb
xor eax, 0x6c
mov word [rsp + 0x42], ax
mov word [rsp + 0x44], 0
mov ecx, 0x1a
call fcn.1400018f0
mov rdi, rax
xor eax, eax
nop word cs:[rax + rax]
movzx ecx, word [rsp + rax*2 + 0x2c]
movzx edx, word [rsp + 0x2a]
add edx, eax
xor dx, cx
mov word [rdi + rax*2], dx
inc rax
cmp rax, 0xc
jne 0x140004cf0
mov word [rdi + 0x18], 0
mov word [rsp + 0x46], 0x77
add byte [rsi - 0x39], ah
and al, 0x48
jno 0x140004d20
mov word [rsp + 0x4a], 0x7e
mov word [rsp + 0x4c], 0x7a
mov word [rsp + 0x4e], 0x71
mov word [rsp + 0x50], pe_nt_image_headers64
mov word [rsp + 0x52], 0x3f
mov word [rsp + 0x54], 0x3e
mov word [rsp + 0x56], 0x3a
mov word [rsp + 0x58], 0x70
mov word [rsp + 0x5a], pe_nt_image_headers64
mov word [rsp + 0x5c], pe_nt_image_headers64
mov word [rsp + 0x5e], 0
mov ecx, 0x1a
call fcn.1400018f0
xor ecx, ecx
nop dword [rax]
movzx edx, word [rsp + rcx*2 + 0x46]
add edx, 0xfffffff4
mov word [rax + rcx*2], dx
inc rcx
cmp rcx, 0xc
jne 0x140004d80
mov word [rax + 0x18], 0
mov byte [rsp + 0x29], 0x69
movzx ecx, byte [rsp + 0x29]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x140004dc6
cmp r9w, r10w
je 0x140004e13
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [rax + r8]
lea ebx, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp bx, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x140004dc0
add r8, 2
cmp r9w, r10w
je 0x140004dd0
jmp 0x140004dc0
mov rdx, qword [rcx + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov r8d, 0x12337fde
call fcn.140004690
mov rcx, rdi
call rax
mov rsi, qword [rsi]
mov word [rsp + 0x2a], 0x71
Function at 0x140004cf4
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
add eax, 7
xor eax, 0x32
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x2a]
add eax, 8
xor eax, 0x2e
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x2a]
add eax, 9
xor eax, 0x64
mov word [rsp + 0x3e], ax
movzx eax, word [rsp + 0x2a]
add eax, 0xa
xor eax, 0x6c
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x2a]
add eax, 0xb
xor eax, 0x6c
mov word [rsp + 0x42], ax
mov word [rsp + 0x44], 0
mov ecx, 0x1a
call fcn.1400018f0
mov rdi, rax
xor eax, eax
nop word cs:[rax + rax]
movzx ecx, word [rsp + rax*2 + 0x2c]
movzx edx, word [rsp + 0x2a]
add edx, eax
xor dx, cx
mov word [rdi + rax*2], dx
inc rax
cmp rax, 0xc
jne 0x140004cf0
mov word [rdi + 0x18], 0
mov word [rsp + 0x46], 0x77
add byte [rsi - 0x39], ah
and al, 0x48
jno 0x140004d20
mov word [rsp + 0x4a], 0x7e
mov word [rsp + 0x4c], 0x7a
mov word [rsp + 0x4e], 0x71
mov word [rsp + 0x50], pe_nt_image_headers64
mov word [rsp + 0x52], 0x3f
mov word [rsp + 0x54], 0x3e
mov word [rsp + 0x56], 0x3a
mov word [rsp + 0x58], 0x70
mov word [rsp + 0x5a], pe_nt_image_headers64
mov word [rsp + 0x5c], pe_nt_image_headers64
mov word [rsp + 0x5e], 0
mov ecx, 0x1a
call fcn.1400018f0
xor ecx, ecx
nop dword [rax]
movzx edx, word [rsp + rcx*2 + 0x46]
add edx, 0xfffffff4
mov word [rax + rcx*2], dx
inc rcx
cmp rcx, 0xc
jne 0x140004d80
mov word [rax + 0x18], 0
mov byte [rsp + 0x29], 0x69
movzx ecx, byte [rsp + 0x29]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x140004dc6
cmp r9w, r10w
je 0x140004e13
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [rax + r8]
lea ebx, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp bx, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x140004dc0
add r8, 2
cmp r9w, r10w
je 0x140004dd0
jmp 0x140004dc0
mov rdx, qword [rcx + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov r8d, 0x12337fde
call fcn.140004690
mov rcx, rdi
call rax
mov rsi, qword [rsi]
mov word [rsp + 0x2a], 0x71
Function at 0x140004d7b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add eax, 7
xor eax, 0x32
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x2a]
add eax, 8
xor eax, 0x2e
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x2a]
add eax, 9
xor eax, 0x64
mov word [rsp + 0x3e], ax
movzx eax, word [rsp + 0x2a]
add eax, 0xa
xor eax, 0x6c
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x2a]
add eax, 0xb
xor eax, 0x6c
mov word [rsp + 0x42], ax
mov word [rsp + 0x44], 0
mov ecx, 0x1a
call fcn.1400018f0
mov rdi, rax
xor eax, eax
nop word cs:[rax + rax]
movzx ecx, word [rsp + rax*2 + 0x2c]
movzx edx, word [rsp + 0x2a]
add edx, eax
xor dx, cx
mov word [rdi + rax*2], dx
inc rax
cmp rax, 0xc
jne 0x140004cf0
mov word [rdi + 0x18], 0
mov word [rsp + 0x46], 0x77
add byte [rsi - 0x39], ah
and al, 0x48
jno 0x140004d20
mov word [rsp + 0x4a], 0x7e
mov word [rsp + 0x4c], 0x7a
mov word [rsp + 0x4e], 0x71
mov word [rsp + 0x50], pe_nt_image_headers64
mov word [rsp + 0x52], 0x3f
mov word [rsp + 0x54], 0x3e
mov word [rsp + 0x56], 0x3a
mov word [rsp + 0x58], 0x70
mov word [rsp + 0x5a], pe_nt_image_headers64
mov word [rsp + 0x5c], pe_nt_image_headers64
mov word [rsp + 0x5e], 0
mov ecx, 0x1a
call fcn.1400018f0
xor ecx, ecx
nop dword [rax]
movzx edx, word [rsp + rcx*2 + 0x46]
add edx, 0xfffffff4
mov word [rax + rcx*2], dx
inc rcx
cmp rcx, 0xc
jne 0x140004d80
mov word [rax + 0x18], 0
mov byte [rsp + 0x29], 0x69
movzx ecx, byte [rsp + 0x29]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x140004dc6
cmp r9w, r10w
je 0x140004e13
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [rax + r8]
lea ebx, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp bx, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x140004dc0
add r8, 2
cmp r9w, r10w
je 0x140004dd0
jmp 0x140004dc0
mov rdx, qword [rcx + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov r8d, 0x12337fde
call fcn.140004690
mov rcx, rdi
call rax
mov rsi, qword [rsi]
mov word [rsp + 0x2a], 0x71

Function at 0x140004e38
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov word [rsp + 0x2c], 0x6b
mov word [rsp + 0x2e], pe_nt_image_headers64
mov word [rsp + 0x30], 0x74
mov word [rsp + 0x32], 0x6b
mov word [rsp + 0x34], 0x72
mov word [rsp + 0x36], 0x39
mov word [rsp + 0x38], 0x38
mov word [rsp + 0x3a], 0x34
mov word [rsp + 0x3c], 0x6a
mov word [rsp + 0x3e], 0x72
mov word [rsp + 0x40], 0x72
mov word [rsp + 0x42], 0
mov ecx, 0x1a
call fcn.1400018f0
xor ecx, ecx
nop dword [rax + rax]
movzx edx, word [rsp + rcx*2 + 0x2a]
add edx, 0xfffffffa
mov word [rax + rcx*2], dx
inc rcx
cmp rcx, 0xc
jne 0x140004ea0
mov word [rax + 0x18], 0
mov byte [rsp + 0x46], 0x69
movzx ecx, byte [rsp + 0x46]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x140004ee6
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [rax + r8]
Function at 0x140007594
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, qword [rcx]
mov word [rsp + 0x2a], 0x52f
movzx eax, word [rsp + 0x2a]
xor eax, 0x77
mov word [rsp + 0x2c], ax
movzx eax, word [rsp + 0x2a]
inc eax
xor eax, 0x69
mov word [rsp + 0x2e], ax
movzx eax, word [rsp + 0x2a]
add eax, 2
xor eax, 0x6e
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x2a]
add eax, 3
xor eax, 0x68
mov word [rsp + 0x32], ax
movzx eax, word [rsp + 0x2a]
add eax, 4
xor eax, 0x74
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x2a]
add eax, 5
xor eax, 0x74
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x2a]
add eax, 6
xor eax, 0x70
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x2a]
add eax, 7
xor eax, 0x2e
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x2a]
add eax, 8
xor eax, 0x64
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x2a]
add eax, 9
xor eax, 0x6c
mov word [rsp + 0x3e], ax
movzx eax, word [rsp + 0x2a]
add eax, 0xa
xor eax, 0x6c
mov word [rsp + 0x40], ax
mov word [rsp + 0x42], 0
mov ecx, 0x18
call fcn.1400018f0
mov rsi, rax
xor eax, eax
nop word cs:[rax + rax]
movzx ecx, word [rsp + rax*2 + 0x2c]
movzx edx, word [rsp + 0x2a]
add edx, eax
xor dx, cx
mov word [rsi + rax*2], dx
inc rax
cmp rax, 0xb
jne 0x1400075c0
mov word [rsi + 0x16], 0
mov word [rsp + 0x44], 0xbf92
mov word [rsp + 0x46], 0xbff9
mov word [rsp + 0x48], 0xbff7
mov word [rsp + 0x4a], 0xbfe0
mov word [rsp + 0x4c], 0xbffc
mov word [rsp + 0x4e], 0xbff7
mov word [rsp + 0x50], 0xbffe
mov word [rsp + 0x52], 0xbfa1
mov word [rsp + 0x54], 0xbfa0
mov word [rsp + 0x56], 0xbfbc
mov word [rsp + 0x58], 0xbff6
mov word [rsp + 0x5a], 0xbffe
mov word [rsp + 0x5c], 0xbffe
mov word [rsp + 0x5e], 0
mov ecx, 0x1a
call fcn.1400018f0
mov ecx, 1
add byte [rax], al
add byte [rsi + 0x66], ah
nop word cs:[rax + rax]
movzx edx, word [rsp + rcx*2 + 0x44]
xor dx, word [rsp + 0x44]
mov word [rax + rcx*2 - 2], dx
inc rcx
cmp rcx, 0xd
jne 0x140007660
mov word [rax + 0x18], 0
mov byte [rsp + 0x29], 0x69
movzx ecx, byte [rsp + 0x29]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x1400076a6
cmp r9w, r10w
je 0x1400076f3
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [rax + r8]
lea ebx, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp bx, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x1400076a0
add r8, 2
cmp r9w, r10w
je 0x1400076b0
jmp 0x1400076a0
mov rdx, qword [rcx + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov r8d, 0x12337fde
call fcn.140004690
mov rcx, rsi
call rax
mov word [rsp + 0x44], 0x82
mov word [rsp + 0x46], 0x74
mov word [rsp + 0x48], 0x79
mov word [rsp + 0x4a], 0x73
mov word [rsp + 0x4c], 0x7f
mov word [rsp + 0x4e], 0x7f
mov word [rsp + 0x50], 0x7b
mov word [rsp + 0x52], 0x39
mov word [rsp + 0x54], 0x6f
mov word [rsp + 0x56], 0x77
mov word [rsp + 0x58], 0x77
mov word [rsp + 0x5a], 0
Function at 0x14000766a
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, qword [rcx]
mov word [rsp + 0x2a], 0x52f
movzx eax, word [rsp + 0x2a]
xor eax, 0x77
mov word [rsp + 0x2c], ax
movzx eax, word [rsp + 0x2a]
inc eax
xor eax, 0x69
mov word [rsp + 0x2e], ax
movzx eax, word [rsp + 0x2a]
add eax, 2
xor eax, 0x6e
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x2a]
add eax, 3
xor eax, 0x68
mov word [rsp + 0x32], ax
movzx eax, word [rsp + 0x2a]
add eax, 4
xor eax, 0x74
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x2a]
add eax, 5
xor eax, 0x74
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x2a]
add eax, 6
xor eax, 0x70
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x2a]
add eax, 7
xor eax, 0x2e
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x2a]
add eax, 8
xor eax, 0x64
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x2a]
add eax, 9
xor eax, 0x6c
mov word [rsp + 0x3e], ax
movzx eax, word [rsp + 0x2a]
add eax, 0xa
xor eax, 0x6c
mov word [rsp + 0x40], ax
mov word [rsp + 0x42], 0
mov ecx, 0x18
call fcn.1400018f0
mov rsi, rax
xor eax, eax
nop word cs:[rax + rax]
movzx ecx, word [rsp + rax*2 + 0x2c]
movzx edx, word [rsp + 0x2a]
add edx, eax
xor dx, cx
mov word [rsi + rax*2], dx
inc rax
cmp rax, 0xb
jne 0x1400075c0
mov word [rsi + 0x16], 0
mov word [rsp + 0x44], 0xbf92
mov word [rsp + 0x46], 0xbff9
mov word [rsp + 0x48], 0xbff7
mov word [rsp + 0x4a], 0xbfe0
mov word [rsp + 0x4c], 0xbffc
mov word [rsp + 0x4e], 0xbff7
mov word [rsp + 0x50], 0xbffe
mov word [rsp + 0x52], 0xbfa1
mov word [rsp + 0x54], 0xbfa0
mov word [rsp + 0x56], 0xbfbc
mov word [rsp + 0x58], 0xbff6
mov word [rsp + 0x5a], 0xbffe
mov word [rsp + 0x5c], 0xbffe
mov word [rsp + 0x5e], 0
mov ecx, 0x1a
call fcn.1400018f0
mov ecx, 1
add byte [rax], al
add byte [rsi + 0x66], ah
nop word cs:[rax + rax]
movzx edx, word [rsp + rcx*2 + 0x44]
xor dx, word [rsp + 0x44]
mov word [rax + rcx*2 - 2], dx
inc rcx
cmp rcx, 0xd
jne 0x140007660
mov word [rax + 0x18], 0
mov byte [rsp + 0x29], 0x69
movzx ecx, byte [rsp + 0x29]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x1400076a6
cmp r9w, r10w
je 0x1400076f3
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [rax + r8]
lea ebx, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp bx, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x1400076a0
add r8, 2
cmp r9w, r10w
je 0x1400076b0
jmp 0x1400076a0
mov rdx, qword [rcx + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov r8d, 0x12337fde
call fcn.140004690
mov rcx, rsi
call rax
mov word [rsp + 0x44], 0x82
mov word [rsp + 0x46], 0x74
mov word [rsp + 0x48], 0x79
mov word [rsp + 0x4a], 0x73
mov word [rsp + 0x4c], 0x7f
mov word [rsp + 0x4e], 0x7f
mov word [rsp + 0x50], 0x7b
mov word [rsp + 0x52], 0x39
mov word [rsp + 0x54], 0x6f
mov word [rsp + 0x56], 0x77
mov word [rsp + 0x58], 0x77
mov word [rsp + 0x5a], 0
Function at 0x140007fa2
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov word [rsp + 0x30], 0x963f
movzx eax, word [rsp + 0x30]
xor eax, 0x6b
mov word [rsp + 0x32], ax
movzx eax, word [rsp + 0x30]
inc eax
xor eax, 0x65
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x30]
add eax, 2
xor eax, 0x72
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x30]
add eax, 3
xor eax, 0x6e
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x30]
add eax, 4
xor eax, 0x65
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x30]
add eax, 5
xor eax, 0x6c
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x30]
add eax, 6
xor eax, 0x33
mov word [rsp + 0x3e], ax
movzx eax, word [rsp + 0x30]
add eax, 7
xor eax, 0x32
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x30]
add eax, 8
xor eax, 0x2e
mov word [rsp + 0x42], ax
movzx eax, word [rsp + 0x30]
add eax, 9
xor eax, 0x64
mov word [rsp + 0x44], ax
movzx eax, word [rsp + 0x30]
add eax, 0xa
xor eax, 0x6c
mov word [rsp + 0x46], ax
movzx eax, word [rsp + 0x30]
add eax, 0xb
xor eax, 0x6c
mov word [rsp + 0x48], ax
mov word [rsp + 0x4a], 0
mov ecx, 0x1a
call fcn.1400018f0
mov rsi, rax
xor eax, eax
nop
movzx ecx, word [rsp + rax*2 + 0x32]
movzx edx, word [rsp + 0x30]
add edx, eax
xor dx, cx
mov word [rsi + rax*2], dx
inc rax
cmp rax, 0xc
jne 0x140007fc0
mov word [rsi + 0x18], 0
mov word [rsp + 0x4c], 0x955
mov word [rsp + 0x4e], 0x93e
mov word [rsp + 0x50], 0x930
mov word [rsp + 0x52], 0x927
mov word [rsp + 0x54], 0x93b
mov word [rsp + 0x56], 0x930
mov word [rsp + 0x58], 0x939
mov word [rsp + 0x5a], 0x966
mov word [rsp + 0x5c], 0x967
mov word [rsp + 0x5e], 0x97b
mov word [rsp + 0x60], 0x931
mov word [rsp + 0x62], 0x939
mov word [rsp + 0x64], 0x939
mov word [rsp + 0x66], 0
mov ecx, 0x1a
call fcn.1400018f0
Function at 0x140007fdc
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov word [rsp + 0x30], 0x963f
movzx eax, word [rsp + 0x30]
xor eax, 0x6b
mov word [rsp + 0x32], ax
movzx eax, word [rsp + 0x30]
inc eax
xor eax, 0x65
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x30]
add eax, 2
xor eax, 0x72
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x30]
add eax, 3
xor eax, 0x6e
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x30]
add eax, 4
xor eax, 0x65
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x30]
add eax, 5
xor eax, 0x6c
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x30]
add eax, 6
xor eax, 0x33
mov word [rsp + 0x3e], ax
movzx eax, word [rsp + 0x30]
add eax, 7
xor eax, 0x32
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x30]
add eax, 8
xor eax, 0x2e
mov word [rsp + 0x42], ax
movzx eax, word [rsp + 0x30]
add eax, 9
xor eax, 0x64
mov word [rsp + 0x44], ax
movzx eax, word [rsp + 0x30]
add eax, 0xa
xor eax, 0x6c
mov word [rsp + 0x46], ax
movzx eax, word [rsp + 0x30]
add eax, 0xb
xor eax, 0x6c
mov word [rsp + 0x48], ax
mov word [rsp + 0x4a], 0
mov ecx, 0x1a
call fcn.1400018f0
mov rsi, rax
xor eax, eax
nop
movzx ecx, word [rsp + rax*2 + 0x32]
movzx edx, word [rsp + 0x30]
add edx, eax
xor dx, cx
mov word [rsi + rax*2], dx
inc rax
cmp rax, 0xc
jne 0x140007fc0
mov word [rsi + 0x18], 0
mov word [rsp + 0x4c], 0x955
mov word [rsp + 0x4e], 0x93e
mov word [rsp + 0x50], 0x930
mov word [rsp + 0x52], 0x927
mov word [rsp + 0x54], 0x93b
mov word [rsp + 0x56], 0x930
mov word [rsp + 0x58], 0x939
mov word [rsp + 0x5a], 0x966
mov word [rsp + 0x5c], 0x967
mov word [rsp + 0x5e], 0x97b
mov word [rsp + 0x60], 0x931
mov word [rsp + 0x62], 0x939
mov word [rsp + 0x64], 0x939
mov word [rsp + 0x66], 0
mov ecx, 0x1a
call fcn.1400018f0