joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180030218
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199810]
mov rbx, rdx
test rax, rax
jne 0x1800302c9
mov dword [rbp - 0x50], 0xe
xor edx, edx
mov byte [rbp - 0x4c], 0x58
mov byte [rbp - 0x4b], 0x67
mov byte [rbp - 0x4a], 0x7c
mov byte [rbp - 0x49], 0x7a
mov byte [rbp - 0x48], 0x7b
mov byte [rbp - 0x47], 0x6f
mov byte [rbp - 0x46], 0x62
mov byte [rbp - 0x45], 0x5f
mov byte [rbp - 0x44], 0x7b
mov byte [rbp - 0x43], 0x6b
mov byte [rbp - 0x42], 0x7c
mov byte [rbp - 0x41], 0x77
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180030277
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199810], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199810]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1800302f2
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18003031e
cmp dword [rbp - 0x18], 0x10000
je 0x18003031e
cmp qword [rbp - 0x20], 0x1000
jb 0x18003031e
cmp dword [rbp - 0x10], 0x1000000
je 0x18003031a
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180030320
mov al, 1
jmp 0x180030320
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180031acc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199878]
mov rbx, rdx
test rax, rax
jne 0x180031b7d
mov dword [rbp - 0x50], 0xe
xor edx, edx
mov byte [rbp - 0x4c], 0x58
mov byte [rbp - 0x4b], 0x67
mov byte [rbp - 0x4a], 0x7c
mov byte [rbp - 0x49], 0x7a
mov byte [rbp - 0x48], 0x7b
mov byte [rbp - 0x47], 0x6f
mov byte [rbp - 0x46], 0x62
mov byte [rbp - 0x45], 0x5f
mov byte [rbp - 0x44], 0x7b
mov byte [rbp - 0x43], 0x6b
mov byte [rbp - 0x42], 0x7c
mov byte [rbp - 0x41], 0x77
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180031b2b
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199878], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199878]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180031ba6
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180031bd2
cmp dword [rbp - 0x18], 0x10000
je 0x180031bd2
cmp qword [rbp - 0x20], 0x1000
jb 0x180031bd2
cmp dword [rbp - 0x10], 0x1000000
je 0x180031bce
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180031bd4
mov al, 1
jmp 0x180031bd4
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18005ce58
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xa
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005ce65
xor edx, edx
mov word [rcx + 0x18], dx
ret

Function at 0x18005ce88
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 8
jb 0x18005ce95
mov word [rcx + 0x14], r11w
ret

Function at 0x18005cebc
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 9
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005cec9
xor edx, edx
mov word [rcx + 0x16], dx
ret

Function at 0x18005ceec
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0xa
jb 0x18005cef9
mov word [rcx + 0x18], r11w
ret

Function at 0x18005cf34
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0xd
jb 0x18005cf41
mov word [rcx + 0x1e], r11w
ret

Function at 0x18005cff8
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xd
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005d005
xor edx, edx
mov word [rcx + 0x1e], dx
ret

Function at 0x18005d074
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0xb
jb 0x18005d081
mov word [rcx + 0x1a], r11w
ret

Function at 0x18005d0bc
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x10
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005d0c9
xor edx, edx
mov word [rcx + 0x24], dx
ret

Function at 0x18005d0ec
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0xf
jb 0x18005d0f9
mov word [rcx + 0x22], r11w
ret

Function at 0x18005d1a0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x13
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005d1ad
xor edx, edx
mov word [rcx + 0x2a], dx
ret
Function at 0x18005d1e4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x12
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005d1f1
xor edx, edx
mov word [rcx + 0x28], dx
ret

Function at 0x18005d214
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xf
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005d221
xor edx, edx
mov word [rcx + 0x22], dx
ret

Function at 0x18005d258
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x17
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005d265
xor edx, edx
mov word [rcx + 0x32], dx
ret

Function at 0x18005d2f4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x14
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005d301
xor edx, edx
mov word [rcx + 0x2c], dx
ret

Function at 0x18005d324
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x10
jb 0x18005d331
mov word [rcx + 0x24], r11w
ret

Function at 0x18005d3d4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xe
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005d3e1
xor edx, edx
mov word [rcx + 0x20], dx
ret

Function at 0x18005d404
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xc
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005d411
xor edx, edx
mov word [rcx + 0x1c], dx
ret

Function at 0x18005d448
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x11
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005d455
xor edx, edx
mov word [rcx + 0x26], dx
ret

Function at 0x18005d494
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0xe
jb 0x18005d4a1
mov word [rcx + 0x20], r11w
ret

Function at 0x18005d58c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 8
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005d599
xor edx, edx
mov word [rcx + 0x14], dx
ret

Function at 0x18005d62c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x12
jb 0x18005d639
mov word [rcx + 0x28], r11w
ret
Function at 0x18005d72c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x11
jb 0x18005d739
mov word [rcx + 0x26], r11w
ret

