joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006f38
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x28], 0x5a
xor eax, eax
mov byte [rbp - 0x24], 0x17
xor r8d, r8d
mov byte [rbp - 0x23], 0x2f
mov byte [rbp - 0x22], 0x36
mov byte [rbp - 0x21], 0x2e
mov byte [rbp - 0x20], 0x33
mov byte [rbp - 0x1f], 0x18
mov byte [rbp - 0x1e], 0x23
mov byte [rbp - 0x1d], 0x2e
mov byte [rbp - 0x1c], 0x3f
mov byte [rbp - 0x1b], 0xe
mov byte [rbp - 0x1a], 0x35
mov byte [rbp - 0x19], 0xd
mov byte [rbp - 0x18], 0x33
mov byte [rbp - 0x17], 0x3e
mov byte [rbp - 0x16], 0x3f
mov byte [rbp - 0x15], 0x19
mov byte [rbp - 0x14], 0x32
mov byte [rbp - 0x13], 0x3b
mov byte [rbp - 0x12], 0x28
mov byte [rbp - 0x11], al
mov al, byte [rbp - 0x24]
movsx edx, byte [rbp + r8 - 0x24]
mov eax, dword [rbp - 0x28]
movsx ecx, al
mov eax, edx
xor eax, ecx
mov byte [rbp + r8 - 0x24], al
inc r8
cmp r8, 0x13
jb 0x140006fad
mov byte [rbp - 0x11], 0
mov dword [rbp - 0x40], 0x77
mov eax, dword [rbp - 0x40]
xor eax, 0x4b
mov byte [rbp - 0x3c], al
mov eax, dword [rbp - 0x40]
inc al
xor eax, 0x65
mov byte [rbp - 0x3b], al
mov eax, dword [rbp - 0x40]
add al, 2
xor eax, 0x72
mov byte [rbp - 0x3a], al
mov eax, dword [rbp - 0x40]
add al, 3
xor eax, 0x6e
mov byte [rbp - 0x39], al
mov eax, dword [rbp - 0x40]
add al, 4
xor eax, 0x65
mov byte [rbp - 0x38], al
mov eax, dword [rbp - 0x40]
add al, 5
xor eax, 0x6c
mov byte [rbp - 0x37], al
mov eax, dword [rbp - 0x40]
add al, 6
xor eax, 0x33
mov byte [rbp - 0x36], al
mov eax, dword [rbp - 0x40]
add al, 7
xor eax, 0x32
mov byte [rbp - 0x35], al
mov eax, dword [rbp - 0x40]
add al, 8
xor eax, 0x2e
mov byte [rbp - 0x34], al
mov eax, dword [rbp - 0x40]
add al, 9
xor eax, 0x64
mov byte [rbp - 0x33], al
mov eax, dword [rbp - 0x40]
add al, 0xa
xor eax, 0x6c
mov byte [rbp - 0x32], al
mov eax, dword [rbp - 0x40]
add al, 0xb
xor eax, 0x6c
mov byte [rbp - 0x31], al
xor eax, eax
mov byte [rbp - 0x30], al
xor edx, edx
mov al, byte [rbp - 0x3c]
movsx eax, byte [rbp + rdx - 0x3c]
mov ecx, dword [rbp - 0x40]
add cl, dl
xor ecx, eax
mov byte [rbp + rdx - 0x3c], cl
inc rdx
cmp rdx, 0xc
jb 0x140007062
lea rdx, [rbp - 0x24]
mov byte [rbp - 0x30], 0
lea rcx, [rbp - 0x3c]
call fcn.140006da8
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140007b00
add rsp, 0x60
pop rbp
ret
Function at 0x1400070a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rbp - 8], rax
mov dword [rbp - 0x30], 0x3c
mov eax, dword [rbp - 0x30]
xor eax, 0x52
mov byte [rbp - 0x2c], al
mov eax, dword [rbp - 0x30]
inc al
xor eax, 0x65
mov byte [rbp - 0x2b], al
mov eax, dword [rbp - 0x30]
add al, 2
xor eax, 0x61
mov byte [rbp - 0x2a], al
mov eax, dword [rbp - 0x30]
add al, 3
xor eax, 0x64
mov byte [rbp - 0x29], al
