joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400026b8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x71b2
mov dword [rbp - 0x20], 0x71db7190
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x71c171c1
mov dword [rbp - 0x18], 0x71d771c7
mov dword [rbp - 0x14], 0x719071c0
mov dword [rbp - 0x10], 0x71907188
mov dword [rbp - 8], 0x8cc671b2
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140002711
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140002730
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x1c
mov dword [rbp - 0x20], 0x71bc71f1
mov dword [rbp - 0x1c], 0x71b971b1
mov ebx, 0x71d3
mov dword [rbp - 0x18], 0x71ba718c
mov dword [rbp - 0x14], 0x71f171b7
mov dword [rbp - 0x10], 0x71f171e9
mov dword [rbp - 0xc], 0x71a071f6
mov dword [rbp - 8], 0x71d371f1
mov dword [rbp - 4], 0x8cc671d3
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xe
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140002794
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400027b4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x71447105
mov dword [rbp - 0x1c], 0x71557142
mov ebx, 0x7127
mov dword [rbp - 0x18], 0x71547153
mov dword [rbp - 0x14], 0x711d7105
mov dword [rbp - 0x10], 0x7127715c
mov dword [rbp - 0xc], 0x8cc67127
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000280a
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000282c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov ebx, 0x71b7
mov dword [rbp - 0x60], 0x71d17195
mov ecx, 0x5a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x5c], 0x71d871c5
mov dword [rbp - 0x58], 0x719571da
mov dword [rbp - 0x54], 0x7195718d
mov dword [rbp - 0x50], 0x71877192
mov dword [rbp - 0x4c], 0x71d37183
mov dword [rbp - 0x48], 0x7192719a
mov dword [rbp - 0x44], 0x71857187
mov dword [rbp - 0x40], 0x719a71d3
mov dword [rbp - 0x3c], 0x71877192
mov dword [rbp - 0x38], 0x71d37185
mov dword [rbp - 0x34], 0x71927197
mov dword [rbp - 0x30], 0x71857187
mov dword [rbp - 0x2c], 0x718d71d3
mov dword [rbp - 0x28], 0x71877192
mov dword [rbp - 0x24], 0x71d37185
mov dword [rbp - 0x20], 0x7192718d
mov dword [rbp - 0x1c], 0x71857187
mov dword [rbp - 0x18], 0x719771d3
mov dword [rbp - 0x14], 0x71877192
mov dword [rbp - 0x10], 0x71d37184
mov dword [rbp - 0xc], 0x719b7195
mov dword [rbp - 4], 0x8cc671b7
call fcn.1400026b0
lea r9, [rbp - 0x60]
mov rdx, rax
sub r9, rax
mov r8d, 0x2d
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400028ff
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140002924
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70cb
mov dword [rbp - 0x20], 0x70b870b9
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x70ae70aa
mov dword [rbp - 0x18], 0x70a370a5
mov dword [rbp - 0x14], 0x70af70e5
mov dword [rbp - 0x10], 0x70a770a7
mov dword [rbp - 8], 0x8cc670cb
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000297d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000299c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x71d77186
mov dword [rbp - 0x1c], 0x71c671d1
mov ebx, 0x71a4
mov dword [rbp - 0x18], 0x71c171ce
mov dword [rbp - 0x14], 0x71d071c7
mov dword [rbp - 0x10], 0x719e7186
mov dword [rbp - 0xc], 0x71a47186
mov dword [rbp - 8], 0x8cc671a4
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400029f9
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140002a18
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov ebx, 0x71bd
mov dword [rbp - 0x19], 0x71d8719f
mov ecx, 0x5e
mov dword [rbp + 0x43], ebx
mov dword [rbp - 0x15], 0x71cd71c5
mov dword [rbp - 0x11], 0x71cf71d4
mov dword [rbp - 0xd], 0x719f71d8
mov dword [rbp - 9], 0x719f7187
mov dword [rbp - 5], 0x718d7198
mov dword [rbp - 1], 0x71d97189
mov dword [rbp + 3], 0x71987190
mov dword [rbp + 7], 0x718f718d
mov dword [rbp + 0xb], 0x719071d9
mov dword [rbp + 0xf], 0x718d7198
mov dword [rbp + 0x13], 0x71d9718f
mov dword [rbp + 0x17], 0x7198719d
mov dword [rbp + 0x1b], 0x718f718d
mov dword [rbp + 0x1f], 0x718771d9
mov dword [rbp + 0x23], 0x718d7198
mov dword [rbp + 0x27], 0x71d9718f
mov dword [rbp + 0x2b], 0x71987187
mov dword [rbp + 0x2f], 0x718f718d
mov dword [rbp + 0x33], 0x719d71d9
mov dword [rbp + 0x37], 0x718d7198
mov dword [rbp + 0x3b], 0x71d9718e