Function at 0x18005d790
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x15
jb 0x18005d79d
mov word [rcx + 0x2e], r11w
ret

Function at 0x18005d858
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x29
jb 0x18005d865
mov word [rcx + 0x56], r11w
ret

Function at 0x18005d8a0
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x2a
jb 0x18005d8ad
mov word [rcx + 0x58], r11w
ret

Function at 0x18005d904
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x2c
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005d911
xor edx, edx
mov word [rcx + 0x5c], dx
ret

Function at 0x18005d948
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x1b
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005d955
xor edx, edx
mov word [rcx + 0x3a], dx
ret

Function at 0x18005d978
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x1b
jb 0x18005d985
mov word [rcx + 0x3a], r11w
ret

Function at 0x18005da1c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x2b
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005da29
xor edx, edx
mov word [rcx + 0x5a], dx
ret

Function at 0x18005da78
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x2a
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005da85
xor edx, edx
mov word [rcx + 0x58], dx
ret

Function at 0x18005dabc
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x27
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005dac9
xor edx, edx
mov word [rcx + 0x52], dx
ret
Function at 0x18005db18
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x29
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005db25
xor edx, edx
mov word [rcx + 0x56], dx
ret

Function at 0x18005dba4
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x2e
jb 0x18005dbb1
mov word [rcx + 0x60], r11w
ret

Function at 0x18005dc08
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x2f
jb 0x18005dc15
mov word [rcx + 0x62], r11w
ret

Function at 0x18005dc50
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x1e
jb 0x18005dc5d
mov word [rcx + 0x40], r11w
ret

Function at 0x18005dd64
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x30
jb 0x18005dd71
mov word [rcx + 0x64], r11w
ret

Function at 0x18005ddac
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x26
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005ddb9
xor edx, edx
mov word [rcx + 0x50], dx
ret

Function at 0x18005ddf0
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x1f
jb 0x18005ddfd
mov word [rcx + 0x42], r11w
ret

Function at 0x18005de64
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x28
jb 0x18005de71
mov word [rcx + 0x54], r11w
ret

Function at 0x18005de98
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x28
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005dea5
xor edx, edx
mov word [rcx + 0x54], dx
ret

Function at 0x18005dec8
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x27
jb 0x18005ded5
mov word [rcx + 0x52], r11w
ret
Function at 0x18005df2c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x25
jb 0x18005df39
mov word [rcx + 0x4e], r11w
ret

Function at 0x18005dfa0
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x21
jb 0x18005dfad
mov word [rcx + 0x46], r11w
ret

Function at 0x18005dfe8
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x23
jb 0x18005dff5
mov word [rcx + 0x4a], r11w
ret

Function at 0x18005e090
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x2b
jb 0x18005e09d
mov word [rcx + 0x5a], r11w
ret

Function at 0x18005e0d8
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x31
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005e0e5
xor edx, edx
mov word [rcx + 0x66], dx
ret

Function at 0x18005e174
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 3
jb 0x18005e181
mov word [rcx + 0xa], r11w
ret

Function at 0x18005e1a8
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 9
jb 0x18005e1b5
mov word [rcx + 0x16], r11w
ret

Function at 0x18005e20c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 5
jb 0x18005e219
mov word [rcx + 0xe], r11w
ret
Function at 0x18005e8d8
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xf
jb 0x18005e8df
mov byte [rcx + 0x13], 0
ret

Function at 0x18005e91c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 6
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005e929
xor edx, edx
mov word [rcx + 0x10], dx
ret

Function at 0x18005e9bc
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 5
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005e9c9
xor edx, edx
mov word [rcx + 0xe], dx
ret

Function at 0x18005ea00
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 4
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005ea0d
xor edx, edx
mov word [rcx + 0xc], dx
ret

Function at 0x18005ea78
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 7
jb 0x18005ea85
mov word [rcx + 0x12], r11w
ret

Function at 0x18005eac8
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 7
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18005ead5
xor edx, edx
mov word [rcx + 0x12], dx
ret
Function at 0x18006da0c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1801999b0]
mov rbx, rdx
test rax, rax
jne 0x18006dabd
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18006da6b
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1801999b0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1801999b0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18006dae6
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18006db12
cmp dword [rbp - 0x18], 0x10000
je 0x18006db12
cmp qword [rbp - 0x20], 0x1000
jb 0x18006db12
cmp dword [rbp - 0x10], 0x1000000
je 0x18006db0e
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18006db14
mov al, 1
jmp 0x18006db14
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18006f2b8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1801998a8]
mov rbx, rdx
test rax, rax
jne 0x18006f369
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18006f317
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1801998a8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1801998a8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18006f392
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18006f3be
cmp dword [rbp - 0x18], 0x10000
je 0x18006f3be
cmp qword [rbp - 0x20], 0x1000
jb 0x18006f3be
cmp dword [rbp - 0x10], 0x1000000
je 0x18006f3ba
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18006f3c0
mov al, 1
jmp 0x18006f3c0
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret