joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400026b8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x73b0
mov dword [rbp - 0x20], 0x73d97392
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x73c373c3
mov dword [rbp - 0x18], 0x73d573c5
mov dword [rbp - 0x14], 0x739273c2
mov dword [rbp - 0x10], 0x7392738a
mov dword [rbp - 8], 0x8ec173b0
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140002711
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140002730
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x1c
mov dword [rbp - 0x20], 0x73be73f3
mov dword [rbp - 0x1c], 0x73bb73b3
mov ebx, 0x73d1
mov dword [rbp - 0x18], 0x73b8738e
mov dword [rbp - 0x14], 0x73f373b5
mov dword [rbp - 0x10], 0x73f373eb
mov dword [rbp - 0xc], 0x73a273f4
mov dword [rbp - 8], 0x73d173f3
mov dword [rbp - 4], 0x8ec173d1
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xe
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140002794
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400027b4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x73467307
mov dword [rbp - 0x1c], 0x73577340
mov ebx, 0x7325
mov dword [rbp - 0x18], 0x73567351
mov dword [rbp - 0x14], 0x731f7307
mov dword [rbp - 0x10], 0x7325735e
mov dword [rbp - 0xc], 0x8ec17325
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000280a
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000282c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov ebx, 0x73b5
mov dword [rbp - 0x60], 0x73d37397
mov ecx, 0x5a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x5c], 0x73da73c7
mov dword [rbp - 0x58], 0x739773d8
mov dword [rbp - 0x54], 0x7397738f
mov dword [rbp - 0x50], 0x73857390
mov dword [rbp - 0x4c], 0x73d17381
mov dword [rbp - 0x48], 0x73907398
mov dword [rbp - 0x44], 0x73877385
mov dword [rbp - 0x40], 0x739873d1
mov dword [rbp - 0x3c], 0x73857390
mov dword [rbp - 0x38], 0x73d17387
mov dword [rbp - 0x34], 0x73907395
mov dword [rbp - 0x30], 0x73877385
mov dword [rbp - 0x2c], 0x738f73d1
mov dword [rbp - 0x28], 0x73857390
mov dword [rbp - 0x24], 0x73d17387
mov dword [rbp - 0x20], 0x7390738f
mov dword [rbp - 0x1c], 0x73877385
mov dword [rbp - 0x18], 0x739573d1
mov dword [rbp - 0x14], 0x73857390
mov dword [rbp - 0x10], 0x73d17386
mov dword [rbp - 0xc], 0x73997397
mov dword [rbp - 4], 0x8ec173b5
call fcn.1400026b0
lea r9, [rbp - 0x60]
mov rdx, rax
sub r9, rax
mov r8d, 0x2d
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400028ff
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140002924
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72c9
mov dword [rbp - 0x20], 0x72ba72bb
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x72ac72a8
mov dword [rbp - 0x18], 0x72a172a7
mov dword [rbp - 0x14], 0x72ad72e7
mov dword [rbp - 0x10], 0x72a572a5
mov dword [rbp - 8], 0x8ec172c9
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000297d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000299c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x73d57384
mov dword [rbp - 0x1c], 0x73c473d3
mov ebx, 0x73a6
mov dword [rbp - 0x18], 0x73c373cc
mov dword [rbp - 0x14], 0x73d273c5
mov dword [rbp - 0x10], 0x739c7384
mov dword [rbp - 0xc], 0x73a67384
mov dword [rbp - 8], 0x8ec173a6
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400029f9
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140002a18
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov ebx, 0x73bf
mov dword [rbp - 0x19], 0x73da739d
mov ecx, 0x5e
mov dword [rbp + 0x43], ebx
mov dword [rbp - 0x15], 0x73cf73c7
mov dword [rbp - 0x11], 0x73cd73d6
mov dword [rbp - 0xd], 0x739d73da
mov dword [rbp - 9], 0x739d7385
mov dword [rbp - 5], 0x738f739a
mov dword [rbp - 1], 0x73db738b
mov dword [rbp + 3], 0x739a7392
mov dword [rbp + 7], 0x738d738f
mov dword [rbp + 0xb], 0x739273db
mov dword [rbp + 0xf], 0x738f739a
mov dword [rbp + 0x13], 0x73db738d
mov dword [rbp + 0x17], 0x739a739f
mov dword [rbp + 0x1b], 0x738d738f
mov dword [rbp + 0x1f], 0x738573db
mov dword [rbp + 0x23], 0x738f739a
mov dword [rbp + 0x27], 0x73db738d
mov dword [rbp + 0x2b], 0x739a7385
mov dword [rbp + 0x2f], 0x738d738f
mov dword [rbp + 0x33], 0x739f73db
mov dword [rbp + 0x37], 0x738f739a
mov dword [rbp + 0x3b], 0x73db738c
mov dword [rbp + 0x3f], 0x7393739d
mov dword [rbp + 0x47], 0x8ec173bf
call fcn.1400026b0
lea r9, [rbp - 0x19]
mov rdx, rax
sub r9, rax
mov r8d, 0x2f
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140002af4
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret

Function at 0x140002cfc
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rbx, qword [rdi + 0x10]
jmp 0x140002d39
mov rcx, qword [rbx + 0x60]
mov rdx, rsi
call fcn.140007d78
test al, al
jne 0x140002d54
mov rbx, qword [rbx + 0x10]
sub rbx, 0x10
cmp rbx, rdi
jne 0x140002d25
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
jmp 0x140002d44
Function at 0x1400037e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x7092
mov dword [rbp - 0x30], 0x70fc70d3
mov ecx, 0x26
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x2c], 0x70fb70e6
mov dword [rbp - 0x28], 0x70e270c1
mov dword [rbp - 0x24], 0x70e570eb
mov dword [rbp - 0x20], 0x70e070f3
mov dword [rbp - 0x1c], 0x70c270f7
mov dword [rbp - 0x18], 0x70fd70e0
mov dword [rbp - 0x14], 0x70e770f6
mov dword [rbp - 0x10], 0x70e670f1
mov dword [rbp - 8], 0x8ec17092
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003855
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140003874
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x7084
mov dword [rbp - 0x30], 0x70e570a6
mov ecx, 0x2a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x2c], 0x70e770f6
mov dword [rbp - 0x28], 0x70db70ec
mov dword [rbp - 0x24], 0x70e770f7
mov dword [rbp - 0x20], 0x70f170eb
mov dword [rbp - 0x1c], 0x70a670f0
mov dword [rbp - 0x18], 0x70a670be
mov dword [rbp - 0x14], 0x70b470a1
mov dword [rbp - 0x10], 0x70e070b6
mov dword [rbp - 0xc], 0x70a870a6
mov dword [rbp - 4], 0x8ec17084
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400038f0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140003910
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x70d170a4
mov dword [rbp - 0x1c], 0x70f170e9
mov ebx, 0x7086
mov dword [rbp - 0x18], 0x70b270b0
mov dword [rbp - 0x14], 0x70bc70a4
mov dword [rbp - 0x10], 0x708670a4
mov dword [rbp - 0xc], 0x8ec17086
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003966
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003988
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x73c173f6
mov dword [rbp - 0x1c], 0x73d873dd
mov ebx, 0x73b4
mov dword [rbp - 0x18], 0x73fa73d0
mov dword [rbp - 0x14], 0x73d973c1
mov dword [rbp - 0x10], 0x73d173d6
mov dword [rbp - 0xc], 0x73b473c6
mov dword [rbp - 8], 0x8ec173b4
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400039e5
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140003a04
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x73c1
mov dword [rbp - 0x20], 0x73b3738e
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x73a073a6
mov dword [rbp - 0x18], 0x73a873af
mov dword [rbp - 0x14], 0x73a073bb
mov dword [rbp - 0x10], 0x73a873b5
mov dword [rbp - 0xc], 0x73af73ae
mov dword [rbp - 4], 0x8ec173c1
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003a64
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003a84
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x70f870d7
mov dword [rbp - 0x2c], 0x70f470e3
mov ebx, 0x7091
mov dword [rbp - 0x28], 0x70f070e6
mov dword [rbp - 0x24], 0x70fd70fd
mov dword [rbp - 0x20], 0x70e370c1
mov dword [rbp - 0x1c], 0x70f570fe
mov dword [rbp - 0x18], 0x70f270e4
mov dword [rbp - 0x14], 0x709170e5
mov dword [rbp - 0x10], 0x8ec17091
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003aef
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140003b10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x73ff
mov dword [rbp - 0x20], 0x739073b3
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x739e739c
mov dword [rbp - 0x18], 0x73be7393
mov dword [rbp - 0x14], 0x739c739c
mov dword [rbp - 0x10], 0x738a7390
mov dword [rbp - 0xc], 0x738b7391
mov dword [rbp - 4], 0x8ec173ff
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003b70
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003b90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x7098
mov dword [rbp - 0x30], 0x70f170cf
mov ecx, 0x2a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x2c], 0x70ab70f6
mov dword [rbp - 0x28], 0x70c770aa
mov dword [rbp - 0x24], 0x70ec70cb
mov dword [rbp - 0x20], 0x70ea70f9
mov dword [rbp - 0x1c], 0x70ed70ec
mov dword [rbp - 0x18], 0x70db70e8
mov dword [rbp - 0x14], 0x70f570f7
mov dword [rbp - 0x10], 0x70f970f5
mov dword [rbp - 0xc], 0x70fc70f6
mov dword [rbp - 4], 0x8ec17098
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003c0c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140003c2c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x73287309
mov dword [rbp - 0x1c], 0x732e733e
mov ebx, 0x734d
mov dword [rbp - 0x18], 0x7324733f
mov dword [rbp - 0x14], 0x7339733d
mov dword [rbp - 0x10], 0x73227324
mov dword [rbp - 0xc], 0x734d7323
mov dword [rbp - 8], 0x8ec1734d
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003c89
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003ca8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x7090
mov dword [rbp - 0x50], 0x70d570c3
mov ecx, 0x3e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x4c], 0x70d570dc
mov dword [rbp - 0x48], 0x70c470d3
mov dword [rbp - 0x44], 0x70ba70b0
mov dword [rbp - 0x40], 0x70d670b0
mov dword [rbp - 0x3c], 0x70df70c2
mov dword [rbp - 0x38], 0x70b070dd
mov dword [rbp - 0x34], 0x70fe70d1
mov dword [rbp - 0x30], 0x70f970e4
mov dword [rbp - 0x2c], 0x70f970c6
mov dword [rbp - 0x28], 0x70e570e2
mov dword [rbp - 0x24], 0x70c070e3
mov dword [rbp - 0x20], 0x70ff70e2
mov dword [rbp - 0x1c], 0x70e570f4
mov dword [rbp - 0x18], 0x70e470f3
mov dword [rbp - 0x10], 0x8ec17090
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x1f
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003d47
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x140003d6c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x3c
mov dword [rbp - 0x40], 0x70d470c2
mov dword [rbp - 0x3c], 0x70d470dd
mov ebx, 0x7091
mov dword [rbp - 0x38], 0x70c570d2
mov dword [rbp - 0x34], 0x70bb70b1
mov dword [rbp - 0x30], 0x70d770b1
mov dword [rbp - 0x2c], 0x70de70c3
mov dword [rbp - 0x28], 0x70b170dc
mov dword [rbp - 0x24], 0x70f870d7
mov dword [rbp - 0x20], 0x70f470e3
mov dword [rbp - 0x1c], 0x70f070e6
mov dword [rbp - 0x18], 0x70fd70fd
mov dword [rbp - 0x14], 0x70e370c1
mov dword [rbp - 0x10], 0x70f570fe
mov dword [rbp - 0xc], 0x70f270e4
mov dword [rbp - 8], 0x709170e5
mov dword [rbp - 4], 0x8ec17091
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1e
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003e08
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140003e28
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x73d8
mov dword [rbp - 0x30], 0x73a0739d
mov ecx, 0x1e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x2c], 0x73bb73bd
mov dword [rbp - 0x28], 0x73ac73ad
mov dword [rbp - 0x24], 0x73ba73b9
mov dword [rbp - 0x20], 0x73bd73b4
mov dword [rbp - 0x1c], 0x73b97388
mov dword [rbp - 0x18], 0x73b073ac
mov dword [rbp - 0x10], 0x8ec173d8
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0xf
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003e8f
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140003eb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x73c2
mov dword [rbp - 0x30], 0x73a77390
mov ecx, 0x1e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x2c], 0x73ab73a5
mov dword [rbp - 0x28], 0x73b673b1
mov dword [rbp - 0x24], 0x73b073a7
mov dword [rbp - 0x20], 0x73a673a7
mov dword [rbp - 0x1c], 0x73b17397
mov dword [rbp - 0x18], 0x73b073a7
mov dword [rbp - 0x10], 0x8ec173c2
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0xf
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003f17
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140003f38
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x73f573c3
mov dword [rbp - 0x1c], 0x73e673e2
mov ebx, 0x7390
mov dword [rbp - 0x18], 0x73f373f9
mov dword [rbp - 0x14], 0x73de73f5
mov dword [rbp - 0x10], 0x73fd73f1
mov dword [rbp - 0xc], 0x739073f5
mov dword [rbp - 8], 0x8ec17390
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003f95
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003fb4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x730f
mov dword [rbp - 0x30], 0x737d7348
mov ecx, 0x1e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x2c], 0x737a7360
mov dword [rbp - 0x28], 0x734c737f
mov dword [rbp - 0x24], 0x73627360
mov dword [rbp - 0x20], 0x7360737f
mov dword [rbp - 0x1c], 0x736a7361
mov dword [rbp - 0x18], 0x737b7361
mov dword [rbp - 0x10], 0x8ec1730f
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0xf
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000401b
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000403c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x1c
mov dword [rbp - 0x20], 0x73717340
mov dword [rbp - 0x1c], 0x73647362
mov ebx, 0x7310
mov dword [rbp - 0x18], 0x737f7353
mov dword [rbp - 0x14], 0x7360737d
mov dword [rbp - 0x10], 0x737e737f
mov dword [rbp - 0xc], 0x737e7375
mov dword [rbp - 8], 0x73107364
mov dword [rbp - 4], 0x8ec17310
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xe
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400040a0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400040c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x709e
mov dword [rbp - 0x30], 0x70f770c9
mov ecx, 0x2a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x2c], 0x70ad70f0
mov dword [rbp - 0x28], 0x70c170ac
mov dword [rbp - 0x24], 0x70f170dd
mov dword [rbp - 0x20], 0x70ee70f3
mov dword [rbp - 0x1c], 0x70ea70eb
mov dword [rbp - 0x18], 0x70ec70fb
mov dword [rbp - 0x14], 0x70e770cd
mov dword [rbp - 0x10], 0x70ea70ed
mov dword [rbp - 0xc], 0x70f370fb
mov dword [rbp - 4], 0x8ec1709e
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000413c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000415c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ecx, 0x48
mov dword [rbp - 0x50], 0x70dc70ca
mov dword [rbp - 0x4c], 0x70dc70d5
mov ebx, 0x7099
mov dword [rbp - 0x48], 0x70cd70da
mov dword [rbp - 0x44], 0x70b370b9
mov dword [rbp - 0x40], 0x70df70b9
mov dword [rbp - 0x3c], 0x70d670cb
mov dword [rbp - 0x38], 0x70b970d4
mov dword [rbp - 0x34], 0x70f070ce
mov dword [rbp - 0x30], 0x70aa70f7
mov dword [rbp - 0x2c], 0x70c670ab
mov dword [rbp - 0x28], 0x70e970d6
mov dword [rbp - 0x24], 0x70eb70fc
mov dword [rbp - 0x20], 0x70ed70f8
mov dword [rbp - 0x1c], 0x70f770f0
mov dword [rbp - 0x18], 0x70ca70fe
mov dword [rbp - 0x14], 0x70ea70e0
mov dword [rbp - 0x10], 0x70fc70ed
mov dword [rbp - 0xc], 0x709970f4
mov dword [rbp - 8], 0x8ec17099
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x24
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000420d
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x140004230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x70f670c8
mov dword [rbp - 0x2c], 0x70ac70f1
mov ebx, 0x709f
mov dword [rbp - 0x28], 0x70c070ad
mov dword [rbp - 0x24], 0x70f170cf
mov dword [rbp - 0x20], 0x70da70cf
mov dword [rbp - 0x1c], 0x70eb70f1
mov dword [rbp - 0x18], 0x70eb70f6
mov dword [rbp - 0x14], 0x709f70e6
mov dword [rbp - 0x10], 0x8ec1709f
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000429b
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400042bc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x73cd73fb
mov dword [rbp - 0x2c], 0x73ca73ca
mov ebx, 0x73b8
mov dword [rbp - 0x28], 0x73d673dd
mov dword [rbp - 0x24], 0x73ec73cc
mov dword [rbp - 0x20], 0x73d573d1
mov dword [rbp - 0x1c], 0x73e273dd
mov dword [rbp - 0x18], 0x73d673d7
mov dword [rbp - 0x14], 0x73b873dd
mov dword [rbp - 0x10], 0x8ec173b8
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004327
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140004348
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x7094
mov dword [rbp - 0x20], 0x70db70c6
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x70c070db
mov dword [rbp - 0x18], 0x70d770c8
mov dword [rbp - 0x14], 0x70d970dd
mov dword [rbp - 0x10], 0x70a670c2
mov dword [rbp - 8], 0x8ec17094
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400043a1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400043c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x734d7375
mov dword [rbp - 0x1c], 0x73497350
mov ebx, 0x7322
mov dword [rbp - 0x18], 0x73507345
mov dword [rbp - 0x14], 0x7357734d
mov dword [rbp - 0x10], 0x73227352
mov dword [rbp - 0xc], 0x8ec17322
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004416
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret