joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000498c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x18000a7b8]
xor esi, esi
mov rbx, rcx
test rax, rax
jne 0x180004ab0
mov dword [rbp - 0x19], 0x2d2e2d16
mov edx, esi
mov dword [rbp - 0x15], 0x2d272d28
mov dword [rbp - 0x11], 0x2d2f2d3d
mov dword [rbp - 0xd], 0x2d0b2d39
mov dword [rbp - 9], 0x2d232d2c
mov dword [rbp - 5], 0x2d7e2d2a
mov dword [rbp - 1], 0x2d202d10
mov dword [rbp + 3], 0x2d272d36
mov dword [rbp + 7], 0x2d3a2d05
mov dword [rbp + 0xb], 0x2d212d36
mov dword [rbp + 0xf], 0x2d282d3c
mov dword [rbp + 0x13], 0x2d332d18
mov dword [rbp + 0x17], 0x2d2a2d33
mov dword [rbp + 0x1b], 0x2d0f2d2d
mov dword [rbp + 0x1f], 0x2d0e2d0d
mov dword [rbp + 0x23], 0x2d162d06
mov dword [rbp + 0x27], 0x2d212d4b
mov dword [rbp + 0x2b], 0x2d1c2d02
mov dword [rbp + 0x2f], 0x2d022d3a
mov dword [rbp + 0x33], 0x2d032d04
mov dword [rbp + 0x37], 0x2d0b2d19
mov dword [rbp + 0x3b], 0x2d332d1d
mov dword [rbp + 0x3f], 0x2d132d19
mov dword [rbp + 0x43], 0x2d152d01
mov dword [rbp + 0x47], 0x2d022d16
mov dword [rbp + 0x4b], 0x2d0a2d12
mov word [rbp + 0x4f], ax
movsxd rcx, edx
mov eax, 0x2d45
add eax, edx
inc edx
xor word [rbp + rcx*2 - 0x19], ax
cmp edx, 0x34
jb 0x180004a78
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x19]
add rax, 0x4014890
mov word [rbp + 0x4f], si
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18000a7b8], rax
mov r9, qword [0x1800082a8]
lea r8, [rbp + 0x6f]
add r9, 0x40001f0
mov rdx, rax
mov rcx, rbx
call r9
mov rax, qword [rbp + 0x6f]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x180004ae8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18000a7e0]
xor r11d, r11d
mov rbx, rcx
test rax, rax
jne 0x180004bc9
mov dword [rbp - 0x50], 0x2d2e2d16
mov edx, r11d
mov dword [rbp - 0x4c], 0x2d272d28
mov dword [rbp - 0x48], 0x2d2f2d3d
mov dword [rbp - 0x44], 0x2d0b2d39
mov dword [rbp - 0x40], 0x2d232d2c
mov dword [rbp - 0x3c], 0x2d7e2d2a
mov dword [rbp - 0x38], 0x2d3a2d02
mov dword [rbp - 0x34], 0x2d3b2d3c
mov dword [rbp - 0x30], 0x2d332d21
mov dword [rbp - 0x2c], 0x2d1b2d25
mov dword [rbp - 0x28], 0x2d3b2d31
mov dword [rbp - 0x24], 0x2d3d2d29
mov dword [rbp - 0x20], 0x2d2a2d3e
mov dword [rbp - 0x1c], 0x2d122d3a
mov dword [rbp - 0x18], 0x2d2b2d4f
mov dword [rbp - 0x14], 0x2d252d10
mov dword [rbp - 0x10], 0x2d0f2d09
mov dword [rbp - 0xc], 0x2d0d2d11
mov word [rbp - 8], ax
movsxd rcx, edx
mov eax, 0x2d45
add eax, edx
inc edx
xor word [rbp + rcx*2 - 0x50], ax
cmp edx, 0x24
jb 0x180004b90
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x50]
add rax, 0x4014890
mov word [rbp - 8], r11w
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18000a7e0], rax
mov r9, qword [0x1800082a8]
lea r8, [rbp + 0x18]
add r9, 0x40001f0
mov rdx, rax
mov rcx, rbx
call r9
mov al, byte [rbp + 0x18]
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180004bf8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
xor r11d, r11d
mov rbx, rdx
cmp qword [0x18000a7f0], r11
mov rdi, rcx
jne 0x180004ce5
xor eax, eax
mov dword [rbp - 1], 0x2d2e2d16
mov word [rbp + 0x47], ax
mov edx, r11d
mov dword [rbp + 3], 0x2d272d28
mov dword [rbp + 7], 0x2d2f2d3d
mov dword [rbp + 0xb], 0x2d0b2d39
mov dword [rbp + 0xf], 0x2d232d2c
mov dword [rbp + 0x13], 0x2d7e2d2a
mov dword [rbp + 0x17], 0x2d332d13
mov dword [rbp + 0x1b], 0x2d312d20
mov dword [rbp + 0x1f], 0x2d332d01
mov dword [rbp + 0x23], 0x2d352d36
mov dword [rbp + 0x27], 0x2d352d1a
mov dword [rbp + 0x2b], 0x2d2c2d36
mov dword [rbp + 0x2f], 0x2d302d32
mov dword [rbp + 0x33], 0x2d0e2d3a
mov dword [rbp + 0x37], 0x2d4c2d15
mov dword [rbp + 0x3b], 0x2d172d2a
mov dword [rbp + 0x3f], 0x2d0a2d24
mov dword [rbp + 0x43], 0x2d112d0b
movsxd rcx, edx
mov eax, 0x2d45
add eax, edx
inc edx
xor word [rbp + rcx*2 - 1], ax
cmp edx, 0x24
jb 0x180004cac
mov rax, qword [0x1800082a8]
lea r8, [rbp - 1]
add rax, 0x4014890
mov word [rbp + 0x47], r11w
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18000a7f0], rax
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], rbx
call fcn.1800066dc
mov r9, qword [0x1800082a8]
lea r8, [rbp - 0x19]
mov rdx, qword [0x18000a7f0]
add r9, 0x40001f0
mov rcx, rax
call r9
mov al, byte [rbp - 9]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x180004d38
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x18000a830]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x180004e2e
mov dword [rbp - 1], 0x2d282d00
mov edx, esi
mov dword [rbp + 3], 0x2d212d20
mov dword [rbp + 7], 0x2d2f2d27
mov dword [rbp + 0xb], 0x2d1c2d65
mov dword [rbp + 0xf], 0x2d2f2d21
mov dword [rbp + 0x13], 0x2d352d36
mov dword [rbp + 0x17], 0x2d112d23
mov dword [rbp + 0x1b], 0x2d3a2d3c
mov dword [rbp + 0x1f], 0x2d242d21
mov dword [rbp + 0x23], 0x2d342d38
mov dword [rbp + 0x27], 0x2d3f2d35
mov dword [rbp + 0x2b], 0x2d722d29
mov dword [rbp + 0x2f], 0x2d2d2d14
mov dword [rbp + 0x33], 0x2d0e2d16
mov dword [rbp + 0x37], 0x2d172d11
mov dword [rbp + 0x3b], 0x2d2f2d17
mov dword [rbp + 0x3f], 0x2d1f2d00
mov dword [rbp + 0x43], 0x2d072d23
mov dword [rbp + 0x47], 0x2d042d1e
mov word [rbp + 0x4b], ax
movsxd rcx, edx
mov eax, 0x2d45
add eax, edx
inc edx
xor word [rbp + rcx*2 - 1], ax
cmp edx, 0x26
jb 0x180004df6
mov rax, qword [0x1800082a8]
lea r8, [rbp - 1]
add rax, 0x4014890
mov word [rbp + 0x4b], si
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18000a830], rax
movups xmm1, xmmword [rbx + 0x10]
mov r9, qword [0x1800082a8]