mov eax, dword [rbp - 0x30]
add al, 4
xor eax, 0x46
mov byte [rbp - 0x28], al
mov eax, dword [rbp - 0x30]
add al, 5
xor eax, 0x69
mov byte [rbp - 0x27], al
mov eax, dword [rbp - 0x30]
add al, 6
xor eax, 0x6c
mov byte [rbp - 0x26], al
mov eax, dword [rbp - 0x30]
add al, 7
xor eax, 0x65
mov byte [rbp - 0x25], al
xor eax, eax
mov byte [rbp - 0x24], al
xor edx, edx
mov al, byte [rbp - 0x2c]
movsx eax, byte [rbp + rdx - 0x2c]
mov ecx, dword [rbp - 0x30]
add cl, dl
xor ecx, eax
mov byte [rbp + rdx - 0x2c], cl
inc rdx
cmp rdx, 8
jb 0x14000711e
mov byte [rbp - 0x24], 0
xor eax, eax
mov dword [rbp - 0x20], 0x1d
xor r8d, r8d
mov byte [rbp - 0x1c], 0x56
mov byte [rbp - 0x1b], 0x78
mov byte [rbp - 0x1a], 0x6f
mov byte [rbp - 0x19], 0x73
mov byte [rbp - 0x18], 0x78
mov byte [rbp - 0x17], 0x71
mov byte [rbp - 0x16], 0x2e
mov byte [rbp - 0x15], 0x2f
mov byte [rbp - 0x14], 0x33
mov byte [rbp - 0x13], 0x79
mov byte [rbp - 0x12], 0x71
mov byte [rbp - 0x11], 0x71
mov byte [rbp - 0x10], al
mov al, byte [rbp - 0x1c]
movsx edx, byte [rbp + r8 - 0x1c]
mov eax, dword [rbp - 0x20]
movsx ecx, al
mov eax, edx
xor eax, ecx
mov byte [rbp + r8 - 0x1c], al
inc r8
cmp r8, 0xc
jb 0x14000717d
lea rdx, [rbp - 0x2c]
mov byte [rbp - 0x10], 0
lea rcx, [rbp - 0x1c]
call fcn.140006da8
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140007b00
add rsp, 0x50
pop rbp
ret
Function at 0x1400071c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov byte [rbp - 0x28], 0x55
xor edx, edx
mov byte [rbp - 0x27], 0x76
mov r8d, edx
mov byte [rbp - 0x26], 0x6b
mov byte [rbp - 0x25], 0x74
mov byte [rbp - 0x24], 0x56
mov byte [rbp - 0x23], 0x78
mov byte [rbp - 0x22], 0x75
mov byte [rbp - 0x21], 0x69
mov byte [rbp - 0x20], 0x6b
mov byte [rbp - 0x1f], 0x79
mov byte [rbp - 0x1e], 0x79
mov byte [rbp - 0x1d], 0x5a
mov byte [rbp - 0x1c], 0x75
mov byte [rbp - 0x1b], 0x71
mov byte [rbp - 0x1a], 0x6b
mov byte [rbp - 0x19], 0x74
mov byte [rbp - 0x18], dl
mov al, byte [rbp - 0x28]
movsx ecx, byte [rbp + r8 - 0x28]
sub ecx, 6
mov byte [rbp + r8 - 0x28], cl
inc r8
cmp r8, 0x10
jb 0x140007222
mov byte [rbp - 0x40], 0x4d
mov byte [rbp - 0x3f], 0x70
mov byte [rbp - 0x3e], 0x82
mov byte [rbp - 0x3d], 0x6d
mov byte [rbp - 0x3c], 0x7c
mov byte [rbp - 0x3b], 0x75
mov byte [rbp - 0x3a], 0x3f
mov byte [rbp - 0x39], 0x3e
mov byte [rbp - 0x38], 0x3a
mov byte [rbp - 0x37], 0x70
mov byte [rbp - 0x36], 0x78
mov byte [rbp - 0x35], 0x78
mov byte [rbp - 0x34], dl
mov al, byte [rbp - 0x40]
movsx ecx, byte [rbp + rdx - 0x40]
sub ecx, 0xc
mov byte [rbp + rdx - 0x40], cl
inc rdx
cmp rdx, 0xc
jb 0x14000726f
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x40]
call fcn.140006da8
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140007b00
add rsp, 0x60
pop rbp
ret
Function at 0x1400072a4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rbp - 8], rax
mov byte [rbp - 0x28], 0x51
xor edx, edx
mov byte [rbp - 0x27], 0x74
mov byte [rbp - 0x26], 0x74
mov byte [rbp - 0x25], 0x70
mov byte [rbp - 0x24], 0x7a
mov byte [rbp - 0x23], 0x75
mov byte [rbp - 0x22], 0x55
mov byte [rbp - 0x21], 0x77
mov byte [rbp - 0x20], 0x6e
mov byte [rbp - 0x1f], 0x7b
mov byte [rbp - 0x1e], 0x6e
mov byte [rbp - 0x1d], 0x71
mov byte [rbp - 0x1c], 0x6a
mov byte [rbp - 0x1b], 0x6c
mov byte [rbp - 0x1a], 0x6a
mov byte [rbp - 0x19], 0x5b
mov byte [rbp - 0x18], 0x66
mov byte [rbp - 0x17], 0x71
mov byte [rbp - 0x16], 0x7a
mov byte [rbp - 0x15], 0x6a
mov byte [rbp - 0x14], 0x46
mov byte [rbp - 0x13], 0
mov al, byte [rbp - 0x28]
movsx ecx, byte [rbp + rdx - 0x28]
sub ecx, 5
mov byte [rbp + rdx - 0x28], cl
inc rdx
cmp rdx, 0x15
jb 0x140007318
mov dword [rbp - 0x40], 0x67
xor eax, eax
mov byte [rbp - 0x3c], 0x26
xor r8d, r8d
mov byte [rbp - 0x3b], 3
mov byte [rbp - 0x3a], 0x11
mov byte [rbp - 0x39], 6
mov byte [rbp - 0x38], 0x17
mov byte [rbp - 0x37], 0xe
mov byte [rbp - 0x36], 0x54
mov byte [rbp - 0x35], 0x55
mov byte [rbp - 0x34], 0x49
mov byte [rbp - 0x33], 3
mov byte [rbp - 0x32], 0xb
mov byte [rbp - 0x31], 0xb
mov byte [rbp - 0x30], al
mov al, byte [rbp - 0x3c]
movsx edx, byte [rbp + r8 - 0x3c]
mov eax, dword [rbp - 0x40]
movsx ecx, al
mov eax, edx
xor eax, ecx
mov byte [rbp + r8 - 0x3c], al
inc r8
cmp r8, 0xc
jb 0x14000736f
lea rdx, [rbp - 0x28]
mov byte [rbp - 0x30], 0
lea rcx, [rbp - 0x3c]
call fcn.140006da8
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140007b00
add rsp, 0x60
pop rbp
ret
Function at 0x1400073b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rbp - 8], rax
mov dword [rbp - 0x40], 0x6a
xor r8d, r8d
mov byte [rbp - 0x3c], 0x2b
xor eax, eax
mov byte [rbp - 0x3b], 0xe
mov r9d, r8d
mov byte [rbp - 0x3a], r8b
mov byte [rbp - 0x39], 0x1f
mov byte [rbp - 0x38], 0x19
mov byte [rbp - 0x37], 0x1e
mov byte [rbp - 0x36], 0x3e
mov byte [rbp - 0x35], 5
mov byte [rbp - 0x34], 1
mov byte [rbp - 0x33], 0xf
mov byte [rbp - 0x32], 4
mov byte [rbp - 0x31], 0x3a
mov byte [rbp - 0x30], 0x18
mov byte [rbp - 0x2f], 3
mov byte [rbp - 0x2e], 0x1c
mov byte [rbp - 0x2d], 3
mov byte [rbp - 0x2c], 6
mov byte [rbp - 0x2b], 0xf
mov byte [rbp - 0x2a], 0xd
mov byte [rbp - 0x29], 0xf
mov byte [rbp - 0x28], 0x19
mov byte [rbp - 0x27], al
mov al, byte [rbp - 0x3c]
movsx edx, byte [rbp + r9 - 0x3c]
mov eax, dword [rbp - 0x40]
movsx ecx, al
mov eax, edx
xor eax, ecx
mov byte [rbp + r9 - 0x3c], al
inc r9
cmp r9, 0x15
jb 0x140007430
mov byte [rbp - 0x27], r8b
mov byte [rbp - 0x20], 0x49
mov byte [rbp - 0x1f], 0x6c
mov byte [rbp - 0x1e], 0x7e
mov byte [rbp - 0x1d], 0x69
mov byte [rbp - 0x1c], 0x78
mov byte [rbp - 0x1b], 0x71
mov byte [rbp - 0x1a], 0x3b
mov byte [rbp - 0x19], 0x3a
mov byte [rbp - 0x18], 0x36
mov byte [rbp - 0x17], 0x6c
mov byte [rbp - 0x16], 0x74
mov byte [rbp - 0x15], 0x74
mov byte [rbp - 0x14], r8b
mov al, byte [rbp - 0x20]
movsx ecx, byte [rbp + r8 - 0x20]
sub ecx, 8
mov byte [rbp + r8 - 0x20], cl
inc r8
cmp r8, 0xc
jb 0x140007489
lea rdx, [rbp - 0x3c]
lea rcx, [rbp - 0x20]
call fcn.140006da8
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140007b00
add rsp, 0x60
pop rbp
ret
Function at 0x1400074c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x40], 4
xor eax, eax
mov byte [rbp - 0x3c], 0x47
xor r8d, r8d
mov byte [rbp - 0x3b], 0x76
mov r9d, r8d
mov byte [rbp - 0x3a], 0x61
mov byte [rbp - 0x39], 0x65
mov byte [rbp - 0x38], 0x70
mov byte [rbp - 0x37], 0x61
mov byte [rbp - 0x36], 0x54
mov byte [rbp - 0x35], 0x76
mov byte [rbp - 0x34], 0x6b
mov byte [rbp - 0x33], 0x67
mov byte [rbp - 0x32], 0x61
mov byte [rbp - 0x31], 0x77
mov byte [rbp - 0x30], 0x77
mov byte [rbp - 0x2f], 0x45
mov byte [rbp - 0x2e], al
mov al, byte [rbp - 0x3c]
movsx edx, byte [rbp + r9 - 0x3c]
mov eax, dword [rbp - 0x40]
movsx ecx, al
mov eax, edx
xor eax, ecx
mov byte [rbp + r9 - 0x3c], al
inc r9
cmp r9, 0xe
jb 0x140007524
mov byte [rbp - 0x2e], r8b
mov byte [rbp - 0x28], 0x57
mov byte [rbp - 0x27], 0x71
mov byte [rbp - 0x26], 0x7e
mov byte [rbp - 0x25], 0x7a
mov byte [rbp - 0x24], 0x71
mov byte [rbp - 0x23], 0x78
mov byte [rbp - 0x22], 0x3f
mov byte [rbp - 0x21], 0x3e
mov byte [rbp - 0x20], 0x3a
mov byte [rbp - 0x1f], 0x70
mov byte [rbp - 0x1e], 0x78
mov byte [rbp - 0x1d], 0x78
mov byte [rbp - 0x1c], r8b
mov al, byte [rbp - 0x28]
movsx ecx, byte [rbp + r8 - 0x28]
sub ecx, 0xc
mov byte [rbp + r8 - 0x28], cl
inc r8
cmp r8, 0xc
jb 0x14000757d
lea rdx, [rbp - 0x3c]
lea rcx, [rbp - 0x28]
call fcn.140006da8
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140007b00
add rsp, 0x60
pop rbp
ret
Function at 0x1400075b4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x40], 0x44
xor eax, eax
mov byte [rbp - 0x3c], 3
xor r8d, r8d
mov byte [rbp - 0x3b], 0x21
mov r9d, r8d
mov byte [rbp - 0x3a], 0x30
mov byte [rbp - 0x39], 9
mov byte [rbp - 0x38], 0x2b
mov byte [rbp - 0x37], 0x20
mov byte [rbp - 0x36], 0x31
mov byte [rbp - 0x35], 0x28
mov byte [rbp - 0x34], 0x21
mov byte [rbp - 0x33], 2
mov byte [rbp - 0x32], 0x2d
mov byte [rbp - 0x31], 0x28
mov byte [rbp - 0x30], 0x21
mov byte [rbp - 0x2f], 0xa
mov byte [rbp - 0x2e], 0x25
mov byte [rbp - 0x2d], 0x29
mov byte [rbp - 0x2c], 0x21
mov byte [rbp - 0x2b], 5
mov byte [rbp - 0x2a], al
mov al, byte [rbp - 0x3c]
movsx edx, byte [rbp + r9 - 0x3c]
mov eax, dword [rbp - 0x40]
movsx ecx, al
mov eax, edx
xor eax, ecx
mov byte [rbp + r9 - 0x3c], al
inc r9
cmp r9, 0x12
jb 0x140007628
mov byte [rbp - 0x2a], r8b
mov byte [rbp - 0x28], 0x4e
mov byte [rbp - 0x27], 0x68
mov byte [rbp - 0x26], 0x75
mov byte [rbp - 0x25], 0x71
mov byte [rbp - 0x24], 0x68
mov byte [rbp - 0x23], 0x6f
mov byte [rbp - 0x22], 0x36
mov byte [rbp - 0x21], 0x35
mov byte [rbp - 0x20], 0x31
mov byte [rbp - 0x1f], 0x67
mov byte [rbp - 0x1e], 0x6f
mov byte [rbp - 0x1d], 0x6f
mov byte [rbp - 0x1c], r8b
mov al, byte [rbp - 0x28]
movsx ecx, byte [rbp + r8 - 0x28]
sub ecx, 3
mov byte [rbp + r8 - 0x28], cl
inc r8
cmp r8, 0xc
jb 0x140007681
lea rdx, [rbp - 0x3c]
lea rcx, [rbp - 0x28]
call fcn.140006da8
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140007b00
add rsp, 0x60
pop rbp
ret
Function at 0x1400076b8
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rbp - 8], rax
mov dword [rbp - 0x30], 0x5a
mov eax, dword [rbp - 0x30]
xor eax, 0x47
mov byte [rbp - 0x2c], al
mov eax, dword [rbp - 0x30]
inc al
xor eax, 0x65
mov byte [rbp - 0x2b], al
mov eax, dword [rbp - 0x30]
add al, 2
xor eax, 0x74
mov byte [rbp - 0x2a], al
mov eax, dword [rbp - 0x30]
add al, 3
xor eax, 0x46
mov byte [rbp - 0x29], al
mov eax, dword [rbp - 0x30]
add al, 4
xor eax, 0x69
mov byte [rbp - 0x28], al
mov eax, dword [rbp - 0x30]
add al, 5
xor eax, 0x6c
mov byte [rbp - 0x27], al
mov eax, dword [rbp - 0x30]
add al, 6
xor eax, 0x65
mov byte [rbp - 0x26], al
mov eax, dword [rbp - 0x30]
add al, 7
xor eax, 0x53
mov byte [rbp - 0x25], al
mov eax, dword [rbp - 0x30]
add al, 8
xor eax, 0x69
mov byte [rbp - 0x24], al
mov eax, dword [rbp - 0x30]
add al, 9
xor eax, 0x7a
mov byte [rbp - 0x23], al
mov eax, dword [rbp - 0x30]
add al, 0xa
xor eax, 0x65
mov byte [rbp - 0x22], al
xor eax, eax
mov byte [rbp - 0x21], al
xor edx, edx
mov al, byte [rbp - 0x2c]
movsx eax, byte [rbp + rdx - 0x2c]
mov ecx, dword [rbp - 0x30]
add cl, dl
xor ecx, eax
mov byte [rbp + rdx - 0x2c], cl
inc rdx
cmp rdx, 0xb
jb 0x140007757
mov byte [rbp - 0x21], 0
mov dword [rbp - 0x20], 0x24
mov eax, dword [rbp - 0x20]
xor eax, 0x4b
mov byte [rbp - 0x1c], al
mov eax, dword [rbp - 0x20]
inc al
xor eax, 0x65
mov byte [rbp - 0x1b], al
mov eax, dword [rbp - 0x20]
add al, 2
xor eax, 0x72
mov byte [rbp - 0x1a], al
mov eax, dword [rbp - 0x20]
add al, 3
xor eax, 0x6e
mov byte [rbp - 0x19], al
mov eax, dword [rbp - 0x20]
add al, 4
xor eax, 0x65
mov byte [rbp - 0x18], al
mov eax, dword [rbp - 0x20]
add al, 5
xor eax, 0x6c
mov byte [rbp - 0x17], al
mov eax, dword [rbp - 0x20]
add al, 6
xor eax, 0x33
mov byte [rbp - 0x16], al
mov eax, dword [rbp - 0x20]
add al, 7
xor eax, 0x32
mov byte [rbp - 0x15], al
mov eax, dword [rbp - 0x20]
add al, 8
xor eax, 0x2e
mov byte [rbp - 0x14], al
mov eax, dword [rbp - 0x20]
add al, 9
xor eax, 0x64
mov byte [rbp - 0x13], al
mov eax, dword [rbp - 0x20]
add al, 0xa
xor eax, 0x6c
mov byte [rbp - 0x12], al
mov eax, dword [rbp - 0x20]
add al, 0xb
xor eax, 0x6c
mov byte [rbp - 0x11], al
xor eax, eax
mov byte [rbp - 0x10], al
xor edx, edx
mov al, byte [rbp - 0x1c]
movsx eax, byte [rbp + rdx - 0x1c]
mov ecx, dword [rbp - 0x20]
add cl, dl
xor ecx, eax
mov byte [rbp + rdx - 0x1c], cl
inc rdx
cmp rdx, 0xc
jb 0x140007807
lea rdx, [rbp - 0x2c]
mov byte [rbp - 0x10], 0
lea rcx, [rbp - 0x1c]
call fcn.140006da8
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140007b00
add rsp, 0x50
pop rbp
ret
Function at 0x140007844
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov byte [rbp - 0x40], 0x58
xor edx, edx
mov byte [rbp - 0x3f], 0x6a
mov byte [rbp - 0x3e], 0x79
mov byte [rbp - 0x3d], 0x4b
mov byte [rbp - 0x3c], 0x6e
mov byte [rbp - 0x3b], 0x71
mov byte [rbp - 0x3a], 0x6a
mov byte [rbp - 0x39], 0x55
mov byte [rbp - 0x38], 0x74
mov byte [rbp - 0x37], 0x6e
mov byte [rbp - 0x36], 0x73
mov byte [rbp - 0x35], 0x79
mov byte [rbp - 0x34], 0x6a
mov byte [rbp - 0x33], 0x77
mov byte [rbp - 0x32], 0
mov al, byte [rbp - 0x40]
movsx ecx, byte [rbp + rdx - 0x40]
sub ecx, 5
mov byte [rbp + rdx - 0x40], cl
inc rdx
cmp rdx, 0xe
jb 0x14000789c
mov dword [rbp - 0x28], 0x34
xor eax, eax
mov byte [rbp - 0x24], 0x7f
xor r8d, r8d
mov byte [rbp - 0x23], 0x51
mov byte [rbp - 0x22], 0x46
mov byte [rbp - 0x21], 0x5a
mov byte [rbp - 0x20], 0x51
mov byte [rbp - 0x1f], 0x58
mov byte [rbp - 0x1e], 7
mov byte [rbp - 0x1d], 6
mov byte [rbp - 0x1c], 0x1a
mov byte [rbp - 0x1b], 0x50
mov byte [rbp - 0x1a], 0x58
mov byte [rbp - 0x19], 0x58
mov byte [rbp - 0x18], al
mov al, byte [rbp - 0x24]
movsx edx, byte [rbp + r8 - 0x24]
mov eax, dword [rbp - 0x28]
movsx ecx, al
mov eax, edx
xor eax, ecx
mov byte [rbp + r8 - 0x24], al
inc r8
cmp r8, 0xc
jb 0x1400078f3
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x18], 0
lea rcx, [rbp - 0x24]
call fcn.140006da8
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140007b00
add rsp, 0x60
pop rbp
ret

Function at 0x140007934
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rbp - 8], rax
mov byte [rbp - 0x20], 0x4f
xor r9d, r9d
mov byte [rbp - 0x1f], 0x7e
mov edx, r9d
mov byte [rbp - 0x1e], 0x71
mov byte [rbp - 0x1d], 0x6d
mov byte [rbp - 0x1c], 0x80
mov byte [rbp - 0x1b], 0x71
mov byte [rbp - 0x1a], 0x50
mov byte [rbp - 0x19], 0x71
mov byte [rbp - 0x18], 0x7f
mov byte [rbp - 0x17], 0x77
mov byte [rbp - 0x16], 0x80
mov byte [rbp - 0x15], 0x7b
mov byte [rbp - 0x14], 0x7c
mov byte [rbp - 0x13], 0x4d
mov byte [rbp - 0x12], r9b
mov al, byte [rbp - 0x20]
movsx ecx, byte [rbp + rdx - 0x20]
sub ecx, 0xc
mov byte [rbp + rdx - 0x20], cl
inc rdx
cmp rdx, 0xe
jb 0x140007990
mov dword [rbp - 0x30], 0x55
xor eax, eax
mov byte [rbp - 0x2c], r9b
mov r8, r9
mov byte [rbp - 0x2b], 0x26
mov byte [rbp - 0x2a], 0x30
mov byte [rbp - 0x29], 0x27
mov byte [rbp - 0x28], 0x66
mov byte [rbp - 0x27], 0x67
mov byte [rbp - 0x26], 0x7b
mov byte [rbp - 0x25], 0x31
mov byte [rbp - 0x24], 0x39
mov byte [rbp - 0x23], 0x39
mov byte [rbp - 0x22], al
mov al, byte [rbp - 0x2c]
movsx edx, byte [rbp + r8 - 0x2c]
mov eax, dword [rbp - 0x30]
movsx ecx, al
mov eax, edx
xor eax, ecx
mov byte [rbp + r8 - 0x2c], al
inc r8
cmp r8, 0xa
jb 0x1400079df
lea rdx, [rbp - 0x20]
mov byte [rbp - 0x22], r9b
lea rcx, [rbp - 0x2c]
call fcn.140006da8
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140007b00
add rsp, 0x50
pop rbp
ret
Function at 0x140007a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rbp - 8], rax
mov byte [rbp - 0x20], 0x46
xor edx, edx
mov byte [rbp - 0x1f], 0x6f
mov r8d, edx
mov byte [rbp - 0x1e], 0x72
mov byte [rbp - 0x1d], 0x76
mov byte [rbp - 0x1c], 0x68
mov byte [rbp - 0x1b], 0x47
mov byte [rbp - 0x1a], 0x68
mov byte [rbp - 0x19], 0x76
mov byte [rbp - 0x18], 0x6e
mov byte [rbp - 0x17], 0x77
mov byte [rbp - 0x16], 0x72
mov byte [rbp - 0x15], 0x73
mov byte [rbp - 0x14], dl
mov al, byte [rbp - 0x20]
movsx ecx, byte [rbp + r8 - 0x20]
sub ecx, 3
mov byte [rbp + r8 - 0x20], cl
inc r8
cmp r8, 0xc
jb 0x140007a72
mov byte [rbp - 0x30], 0x55
mov byte [rbp - 0x2f], 0x73
mov byte [rbp - 0x2e], 0x65
mov byte [rbp - 0x2d], 0x72
mov byte [rbp - 0x2c], 0x33
mov byte [rbp - 0x2b], 0x32
mov byte [rbp - 0x2a], 0x2e
mov byte [rbp - 0x29], 0x64
mov byte [rbp - 0x28], 0x6c
mov byte [rbp - 0x27], 0x6c
mov byte [rbp - 0x26], dl
mov al, byte [rbp - 0x30]
mov al, byte [rbp + rdx - 0x30]
mov byte [rbp + rdx - 0x30], al
inc rdx
cmp rdx, 0xa
jb 0x140007ab7
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call fcn.140006da8
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140007b00
add rsp, 0x50
pop rbp
ret

Function at 0x14000ded0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14000dca4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000dca4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000dca4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000dca4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000dca4
cmp dword [rcx + 0x84], 0xe
jbe 0x14000dca4
cmp dword [rcx + 0xf8], esi
je 0x14000dca4
mov ecx, r14d
call fcn.14000ddec
mov ecx, 2
call fcn.140011ac8
nop
cmp byte [0x1400273b0], 0
jne 0x14000dd6e
mov r15d, 1
mov eax, r15d
xchg dword [0x1400273a0], eax
test ebx, ebx
jne 0x14000dd17
mov rdi, qword [0x140026008]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400273a8]
cmp rcx, rax
je 0x14000dd0e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140008d68]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1400274e8]
jmp 0x14000dd23
cmp ebx, r15d
jne 0x14000dd29
lea rcx, [0x140027500]
call fcn.14000e860
nop
test ebx, ebx
jne 0x14000dd40
lea rdx, [0x14001a410]
lea rcx, [0x14001a3f0]
call fcn.14000eb9c
lea rdx, [0x14001a420]
lea rcx, [0x14001a418]
call fcn.14000eb9c
movzx eax, byte [0x1400273b0]
test esi, esi
cmove eax, r15d
mov byte [0x1400273b0], al
jmp 0x14000dd6e
mov ecx, 2
call fcn.140011b1c
test esi, esi
jne 0x14000dd85
mov ecx, r14d
call fcn.14000dda0
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000dc34
Function at 0x1400020d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1470
call fcn.140006100
sub rsp, rax
mov rax, qword [0x14000b008]
xor rax, rsp
mov qword [rsp + 0x1460], rax
mov rdi, rcx
cmp dword [0x14000b9a0], 0
je 0x1400022eb
cmp qword [0x14000b9a8], 0
jne 0x1400022eb
call fcn.140002330
test al, al
je 0x1400022eb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140001fb0
nop
mov rbx, qword [rsp + 0xb0]
mov r8, qword [rsp + 0xb8]
cmp rbx, r8
je 0x140002310
mov rdx, qword [rbx]
cmp rdi, rdx
jbe 0x14000217e
mov rcx, qword [rbx + 0x18]
add rcx, rdx
cmp rdi, rcx
jb 0x140002184
add rbx, 0x30
jmp 0x140002161
mov qword [0x14000b9a8], rdx
mov rax, qword [rbx + 0x18]
mov qword [0x14000b9b0], rax
mov byte [0x14000b9b8], 0
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x1454], 0xffffffff
mov dword [rsp + 0xd4], eax
mov edx, 1
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0xd4], eax
inc rdx
cmp rdx, 0x270
jb 0x1400021c0
mov dword [rsp + 0xd0], 0x270
lea rcx, [rsp + 0xd0]
call fcn.140004ef0
mov dword [0x14000b9bc], eax
lea rcx, str.___Fluctuation_initialized.
call fcn.140003b60
mov esi, dword [0x14000b9bc]
mov edx, 8
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov rdi, qword [rbx + 0x18]
mov rbx, qword [rbx]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x70], xmm0
mov edx, 8
lea rcx, [rsp + 0xa0]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x60], esi
mov byte [rsp + 0x58], 0x30
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x20], rbx
mov r9b, 0x30
lea r8, [rsp + 0x80]
call fcn.140003d40
nop
mov r8, qword [rsp + 0xb0]
test r8, r8
je 0x1400022eb
mov rcx, qword [rsp + 0xc0]
sub rcx, r8
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 4
mov rax, r8
cmp rdx, 0x1000
jb 0x1400022e3
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400022e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.1400052fc
mov rcx, qword [rsp + 0x1460]
xor rcx, rsp
call fcn.1400052a0
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rcx, str.____Could_not_initialize_shellcode_fluctuation_
call fcn.140003b60
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]