mov dword [rbp + 0x3f], 0x7191719f
mov dword [rbp + 0x47], 0x8cc671bd
call fcn.1400026b0
lea r9, [rbp - 0x19]
mov rdx, rax
sub r9, rax
mov r8d, 0x2f
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140002af4
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret

Function at 0x140002cfc
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rbx, qword [rdi + 0x10]
jmp 0x140002d39
mov rcx, qword [rbx + 0x60]
mov rdx, rsi
call fcn.140007d78
test al, al
jne 0x140002d54
mov rbx, qword [rbx + 0x10]
sub rbx, 0x10
cmp rbx, rdi
jne 0x140002d25
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
jmp 0x140002d44
Function at 0x1400037e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x7290
mov dword [rbp - 0x30], 0x72fe72d1
mov ecx, 0x26
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x2c], 0x72f972e4
mov dword [rbp - 0x28], 0x72e072c3
mov dword [rbp - 0x24], 0x72e772e9
mov dword [rbp - 0x20], 0x72e272f1
mov dword [rbp - 0x1c], 0x72c072f5
mov dword [rbp - 0x18], 0x72ff72e2
mov dword [rbp - 0x14], 0x72e572f4
mov dword [rbp - 0x10], 0x72e472f3
mov dword [rbp - 8], 0x8cc67290
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003855
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140003874
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x7286
mov dword [rbp - 0x30], 0x72e772a4
mov ecx, 0x2a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x2c], 0x72e572f4
mov dword [rbp - 0x28], 0x72d972ee
mov dword [rbp - 0x24], 0x72e572f5
mov dword [rbp - 0x20], 0x72f372e9
mov dword [rbp - 0x1c], 0x72a472f2
mov dword [rbp - 0x18], 0x72a472bc
mov dword [rbp - 0x14], 0x72b672a3
mov dword [rbp - 0x10], 0x72e272b4
mov dword [rbp - 0xc], 0x72aa72a4
mov dword [rbp - 4], 0x8cc67286
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400038f0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140003910
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x72d372a6
mov dword [rbp - 0x1c], 0x72f372eb
mov ebx, 0x7284
mov dword [rbp - 0x18], 0x72b072b2
mov dword [rbp - 0x14], 0x72be72a6
mov dword [rbp - 0x10], 0x728472a6
mov dword [rbp - 0xc], 0x8cc67284
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003966
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003988
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x71c371f4
mov dword [rbp - 0x1c], 0x71da71df
mov ebx, 0x71b6
mov dword [rbp - 0x18], 0x71f871d2
mov dword [rbp - 0x14], 0x71db71c3
mov dword [rbp - 0x10], 0x71d371d4
mov dword [rbp - 0xc], 0x71b671c4
mov dword [rbp - 8], 0x8cc671b6
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400039e5
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140003a04
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x71c3
mov dword [rbp - 0x20], 0x71b1718c
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x71a271a4
mov dword [rbp - 0x18], 0x71aa71ad
mov dword [rbp - 0x14], 0x71a271b9
mov dword [rbp - 0x10], 0x71aa71b7
mov dword [rbp - 0xc], 0x71ad71ac
mov dword [rbp - 4], 0x8cc671c3
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003a64
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003a84
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x72fa72d5
mov dword [rbp - 0x2c], 0x72f672e1
mov ebx, 0x7293
mov dword [rbp - 0x28], 0x72f272e4
mov dword [rbp - 0x24], 0x72ff72ff
mov dword [rbp - 0x20], 0x72e172c3
mov dword [rbp - 0x1c], 0x72f772fc
mov dword [rbp - 0x18], 0x72f072e6
mov dword [rbp - 0x14], 0x729372e7
mov dword [rbp - 0x10], 0x8cc67293
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003aef
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140003b10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x71fd
mov dword [rbp - 0x20], 0x719271b1
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x719c719e
mov dword [rbp - 0x18], 0x71bc7191
mov dword [rbp - 0x14], 0x719e719e
mov dword [rbp - 0x10], 0x71887192
mov dword [rbp - 0xc], 0x71897193
mov dword [rbp - 4], 0x8cc671fd
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003b70
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003b90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x729a
mov dword [rbp - 0x30], 0x72f372cd
mov ecx, 0x2a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x2c], 0x72a972f4
mov dword [rbp - 0x28], 0x72c572a8
mov dword [rbp - 0x24], 0x72ee72c9
mov dword [rbp - 0x20], 0x72e872fb
mov dword [rbp - 0x1c], 0x72ef72ee
mov dword [rbp - 0x18], 0x72d972ea
mov dword [rbp - 0x14], 0x72f772f5
mov dword [rbp - 0x10], 0x72fb72f7
mov dword [rbp - 0xc], 0x72fe72f4
mov dword [rbp - 4], 0x8cc6729a
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003c0c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140003c2c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x712a710b
mov dword [rbp - 0x1c], 0x712c713c
mov ebx, 0x714f
mov dword [rbp - 0x18], 0x7126713d
mov dword [rbp - 0x14], 0x713b713f
mov dword [rbp - 0x10], 0x71207126
mov dword [rbp - 0xc], 0x714f7121
mov dword [rbp - 8], 0x8cc6714f
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003c89
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003ca8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x7292
mov dword [rbp - 0x50], 0x72d772c1
mov ecx, 0x3e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x4c], 0x72d772de
mov dword [rbp - 0x48], 0x72c672d1
mov dword [rbp - 0x44], 0x72b872b2
mov dword [rbp - 0x40], 0x72d472b2
mov dword [rbp - 0x3c], 0x72dd72c0
mov dword [rbp - 0x38], 0x72b272df
mov dword [rbp - 0x34], 0x72fc72d3
mov dword [rbp - 0x30], 0x72fb72e6
mov dword [rbp - 0x2c], 0x72fb72c4
mov dword [rbp - 0x28], 0x72e772e0
mov dword [rbp - 0x24], 0x72c272e1
mov dword [rbp - 0x20], 0x72fd72e0
mov dword [rbp - 0x1c], 0x72e772f6
mov dword [rbp - 0x18], 0x72e672f1
mov dword [rbp - 0x10], 0x8cc67292
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x1f
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003d47
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x140003d6c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x3c
mov dword [rbp - 0x40], 0x72d672c0
mov dword [rbp - 0x3c], 0x72d672df
mov ebx, 0x7293
mov dword [rbp - 0x38], 0x72c772d0
mov dword [rbp - 0x34], 0x72b972b3
mov dword [rbp - 0x30], 0x72d572b3
mov dword [rbp - 0x2c], 0x72dc72c1
mov dword [rbp - 0x28], 0x72b372de
mov dword [rbp - 0x24], 0x72fa72d5
mov dword [rbp - 0x20], 0x72f672e1
mov dword [rbp - 0x1c], 0x72f272e4
mov dword [rbp - 0x18], 0x72ff72ff
mov dword [rbp - 0x14], 0x72e172c3
mov dword [rbp - 0x10], 0x72f772fc
mov dword [rbp - 0xc], 0x72f072e6
mov dword [rbp - 8], 0x729372e7
mov dword [rbp - 4], 0x8cc67293
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1e
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003e08
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140003e28
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x71da
mov dword [rbp - 0x30], 0x71a2719f
mov ecx, 0x1e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x2c], 0x71b971bf
mov dword [rbp - 0x28], 0x71ae71af
mov dword [rbp - 0x24], 0x71b871bb
mov dword [rbp - 0x20], 0x71bf71b6
mov dword [rbp - 0x1c], 0x71bb718a
mov dword [rbp - 0x18], 0x71b271ae
mov dword [rbp - 0x10], 0x8cc671da
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0xf
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003e8f
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140003eb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x71c0
mov dword [rbp - 0x30], 0x71a57192
mov ecx, 0x1e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x2c], 0x71a971a7
mov dword [rbp - 0x28], 0x71b471b3
mov dword [rbp - 0x24], 0x71b271a5
mov dword [rbp - 0x20], 0x71a471a5
mov dword [rbp - 0x1c], 0x71b37195
mov dword [rbp - 0x18], 0x71b271a5
mov dword [rbp - 0x10], 0x8cc671c0
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0xf
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003f17
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140003f38
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x71f771c1
mov dword [rbp - 0x1c], 0x71e471e0
mov ebx, 0x7192
mov dword [rbp - 0x18], 0x71f171fb
mov dword [rbp - 0x14], 0x71dc71f7
mov dword [rbp - 0x10], 0x71ff71f3
mov dword [rbp - 0xc], 0x719271f7
mov dword [rbp - 8], 0x8cc67192
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003f95
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003fb4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x710d
mov dword [rbp - 0x30], 0x717f714a
mov ecx, 0x1e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x2c], 0x71787162
mov dword [rbp - 0x28], 0x714e717d
mov dword [rbp - 0x24], 0x71607162
mov dword [rbp - 0x20], 0x7162717d
mov dword [rbp - 0x1c], 0x71687163
mov dword [rbp - 0x18], 0x71797163
mov dword [rbp - 0x10], 0x8cc6710d
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0xf
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000401b
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000403c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x1c
mov dword [rbp - 0x20], 0x71737142
mov dword [rbp - 0x1c], 0x71667160
mov ebx, 0x7112
mov dword [rbp - 0x18], 0x717d7151
mov dword [rbp - 0x14], 0x7162717f
mov dword [rbp - 0x10], 0x717c717d
mov dword [rbp - 0xc], 0x717c7177
mov dword [rbp - 8], 0x71127166
mov dword [rbp - 4], 0x8cc67112
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xe
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400040a0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400040c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x729c
mov dword [rbp - 0x30], 0x72f572cb
mov ecx, 0x2a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x2c], 0x72af72f2
mov dword [rbp - 0x28], 0x72c372ae
mov dword [rbp - 0x24], 0x72f372df
mov dword [rbp - 0x20], 0x72ec72f1
mov dword [rbp - 0x1c], 0x72e872e9
mov dword [rbp - 0x18], 0x72ee72f9
mov dword [rbp - 0x14], 0x72e572cf
mov dword [rbp - 0x10], 0x72e872ef
mov dword [rbp - 0xc], 0x72f172f9
mov dword [rbp - 4], 0x8cc6729c
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000413c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000415c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ecx, 0x48
mov dword [rbp - 0x50], 0x72de72c8
mov dword [rbp - 0x4c], 0x72de72d7
mov ebx, 0x729b
mov dword [rbp - 0x48], 0x72cf72d8
mov dword [rbp - 0x44], 0x72b172bb
mov dword [rbp - 0x40], 0x72dd72bb
mov dword [rbp - 0x3c], 0x72d472c9
mov dword [rbp - 0x38], 0x72bb72d6
mov dword [rbp - 0x34], 0x72f272cc
mov dword [rbp - 0x30], 0x72a872f5
mov dword [rbp - 0x2c], 0x72c472a9
mov dword [rbp - 0x28], 0x72eb72d4
mov dword [rbp - 0x24], 0x72e972fe
mov dword [rbp - 0x20], 0x72ef72fa
mov dword [rbp - 0x1c], 0x72f572f2
mov dword [rbp - 0x18], 0x72c872fc
mov dword [rbp - 0x14], 0x72e872e2
mov dword [rbp - 0x10], 0x72fe72ef
mov dword [rbp - 0xc], 0x729b72f6
mov dword [rbp - 8], 0x8cc6729b
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x24
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000420d
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x140004230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x72f472ca
mov dword [rbp - 0x2c], 0x72ae72f3
mov ebx, 0x729d
mov dword [rbp - 0x28], 0x72c272af
mov dword [rbp - 0x24], 0x72f372cd
mov dword [rbp - 0x20], 0x72d872cd
mov dword [rbp - 0x1c], 0x72e972f3
mov dword [rbp - 0x18], 0x72e972f4
mov dword [rbp - 0x14], 0x729d72e4
mov dword [rbp - 0x10], 0x8cc6729d
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000429b
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400042bc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x71cf71f9
mov dword [rbp - 0x2c], 0x71c871c8
mov ebx, 0x71ba
mov dword [rbp - 0x28], 0x71d471df
mov dword [rbp - 0x24], 0x71ee71ce
mov dword [rbp - 0x20], 0x71d771d3
mov dword [rbp - 0x1c], 0x71e071df
mov dword [rbp - 0x18], 0x71d471d5
mov dword [rbp - 0x14], 0x71ba71df
mov dword [rbp - 0x10], 0x8cc671ba
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004327
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140004348
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x7296
mov dword [rbp - 0x20], 0x72d972c4
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x72c272d9
mov dword [rbp - 0x18], 0x72d572ca
mov dword [rbp - 0x14], 0x72db72df
mov dword [rbp - 0x10], 0x72a472c0
mov dword [rbp - 8], 0x8cc67296
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400043a1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400043c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x714f7177
mov dword [rbp - 0x1c], 0x714b7152
mov ebx, 0x7120
mov dword [rbp - 0x18], 0x71527147
mov dword [rbp - 0x14], 0x7155714f
mov dword [rbp - 0x10], 0x71207150
mov dword [rbp - 0xc], 0x8cc67120
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004416
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret