joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x448e58
movzx edx, byte [rax]
nop
test edx, edx
jne 0x448d1c
test r8b, r8b
jne 0x448d1c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x448d2f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x448e18
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x448e06
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x448dfc
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x448d83
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x448dc6
mov eax, 1
cmp rax, rbx
ja 0x448db5
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.00458ae0
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x448df4
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x448dbd
mov r8d, eax
mov eax, r10d
jmp 0x448d88
mov rcx, rbx
call fcn.00458a20
xor eax, eax
mov rcx, rbx
call fcn.00458a20
mov eax, r8d
mov rcx, rbx
call fcn.00458ae0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x448e4e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x448e11
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x448d35
mov eax, edx
mov rcx, rbx
call fcn.00458a20
xor eax, eax
mov rcx, rbx
nop dword [rax]
call fcn.00458a20
nop
int3
Function at 0x4504c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45057b
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x004505c0]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00456220
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00456360
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004504c0
Function at 0x4584e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0058d720]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0058d450], 0
je 0x458516
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0058d9e0]
aesenc xmm0, xmmword [0x0058d9f0]
aesenc xmm0, xmmword [0x0058da00]
movq rax, xmm0
ret
jmp 0x408560

Function at 0x459e00
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x0058d960]
mov qword [rsp + 8], rdx
lea r8d, [0x0058d468]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.004583c0
add rsp, 0x30
ret
Function at 0x1400056b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2040
call fcn.14008b550
sub rsp, rax
mov rax, qword [0x1400f1010]
xor rax, rsp
mov qword [rsp + 0x2030], rax
mov qword [rsp + 0x20], rcx
xor esi, esi
mov eax, esi
mov dword [rsp + 0x20], 0x6b62716a
mov rbx, rcx
invalid

Function at 0x14000b020
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1400f1010]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [0x1400bf610]
xor edx, edx
test eax, eax
jns 0x14000b0fa
mov dword [rsp + 0x38], 0x3431344e
mov dword [rsp + 0x3c], 0x34493450
mov dword [rsp + 0x40], 0x347b346f
mov dword [rsp + 0x44], 0x3471
mov byte [rsp + 0x48], 1
mov ecx, edx
mov edi, 0x340a
nop dword [rax]
lea eax, [rdi + rcx]
xor word [rsp + rcx*2 + 0x38], ax
inc rcx
cmp rcx, 7
jb 0x14000b0a0
mov byte [rsp + 0x48], 0
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
lea rax, [rsp + 0x38]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14000b0d1
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14002a2d0
nop
lea rdi, [rsp + 0x38]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
jmp 0x14000b12c
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], dx
jne 0x14000b115
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14002a2d0
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14005fa30
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x14000de40
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x70]
mov rbx, rcx
test rdi, rdi
je 0x14000de6b
mov rcx, rdi
call fcn.14000b220
mov edx, 0x58
mov rcx, rdi
call fcn.14005fb2c
mov rdx, qword [rbx + 0xd0]
cmp rdx, 8
jb 0x14000deb1
mov rcx, qword [rbx + 0xb8]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000deac
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000dfee
mov rcx, r8
call fcn.14005fb2c
xor edi, edi
mov qword [rbx + 0xd0], 7
mov qword [rbx + 0xc8], rdi
mov word [rbx + 0xb8], di
mov rdx, qword [rbx + 0xb0]
cmp rdx, 0x10
jb 0x14000df0d
mov rcx, qword [rbx + 0x98]
inc rdx
cmp rdx, 0x1000
jb 0x14000df08
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000dfee
mov rcx, r8
call fcn.14005fb2c
mov qword [rbx + 0xa8], rdi
mov qword [rbx + 0xb0], 0xf
mov byte [rbx + 0x98], dil
mov rdx, qword [rbx + 0x90]
cmp rdx, 8
jb 0x14000df69
mov rcx, qword [rbx + 0x78]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000df64
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000dfee
mov rcx, r8
call fcn.14005fb2c
mov qword [rbx + 0x88], rdi
mov qword [rbx + 0x90], 7
mov word [rbx + 0x78], di
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14000dfc5
mov rdx, qword [rbx + 0x20]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x14000dfb4
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000dfee
mov rcx, r8
call fcn.14005fb2c
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
mov r8, qword [rbx]
mov rdx, rbx
mov rcx, rbx
mov r8, qword [r8 + 8]
call fcn.14005e960
mov rcx, qword [rbx]
mov edx, 0x48
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14005fb2c
call fcn.14009598c
int3
Function at 0x14000e000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1400f1010]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400dde00]
xor ebx, ebx
movdqa xmm1, xmmword [0x1400ddd00]
mov r11, rcx
movdqu xmmword [rbp + 0xf], xmm0
mov ecx, ebx
mov dword [rbp + 0x3f], 0x1004746
movdqa xmm0, xmmword [0x1400ddc00]
movdqu xmmword [rbp + 0x2f], xmm0
movdqu xmmword [rbp + 0x1f], xmm1
nop word [rax + rax]
lea eax, [rcx + 0xe]
xor byte [rbp + rcx + 0xf], al
inc rcx
cmp rcx, 0x32
jb 0x14000e060
mov byte [rbp + 0x42], bl
mov rcx, rbx
mov dword [rbp - 0x29], 0x346f345d
mov edx, 0x3409
mov dword [rbp - 0x25], 0x3461346a
mov dword [rbp - 0x21], 0x3467345b
mov dword [rbp - 0x1d], 0x3467346a
mov dword [rbp - 0x19], 0x34603474
mov dword [rbp - 0x15], 0x3425344c
mov dword [rbp - 0x11], 0x34493426
mov dword [rbp - 0xd], 0x34473425
mov dword [rbp - 9], 0x342e3428
mov dword [rbp - 5], 0x342e3428
mov dword [rbp - 1], 0x3441342a
mov dword [rbp + 3], 0x347f342f
mov dword [rbp + 7], 0x3467
mov byte [rbp + 0xb], 1
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [rbp + rcx*2 - 0x29], ax
inc rcx
cmp rcx, 0x19
jb 0x14000e0e0
mov r10, qword [r11]
mov r11, qword [r11 + 8]
mov byte [rbp + 0xb], bl
sub r11, r10
je 0x14000e15b
movzx r8d, byte [rbp + 0xf]
mov r9, r10
nop dword [rax + rax]
lea rdx, [rbp - 0x29]
test r8b, r8b
je 0x14000e15e
lea rcx, [rbp + 0xf]
mov rdi, r9
sub rdi, rcx
lea rax, [rbp + 0xf]
movzx ecx, r8b
nop dword [rax + rax]
cmp cl, 0x78
jne 0x14000e13d
movzx ecx, byte [rdx]
cmp byte [rax + rdi], cl
jne 0x14000e14d
movzx ecx, byte [rax + 1]
inc rax
inc rdx
test cl, cl
jne 0x14000e130
jmp 0x14000e15e
inc r9
mov rax, r9
sub rax, r10
cmp rax, r11
jb 0x14000e110
mov r9, rbx
mov r8, qword [0x140102cf0]
lea rdi, [rbp - 0x29]
xor eax, eax
lea rdx, [0x140102ce0]
cmp qword [0x140102cf8], 8
mov ecx, 0x34
rep stosb byte [rdi], al
cmovae rdx, qword [0x140102ce0]
lea rdi, [rbp + 0xf]
mov ecx, 0x33
lea r8, [r8*2 + 2]
rep stosb byte [rdi], al
mov rcx, r9
call fcn.14008cda0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14005fa30
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140010f60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400f1010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
mov qword [rbp - 0x40], rcx
xor r14d, r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
lea ecx, [r14 + 0x48]
call fcn.1400111e0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsi], rax
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], r14
mov qword [rsi + 0x20], r14
mov byte [rsi + 0x38], 1
mov qword [rsi + 0x3c], r14
mov qword [rsi + 0x48], r14
mov dword [rsi + 0x50], r14d
mov qword [rsi + 0x58], r14
mov qword [rsi + 0x60], r14
mov qword [rsi + 0x68], r14
mov qword [rsi + 0x70], r14
mov dword [rbp - 0x28], 0x347f347e
mov dword [rbp - 0x24], 0x347c3468
mov dword [rbp - 0x20], 0x3422343c
mov dword [rbp - 0x1c], 0x3476343f
mov dword [rbp - 0x18], 0x3478347f
mov word [rbp - 0x14], r14w
mov byte [rbp - 0x12], 1
mov ecx, r14d
mov edx, 0x340b
lea eax, [rdx + rcx]
xor word [rbp + rcx*2 - 0x28], ax
inc rcx
cmp rcx, 0xa
jb 0x140011011
mov byte [rbp - 0x12], 0
mov qword [rsi + 0x88], r14
mov qword [rsi + 0x90], 7
mov word [rsi + 0x78], r14w
lea rax, [rbp - 0x28]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140011050
lea rdx, [rbp - 0x28]
lea rcx, [rsi + 0x78]
call fcn.14002a2d0
nop
lea rdi, [rbp - 0x28]
xor eax, eax
mov ecx, 0x16
rep stosb byte [rdi], al
movdqa xmm0, xmmword [0x1400de1a0]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x18], 0x100
mov rax, r14
nop dword [rax]
lea ecx, [rax + 0xa]
xor byte [rbp + rax - 0x28], cl
inc rax
cmp rax, 0x10
jb 0x140011090
mov byte [rbp - 0x17], 0
mov qword [rsi + 0xa8], r14
mov qword [rsi + 0xb0], 0xf
mov byte [rsi + 0x98], 0
lea rax, [rbp - 0x28]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400110c1
mov r8, rbx
lea rdx, [rbp - 0x28]
lea rcx, [rsi + 0x98]
call fcn.14002a590
nop
lea rdi, [rbp - 0x28]
xor eax, eax
mov ecx, 0x11
rep stosb byte [rdi], al
lea rcx, [rsi + 0xb8]
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 7
mov word [rcx], r14w
xor r8d, r8d
lea rdx, [0x1400dd0a4]
call fcn.14002a2d0
mov word [rsi + 0xd8], 0x101
mov rax, rsi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14005fa30
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400111e0
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, qword [0x140108148]
mov r14, rcx
test rsi, rsi
jne 0x1400112b7
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rsi, qword [rdx + 0x10]
mov rdi, rsi
nop dword [rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140011298
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140011298
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rbx + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140011293
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140011270
cmp edx, 0xb3f819f8
je 0x1400113b1
test r8d, r8d
jne 0x140011250
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
jne 0x140011220
xor esi, esi
xor rsi, 0x1340e
mov qword [0x140108148], rsi
mov rax, qword [0x140108138]
xor rsi, 0x1340e
test rax, rax
jne 0x140011383
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbp
mov rcx, qword [rax + 0x18]
mov rbp, qword [rcx + 0x10]
mov rdi, rbp
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140011364
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140011364
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rbx + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14001135f
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140011340
cmp edx, 0x86fe8652
je 0x1400113cf
test r8d, r8d
jne 0x140011320
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
jne 0x1400112f0
xor eax, eax
mov rbp, qword [rsp + 0x30]
xor rax, 0x1340e
mov qword [0x140108138], rax
xor rax, 0x1340e
call rax
mov r8, r14
mov edx, 8
mov rcx, rax
mov rax, rsi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp rax
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov esi, dword [rcx + rdx*4]
add rsi, r9
jmp 0x1400112a9
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140011371
Function at 0x1400113f0
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov rdi, qword [0x140108160]
test rdi, rdi
jne 0x1400114d6
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rsi, qword [rdx + 0x10]
mov rdi, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400114b7
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400114b7
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [rbx + r8*4]
mov eax, dword [rax + r9]
add rax, r9
mov edx, 0x811c9dc5
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400114b2
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x140011490
cmp edx, 0x7c76ecf5
je 0x1400115cb
test r8d, r8d
jne 0x140011470
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
jne 0x140011440
xor edi, edi
xor rdi, 0x1340e
mov qword [0x140108160], rdi
xor rdi, 0x1340e
mov rax, qword [0x140108138]
test rax, rax
jne 0x14001159d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbp, qword [rcx + 0x10]
mov rsi, rbp
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140011583
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140011583
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [rbx + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x811c9dc5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14001157e
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140011560
cmp edx, 0x86fe8652
je 0x1400115e9
test r8d, r8d
jne 0x140011540
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
jne 0x140011510
xor eax, eax
xor rax, 0x1340e
mov qword [0x140108138], rax
xor rax, 0x1340e
call rax
mov r8, r14
xor edx, edx
mov rcx, rax
call rdi
nop
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov edi, dword [rcx + rdx*4]
add rdi, r9
jmp 0x1400114c8
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140011590
jmp 0x1400113f0
Function at 0x140011960
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400f1010]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov qword [rbp - 0x60], rcx
mov dword [rbp - 0x58], 0x34563433
mov dword [rbp - 0x54], 0x3465345c
mov dword [rbp - 0x50], 0x346a3463
mov dword [rbp - 0x4c], 0x34673460
mov dword [rbp - 0x48], 0x344e3462
mov dword [rbp - 0x44], 0x34663443
mov dword [rbp - 0x40], 0x34703470
mov dword [rbp - 0x3c], 0x346c3472
mov dword [rbp - 0x38], 0x3472347a
mov dword [rbp - 0x34], 0x3447
xor edi, edi
mov byte [rbp - 0x30], 1
mov eax, edi
mov edx, 0x3409
nop dword [rax]
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x58], cx
inc rax
cmp rax, 0x13
jb 0x1400119e0
mov byte [rbp - 0x30], 0
lea rcx, [rbp - 0x28]
call fcn.1400056b0
nop
lea rcx, [rbp - 0x58]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rcx + r8*2], 0
jne 0x140011a10
lea rdx, [rbp - 0x58]
mov rcx, rax
call fcn.14002aca0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140011a89
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011a83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011aba
call fcn.14005fb2c
nop
lea rdi, [rbp - 0x58]
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14005fa30
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14009598c
nop
jmp 0x1403b9f16
Function at 0x140014350
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x790]
sub rsp, 0x890
mov rax, qword [0x1400f1010]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov r14, rcx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x68]
call fcn.14000b020
nop
cmp qword [0x1401060f8], 0
jne 0x1400143ac
mov ecx, 1
call fcn.1400111e0
mov qword [0x1401060f8], rax
mov dword [rsp + 0x20], 0x10
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x78]
xor ecx, ecx
call qword [0x1400bf3a0]
xor esi, esi
test eax, eax
jne 0x14001445b
mov dword [rsp + 0x28], 0x34663446
mov dword [rsp + 0x2c], 0x346e3464
mov word [rsp + 0x30], si
mov byte [rsp + 0x32], 1
mov ecx, esi
mov edx, 0x3408
lea eax, [rdx + rcx]
xor word [rsp + rcx*2 + 0x28], ax
inc rcx
cmp rcx, 4
jb 0x1400143f0
mov byte [rsp + 0x32], 0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], si
lea rax, [rsp + 0x28]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140014430
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.14002a2d0
nop
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0xa
rep stosb byte [rdi], al
jmp 0x140014498
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], si
lea rax, [rbp - 0x78]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], si
jne 0x140014480
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call fcn.14002a2d0
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
lea r8, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r8, qword [rsp + 0x68]
mov dword [rsp + 0x38], 0x3478342f
mov dword [rsp + 0x3c], 0x34283450
mov dword [rsp + 0x40], 0x347d
mov byte [rsp + 0x44], 1
mov rcx, rsi
mov edx, 0x340a
nop
lea eax, [rdx + rcx]
xor word [rsp + rcx*2 + 0x38], ax
inc rcx
cmp rcx, 5
jb 0x1400144e0
mov byte [rsp + 0x44], 0
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x50]
call fcn.14005ce90
lea rdi, [rsp + 0x38]
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140014554
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001454f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400145f7
call fcn.14005fb2c
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], 7
mov word [r14], si
lea rax, [rbp - 0x50]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140014570
mov r8, rbx
lea rdx, [rbp - 0x50]
mov rcx, r14
call fcn.14002a2d0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400145c7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400145c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400145f1
call fcn.14005fb2c
mov rax, r14
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.14005fa30
lea r11, [rsp + 0x890]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14009598c
nop
call fcn.14009598c
nop
int3