lea r8, [rbp - 0x29]
xorps xmm0, xmm0
add r9, 0x40001f0
movups xmmword [rbp - 0x21], xmm0
mov rdx, rax
mov rcx, rdi
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x19], xmm1
movups xmmword [rbp - 0x29], xmm0
call r9
mov al, byte [rbp - 9]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180004e7c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
lea rbp, [rax - 0x57]
sub rsp, 0xa0
mov qword [rbp + 7], rdx
xor r9d, r9d
mov rdx, qword [0x18000a7d8]
mov rbx, rcx
movaps xmmword [rax - 0x18], xmm6
movaps xmm6, xmm3
mov qword [rbp + 0xf], r8
test rdx, rdx
jne 0x180004f4e
mov dword [rbp - 0x31], 0x2d282d00
mov edx, r9d
mov dword [rbp - 0x2d], 0x2d212d20
mov dword [rbp - 0x29], 0x2d2f2d27
mov dword [rbp - 0x25], 0x2d0f2d65
mov dword [rbp - 0x21], 0x2d202d2c
mov dword [rbp - 0x1d], 0x2d312d39
mov dword [rbp - 0x19], 0x2d7c2d22
mov dword [rbp - 0x15], 0x2d662d18
mov dword [rbp - 0x11], 0x2d122d0a
mov dword [rbp - 0xd], 0x2d392d25
mov dword [rbp - 9], 0x2d162d2e
mov dword [rbp - 5], 0x2d322d32
mov dword [rbp - 1], 0x2d38
movsxd rcx, edx
mov eax, 0x2d45
add eax, edx
inc edx
xor word [rbp + rcx*2 - 0x31], ax
cmp edx, 0x19
jb 0x180004f12
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x31]
add rax, 0x4014890
mov word [rbp + 1], r9w
xor edx, edx
xor ecx, ecx
call rax
mov rdx, rax
mov qword [0x18000a7d8], rax
movss xmm0, dword [rbp + 7]
lea r8, [rbp + 0x17]
movss xmm1, dword [rbp + 0xb]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [0x1800082a8]
movss dword [rbp + 0x17], xmm0
add rax, 0x40001f0
movss xmm0, dword [rbp + 0xf]
movss dword [rbp + 0x1f], xmm0
movups xmm0, xmmword [rcx]
mov rcx, rbx
movss dword [rbp + 0x1b], xmm1
movss xmm1, dword [rbp + 0x13]
movdqu xmmword [rbp + 0x2b], xmm0
movss dword [rbp + 0x23], xmm1
movss dword [rbp + 0x27], xmm6
call rax
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
Function at 0x180004fb4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 7]
sub rsp, 0xd0
mov rdi, rdx
mov qword [rbp + 0x2f], r9
mov rdx, qword [0x18000a7e8]
xor r9d, r9d
mov rbx, r8
mov rsi, rcx
test rdx, rdx
jne 0x18000508e
mov dword [rsp + 0x20], 0x2d282d00
mov edx, r9d
mov dword [rsp + 0x24], 0x2d212d20
mov dword [rsp + 0x28], 0x2d2f2d27
mov dword [rsp + 0x2c], 0x2d0f2d65
mov dword [rsp + 0x30], 0x2d202d2c
mov dword [rsp + 0x34], 0x2d312d39
mov dword [rsp + 0x38], 0x2d7c2d22
mov dword [rsp + 0x3c], 0x2d662d18
mov dword [rsp + 0x40], 0x2d122d0a
mov dword [rsp + 0x44], 0x2d392d25
mov dword [rsp + 0x48], 0x2d0e2d2e
mov dword [rbp - 0x7d], 0x2d242d3e
mov dword [rbp - 0x79], 0x2d29
movsxd rcx, edx
mov eax, 0x2d45
add eax, edx
inc edx
xor word [rsp + rcx*2 + 0x20], ax
cmp edx, 0x19
jb 0x180005051
mov rax, qword [0x1800082a8]
lea r8, [rsp + 0x20]
add rax, 0x4014890
mov word [rbp - 0x77], r9w
xor edx, edx
xor ecx, ecx
call rax
mov rdx, rax
mov qword [0x18000a7e8], rax
movss xmm1, dword [rbp + 0x2f]
lea r8, [rbp - 0x69]
movups xmm0, xmmword [rbx]
mov rax, qword [rbp + 0x4f]
mov rcx, rsi
movss dword [rbp - 0x51], xmm1
movss xmm1, dword [rbp + 0x47]
movdqu xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x69], rdi
movss xmm0, dword [rbp + 0x33]
movss dword [rbp - 0x4d], xmm0
movss xmm0, dword [rbp + 0x4b]
movss dword [rbp - 0x49], xmm1
movups xmm1, xmmword [rax]
mov rax, qword [rbp + 0x5f]
movss dword [rbp - 0x45], xmm0
movss xmm0, dword [rbp + 0x57]
movdqu xmmword [rbp - 0x41], xmm1
movups xmm1, xmmword [rax]
mov al, byte [rbp + 0x6f]
mov byte [rbp - 0x15], al
mov al, byte [rbp + 0x77]
mov byte [rbp - 0x14], al
mov al, byte [rbp + 0x7f]
mov byte [rbp - 0x13], al
mov rax, qword [rbp + 0x87]
movss dword [rbp - 0x31], xmm0
movss xmm0, dword [rbp + 0x67]
movss dword [rbp - 0x1d], xmm0
movups xmm0, xmmword [rax]
mov rax, qword [0x1800082a8]
movdqu xmmword [rbp - 0x2d], xmm1
add rax, 0x40001f0
movss xmm1, dword [rbp + 0x6b]
movdqu xmmword [rbp - 0x11], xmm0
movss dword [rbp - 0x19], xmm1
call rax
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180006150
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rdi, rdx
xor r14d, r14d
mov rdx, qword [0x18000a7d0]
mov rbx, r8
mov rsi, rcx
test rdx, rdx
jne 0x180006286
xor eax, eax
mov dword [rbp - 0x39], 0x2d282d00
mov word [rbp + 0x2f], ax
mov edx, r14d
mov dword [rbp - 0x35], 0x2d212d20
mov dword [rbp - 0x31], 0x2d2f2d27
mov dword [rbp - 0x2d], 0x2d1c2d65
mov dword [rbp - 0x29], 0x2d2f2d21
mov dword [rbp - 0x25], 0x2d352d36
mov dword [rbp - 0x21], 0x2d112d23
mov dword [rbp - 0x1d], 0x2d3a2d3c
mov dword [rbp - 0x19], 0x2d242d21
mov dword [rbp - 0x15], 0x2d342d38
mov dword [rbp - 0x11], 0x2d3f2d35
mov dword [rbp - 0xd], 0x2d722d29
mov dword [rbp - 9], 0x2d2c2d0d
mov dword [rbp - 5], 0x2d0a2d30
mov dword [rbp - 1], 0x2d012d04
mov dword [rbp + 3], 0x2d332d17
mov dword [rbp + 7], 0x2d142d0a
mov dword [rbp + 0xb], 0x2d0c2d0b
mov dword [rbp + 0xf], 0x2d052d25
mov dword [rbp + 0x13], 0x2d0d2d08
mov dword [rbp + 0x17], 0x2d072d19
mov dword [rbp + 0x1b], 0x2d1e2d00
mov dword [rbp + 0x1f], 0x2d1d2d25
mov dword [rbp + 0x23], 0x2d172d20
mov dword [rbp + 0x27], 0x2d132d07
mov dword [rbp + 0x2b], 0x2d162d12
movsxd rcx, edx
mov eax, 0x2d45
add eax, edx
inc edx
xor word [rbp + rcx*2 - 0x39], ax
cmp edx, 0x34
jb 0x18000624a
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x39]
add rax, 0x4014890
mov word [rbp + 0x2f], r14w
xor edx, edx
xor ecx, ecx
call rax
mov rdx, rax
mov qword [0x18000a7d0], rax
movss xmm1, dword [rbx]
lea r8, [rbp + 0x37]
mov rax, qword [0x1800082a8]
mov rcx, rsi
movss xmm0, dword [rbx + 4]
add rax, 0x40001f0
and dword [rbp + 0x43], r14d
and dword [rbp + 0x47], r14d
movss dword [rbp + 0x37], xmm1
movss xmm1, dword [rbx + 8]
movss dword [rbp + 0x3f], xmm1
movss dword [rbp + 0x3b], xmm0
mov byte [rbp + 0x4b], 1
call rax
movsd xmm0, qword [rbp + 0x43]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rax, rdi
mov rsi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x28]
movsd qword [rdi], xmm0
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1800063dc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x57]
sub rsp, 0xb0
xor r10d, r10d
movaps xmmword [rax - 0x18], xmm6
cmp qword [0x18000a808], r10
movaps xmm6, xmm3
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
jne 0x1800064d0
xor eax, eax
mov dword [rbp - 0x11], 0x2d282d00
mov word [rbp + 0x33], ax
mov edx, r10d
mov dword [rbp - 0xd], 0x2d212d20
mov dword [rbp - 9], 0x2d2f2d27
mov dword [rbp - 5], 0x2d072d65
mov dword [rbp - 1], 0x2d3d2d24
mov dword [rbp + 3], 0x2d352d22
mov dword [rbp + 7], 0x2d1f2d25
mov dword [rbp + 0xb], 0x2d202d32
mov dword [rbp + 0xf], 0x2d1a2d3d
mov dword [rbp + 0x13], 0x2d3a2d3e
mov dword [rbp + 0x17], 0x2d3b2d2b
mov dword [rbp + 0x1b], 0x2d252d29
mov dword [rbp + 0x1f], 0x2d0c2d73
mov dword [rbp + 0x23], 0x2d0e2d16
mov dword [rbp + 0x27], 0x2d072d15
mov dword [rbp + 0x2b], 0x2d142d11
mov dword [rbp + 0x2f], 0x2d092d31
movsxd rcx, edx
mov eax, 0x2d45
add eax, edx
inc edx
xor word [rbp + rcx*2 - 0x11], ax
cmp edx, 0x22
jb 0x180006497
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x11]
add rax, 0x4014890
mov word [rbp + 0x33], r10w
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18000a808], rax
movsd xmm0, qword [rsi]
mov eax, dword [rsi + 8]
and dword [rbp - 0x21], 0
and dword [rbp - 0x1d], 0
and dword [rbp - 0x19], 0
movsd qword [rbp - 0x41], xmm0
movsd xmm0, qword [rdi]
movsd qword [rbp - 0x35], xmm0
movss xmm0, dword [rbp + 0x7f]
mov dword [rbp - 0x39], eax
mov eax, dword [rdi + 8]
movss dword [rbp - 0x25], xmm0
movss dword [rbp - 0x29], xmm6
mov dword [rbp - 0x2d], eax
call fcn.180006954
mov r9, qword [0x1800082a8]
lea r8, [rbp - 0x41]
mov rdx, qword [0x18000a808]
add r9, 0x40001f0
mov rcx, rax
call r9
mov eax, dword [rbp - 0x19]
lea r11, [rsp + 0xb0]
movsd xmm0, qword [rbp - 0x21]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rsp, r11
pop rbp
ret
Function at 0x1800066dc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
xor eax, eax
mov dword [rbp - 0x50], 0x2d2e2d16
xor r9d, r9d
mov dword [rbp - 0x4c], 0x2d272d28
mov edx, r9d
mov dword [rbp - 0x48], 0x2d2f2d3d
mov dword [rbp - 0x44], 0x2d0b2d39
mov dword [rbp - 0x40], 0x2d232d2c
mov dword [rbp - 0x3c], 0x2d7e2d2a
mov dword [rbp - 0x38], 0x2d372d15
mov dword [rbp - 0x34], 0x2d352d35
mov dword [rbp - 0x30], 0x2d3a2d20
mov dword [rbp - 0x2c], 0x2d072d23
mov dword [rbp - 0x28], 0x2d182d06
mov dword [rbp - 0x24], 0x2d2f2d3a
mov dword [rbp - 0x20], 0x2d0a2d38
mov dword [rbp - 0x1c], 0x2d012d3a
mov dword [rbp - 0x18], 0x2d212d0c
mov dword [rbp - 0x14], 0x2d092d0c
mov dword [rbp - 0x10], 0x2d092d15
mov dword [rbp - 0xc], 0x2d0d2d09
mov dword [rbp - 8], 0x2d1e2d07
mov word [rbp - 4], ax
movsxd rcx, edx
mov eax, 0x2d45
add eax, edx
inc edx
xor word [rbp + rcx*2 - 0x50], ax
cmp edx, 0x26
jb 0x180006776
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x50]
add rax, 0x4014890
mov word [rbp - 4], r9w
xor edx, edx
xor ecx, ecx
call rax
add rsp, 0x70
pop rbp
ret

Function at 0x1800067b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
xor eax, eax
mov dword [rbp - 0x60], 0x2d2e2d16
xor r9d, r9d
mov dword [rbp - 0x5c], 0x2d272d28
mov edx, r9d
mov dword [rbp - 0x58], 0x2d2f2d3d
mov dword [rbp - 0x54], 0x2d0b2d39
mov dword [rbp - 0x50], 0x2d232d2c
mov dword [rbp - 0x4c], 0x2d7e2d2a
mov dword [rbp - 0x48], 0x2d372d15
mov dword [rbp - 0x44], 0x2d352d35
mov dword [rbp - 0x40], 0x2d3a2d20
mov dword [rbp - 0x3c], 0x2d072d23
mov dword [rbp - 0x38], 0x2d092d06
mov dword [rbp - 0x34], 0x2d332d33
mov dword [rbp - 0x30], 0x2d2a2d32
mov dword [rbp - 0x2c], 0x2d122d3a
mov dword [rbp - 0x28], 0x2d0e2d23
mov dword [rbp - 0x24], 0x2d012d16
mov dword [rbp - 0x20], 0x2d142d15
mov dword [rbp - 0x1c], 0x2d062d0e
mov dword [rbp - 0x18], 0x2d262d1d
mov dword [rbp - 0x14], 0x2d0e2d02
mov dword [rbp - 0x10], 0x2d0f2d1f
mov dword [rbp - 0xc], 0x2d092d1d
mov word [rbp - 8], ax
movsxd rcx, edx
mov eax, 0x2d45
add eax, edx
inc edx
xor word [rbp + rcx*2 - 0x60], ax
cmp edx, 0x2c
jb 0x180006866
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x60]
add rax, 0x4014890
mov word [rbp - 8], r9w
xor edx, edx
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x1800068ac
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
xor eax, eax
mov dword [rbp - 0x40], 0x2d282d00
xor r9d, r9d
mov dword [rbp - 0x3c], 0x2d212d20
mov edx, r9d
mov dword [rbp - 0x38], 0x2d2f2d27
mov dword [rbp - 0x34], 0x2d072d65
mov dword [rbp - 0x30], 0x2d3d2d24
mov dword [rbp - 0x2c], 0x2d352d22
mov dword [rbp - 0x28], 0x2d012d25
mov dword [rbp - 0x24], 0x2d262d27
mov dword [rbp - 0x20], 0x2d382d3c
mov dword [rbp - 0x1c], 0x2d142d30
mov dword [rbp - 0x18], 0x2d382d30
mov dword [rbp - 0x14], 0x2d3d2d29
mov dword [rbp - 0x10], 0x2d272d2f
mov word [rbp - 0xc], ax
movsxd rcx, edx
mov eax, 0x2d45
add eax, edx
inc edx
xor word [rbp + rcx*2 - 0x40], ax
cmp edx, 0x1a
jb 0x18000691c
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x40]
add rax, 0x4014890
mov word [rbp - 0xc], r9w
xor edx, edx
xor ecx, ecx
call rax
add rsp, 0x60
pop rbp
ret

Function at 0x180006954
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
xor r9d, r9d
mov dword [rbp - 0x50], 0x2d282d00
mov edx, r9d
mov dword [rbp - 0x4c], 0x2d212d20
mov dword [rbp - 0x48], 0x2d2f2d27
mov dword [rbp - 0x44], 0x2d082d65
mov dword [rbp - 0x40], 0x2d282d28
mov dword [rbp - 0x3c], 0x2d252d2e
mov dword [rbp - 0x38], 0x2d262d3d
mov dword [rbp - 0x34], 0x2d0b2d0c
mov dword [rbp - 0x30], 0x2d3f2d1e
mov dword [rbp - 0x2c], 0x2d352d24
mov dword [rbp - 0x28], 0x2d2e2d3c
mov dword [rbp - 0x24], 0x2d3d2d16
mov dword [rbp - 0x20], 0x2d362d29
mov dword [rbp - 0x1c], 0x2d092d13
mov dword [rbp - 0x18], 0x2d102d03
mov dword [rbp - 0x14], 0x2d162d02
mov dword [rbp - 0x10], 0x2d1c
movsxd rcx, edx
mov eax, 0x2d45
add eax, edx
inc edx
xor word [rbp + rcx*2 - 0x50], ax
cmp edx, 0x21
jb 0x1800069da
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x50]
add rax, 0x4014890
mov word [rbp - 0xe], r9w
xor edx, edx
xor ecx, ecx
call rax
add rsp, 0x70
pop rbp
ret
Function at 0x140009b40
Capabilities:
Delete file

Disassembly:
mov word [rsp + 0x10], dx
mov byte [rsp + 8], cl
sub rsp, 0x58
cmp dword [0x1401465c8], 5
jge 0x140009e15
mov eax, dword [0x1401465c8]
inc eax
mov dword [0x1401465c8], eax
mov eax, 0xf797
mov word [rsp + 0x30], ax
mov dword [rsp + 0x44], 0x96cba916
mov byte [rsp + 0x25], 8
mov dword [rsp + 0x34], 0xda956bcb
mov dword [rsp + 0x28], 0x4c411e92
mov dword [rsp + 0x3c], 0x89c6df51
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov byte [rsp + 0x60], 0
jmp 0x140009bb3
movzx eax, byte [rsp + 0x60]
inc al
mov byte [rsp + 0x60], al
movsx eax, byte [rsp + 0x60]
cmp eax, 0x64
jge 0x140009d32
mov byte [rsp + 0x24], 0x6f
movsx eax, word [0x140142ef4]
test eax, eax
je 0x140009bf0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
call fcn.140009a00
jmp 0x140009ccd
mov byte [rsp + 0x60], 0
jmp 0x140009c02
movsx eax, byte [rsp + 0x60]
cmp eax, 0x64
jge 0x140009ccd
mov dword [rsp + 0x38], 0xb6c168d9
mov r8w, 0x880b
mov dx, 0x254b
movzx ecx, word [rsp + 0x34]
call fcn.140009ad0
mov eax, dword [0x1401465c8]
dec eax
mov dword [0x1401465c8], eax
movsx eax, word [0x140142ef4]
jmp 0x140009e1a
cmp dword [rsp + 0x28], 0
je 0x140009d1d
mov eax, 0x84a7
mov word [rsp + 0x20], ax
xor eax, eax
mov word [rsp + 0x20], ax
jmp 0x140009cf4
movzx eax, word [rsp + 0x20]
inc ax
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
cmp eax, 0x64
jge 0x140009d1b
mov eax, 0x67bf
mov word [0x140142ef4], ax
movzx eax, word [rsp + 0x20]
mov word [rsp + 0x68], ax
mov byte [rsp + 0x24], 0x2f
jmp 0x140009ce7
jmp 0x140009d2d
movsx ax, byte [rsp + 0x60]
movzx edx, ax
xor ecx, ecx
call fcn.140009b40
jmp 0x140009ba8
mov eax, dword [0x1401465c8]
dec eax
mov dword [0x1401465c8], eax
movsx eax, word [0x140142ef4]
jmp 0x140009e1a
mov eax, 0x316108aa
add rsp, 0x58
ret

Function at 0x140009e20
Capabilities:
Delete directory

Disassembly:
mov word [rsp + 0x10], dx
mov word [rsp + 8], cx
sub rsp, 0x38
cmp dword [0x1401465c8], 5
jge 0x140009eb4
mov eax, dword [0x1401465c8]
inc eax
mov dword [0x1401465c8], eax
mov dword [rsp + 0x24], 0xf17cb599
movsx eax, byte [0x140142c8a]
test eax, eax
je 0x140009e67
mov byte [rsp + 0x20], 0xc0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140009e8d
mov dword [rsp + 0x24], 0
jmp 0x140009e7b
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x64
jge 0x140009e8d
call fcn.140009a00
mov dword [rsp + 0x24], eax
jmp 0x140009e71
mov eax, dword [0x1401465c8]
dec eax
mov dword [0x1401465c8], eax
movsx eax, byte [0x140142c8a]
jmp 0x140009eb9
mov eax, 0x9cff3d02
add rsp, 0x38
ret
Function at 0x14000ddd0
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140142088]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov qword [rbp - 0x10], 7
mov rax, r8
mov dword [rbp - 0x4c], ebx
mov qword [rbp - 0x18], rbx
mov word [rbp - 0x28], bx
cmp word [r8], bx
jne 0x14000de0e
mov r8d, ebx
jmp 0x14000de1c
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bx
jne 0x14000de12
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400053b0
cmp qword [rbp - 0x18], 0x3e8
jbe 0x14000de3c
xor edx, edx
lea ecx, [rdx + 2]
call fcn.140009ec0
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x2710
call fcn.1400f14a0
test eax, eax
je 0x14000debb
mov r9d, dword [rbp - 0x50]
cmp r9d, 0x2710
je 0x14000debb
movdqa xmm0, xmmword [0x140137340]
xor eax, eax
movdqu xmmword [rbp - 0x48], xmm0
mov byte [rbp - 0x2a], al
mov dword [rbp - 0x38], 0x643a33
mov dword [rbp - 0x34], 0x41534b65
mov dword [rbp - 0x30], 0x44095b05
mov word [rbp - 0x2c], 0x4d46
nop word [rax + rax]
lea ecx, [rbx + 1]
add bl, byte [rbp - 0x48]
movsxd rax, ecx
xor byte [rbp + rax - 0x48], bl
movsxd rbx, ecx
cmp rbx, 0x1d
jb 0x14000de90
lea r8, str.logs_MduNa._Dipe.log
xor edx, edx
lea rcx, str.smi64
call fcn.1400f1b60
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp qword [rbp - 0x18], 0x2738
mov rbx, rax
jbe 0x14000dee5
xor edx, edx
lea ecx, [rdx + 2]
call fcn.1400eab40
mov edx, dword [rbp - 0x4c]
mov r8, rbx
call fcn.1400031d0
mov r8, qword [rbp - 0x10]
mov ebx, eax
cmp r8, 8
jb 0x14000df0e
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x28]
inc r8
call fcn.140005e20
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400fcbc0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret