joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008014
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov word [rsp + 0x30], 0x963f
movzx eax, word [rsp + 0x30]
xor eax, 0x6b
mov word [rsp + 0x32], ax
movzx eax, word [rsp + 0x30]
inc eax
xor eax, 0x65
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x30]
add eax, 2
xor eax, 0x72
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x30]
add eax, 3
xor eax, 0x6e
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x30]
add eax, 4
xor eax, 0x65
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x30]
add eax, 5
xor eax, 0x6c
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x30]
add eax, 6
xor eax, 0x33
mov word [rsp + 0x3e], ax
movzx eax, word [rsp + 0x30]
add eax, 7
xor eax, 0x32
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x30]
add eax, 8
xor eax, 0x2e
mov word [rsp + 0x42], ax
movzx eax, word [rsp + 0x30]
add eax, 9
xor eax, 0x64
mov word [rsp + 0x44], ax
movzx eax, word [rsp + 0x30]
add eax, 0xa
xor eax, 0x6c
mov word [rsp + 0x46], ax
movzx eax, word [rsp + 0x30]
add eax, 0xb
xor eax, 0x6c
mov word [rsp + 0x48], ax
mov word [rsp + 0x4a], 0
mov ecx, 0x1a
call fcn.1400018f0
mov rsi, rax
xor eax, eax
nop
movzx ecx, word [rsp + rax*2 + 0x32]
movzx edx, word [rsp + 0x30]
add edx, eax
xor dx, cx
mov word [rsi + rax*2], dx
inc rax
cmp rax, 0xc
jne 0x140007fc0
mov word [rsi + 0x18], 0
mov word [rsp + 0x4c], 0x955
mov word [rsp + 0x4e], 0x93e
mov word [rsp + 0x50], 0x930
mov word [rsp + 0x52], 0x927
mov word [rsp + 0x54], 0x93b
mov word [rsp + 0x56], 0x930
mov word [rsp + 0x58], 0x939
mov word [rsp + 0x5a], 0x966
mov word [rsp + 0x5c], 0x967
mov word [rsp + 0x5e], 0x97b
mov word [rsp + 0x60], 0x931
mov word [rsp + 0x62], 0x939
mov word [rsp + 0x64], 0x939
mov word [rsp + 0x66], 0
mov ecx, 0x1a
call fcn.1400018f0
Function at 0x14000804e
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov ecx, 1
nop word cs:[rax + rax]
movzx edx, word [rsp + rcx*2 + 0x4c]
xor dx, word [rsp + 0x4c]
mov word [rax + rcx*2 - 2], dx
inc rcx
cmp rcx, 0xd
jne 0x140008060
mov word [rax + 0x18], 0
mov byte [rsp + 0x2f], 0x69
movzx ecx, byte [rsp + 0x2f]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x1400080a6
cmp r9w, r10w
je 0x1400080f3
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [rax + r8]
lea edi, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp di, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x1400080a0
add r8, 2
cmp r9w, r10w
je 0x1400080b0
jmp 0x1400080a0
mov rdx, qword [rcx + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov r8d, 0x12337fde
call fcn.140004690
mov rcx, rsi
call rax
mov word [rsp + 0x30], 0x6c
mov word [rsp + 0x32], 0x66
mov word [rsp + 0x34], 0x73
mov word [rsp + 0x36], 0x6f
mov word [rsp + 0x38], 0x66
mov word [rsp + 0x3a], 0x6d
mov word [rsp + 0x3c], 0x34
mov word [rsp + 0x3e], 0x33
mov word [rsp + 0x40], 0x2f
mov word [rsp + 0x42], 0x65
mov word [rsp + 0x44], 0x6d
mov word [rsp + 0x46], 0x6d
mov word [rsp + 0x48], 0
mov ecx, 0x1a
call fcn.1400018f0
xor ecx, ecx
nop word cs:[rax + rax]
movzx edx, word [rsp + rcx*2 + 0x30]
dec edx
mov word [rax + rcx*2], dx
inc rcx
cmp rcx, 0xc
jne 0x140008180
mov word [rax + 0x18], 0
mov byte [rsp + 0x4c], 0x69
movzx ecx, byte [rsp + 0x4c]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x1400081c6
cmp r9w, r10w
je 0x140008213
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
leave
and byte [rsi + 0x41], ah
cmp ebx, 0x1a
cmovae r9d, r10d
movzx r11d, word [rax + r8]
sbb al, 0
lea esi, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp si, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x1400081c0
add r8, 2
cmp r9w, r10w
invalid
je 0x1400081d0
jmp 0x1400081c0
mov rdx, qword [rcx + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov r8d, 0x57c4d0d0
call fcn.140004690
nop
add rsp, 0x68
pop rdi
pop rsi
jmp rax
Function at 0x1400082e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rbx, qword [rcx]
mov word [rsp + 0x26], 0xdc94
movzx eax, word [rsp + 0x26]
xor eax, 0x77
mov word [rsp + 0x28], ax
movzx eax, word [rsp + 0x26]
inc eax
xor eax, 0x69
mov word [rsp + 0x2a], ax
movzx eax, word [rsp + 0x26]
add eax, 2
xor eax, 0x6e
mov word [rsp + 0x2c], ax
movzx eax, word [rsp + 0x26]
add eax, 3
xor eax, 0x68
mov word [rsp + 0x2e], ax
movzx eax, word [rsp + 0x26]
add eax, 4
xor eax, 0x74
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x26]
add eax, 5
xor eax, 0x74
mov word [rsp + 0x32], ax
movzx eax, word [rsp + 0x26]
add eax, 6
xor eax, 0x70
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x26]
add eax, 7
xor eax, 0x2e
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x26]
add eax, 8
xor eax, 0x64
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x26]
add eax, 9
xor eax, 0x6c
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x26]
add eax, 0xa
xor eax, 0x6c
mov word [rsp + 0x3c], ax
invalid
Function at 0x140009457
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rax, qword [rsp + 0xc0]
test rax, rax
sete r10b
test r9, r9
sete r9b
or r9b, r10b
jne 0x14000973c
movzx r9d, word [rax + 0x14]
add r9, rax
add r9, 0x18
je 0x14000973c
movzx r10d, word [rax + 6]
test r10w, r10w
je 0x14000973c
mov r11d, dword [rax + 0xb0]
mov sil, 1
jmp 0x1400093b1
movzx edi, sil
inc sil
cmp r10w, di
jbe 0x14000973c
lea edi, [rsi - 1]
movzx edi, dil
shl edi, 3
lea rdi, [rdi + rdi*4]
mov ebx, dword [r9 + rdi + 0xc]
cmp r11d, ebx
jb 0x1400093a0
add ebx, dword [rdi + r9 + 8]
cmp r11d, ebx
jae 0x1400093a0
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdi, [rsp + 0xc0]
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x28]
mov rbx, rcx
mov rcx, rax
mov r14, r8
mov r15, rdx
call fcn.140009750
mov rcx, r15
mov rdx, r14
mov r12, rbx
mov rsi, rax
test rax, rax
jne 0x14000943e
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x28]
call fcn.140009b50
mov rcx, r15
mov rdx, r14
mov r12, rbx
mov rsi, rax
test rax, rax
je 0x14000973c
mov rax, qword [rsp + 0xc0]
mov r11d, dword [rax + 0x54]
mov r8d, r11d
and r8d, 7
mov r10, rcx
mov r9, rsi
cmp r11, 8
jb 0x1400094ea
mov ebx, r11d
shr ebx, 3
cmp r11d, 0x30
jb 0x1400094b8
mov r9, rsi
sub r9, rcx
cmp r9, 0x20
jb 0x1400094b8
mov r14d, ebx
mov r9, rsi
mov r11, rbx
mov r10, rcx
Function at 0x140009be0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov word [rsp + 0x26], 0xa00c
movzx eax, word [rsp + 0x26]
xor eax, 0x6b
mov word [rsp + 0x28], ax
movzx eax, word [rsp + 0x26]
inc eax
xor eax, 0x65
mov word [rsp + 0x2a], ax
movzx eax, word [rsp + 0x26]
add eax, 2
xor eax, 0x72
mov word [rsp + 0x2c], ax
movzx eax, word [rsp + 0x26]
add eax, 3
xor eax, 0x6e
mov word [rsp + 0x2e], ax
movzx eax, word [rsp + 0x26]
add eax, 4
xor eax, 0x65
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x26]
add eax, 5
xor eax, 0x6c
mov word [rsp + 0x32], ax
movzx eax, word [rsp + 0x26]
add eax, 6
xor eax, 0x33
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x26]
add eax, 7
xor eax, 0x32
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x26]
add eax, 8
xor eax, 0x2e
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x26]
add eax, 9
xor eax, 0x64
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x26]
add eax, 0xa
xor eax, 0x6c
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x26]
add eax, 0xb
xor eax, 0x6c
mov word [rsp + 0x3e], ax
mov word [rsp + 0x40], 0
mov ecx, 0x1a
call fcn.1400018f0
mov rdi, rax
xor eax, eax
nop word cs:[rax + rax]
movzx ecx, word [rsp + rax*2 + 0x28]
movzx edx, word [rsp + 0x26]
add edx, eax
xor dx, cx
mov word [rdi + rax*2], dx
inc rax
cmp rax, 0xc
jne 0x140009c40
mov word [rdi + 0x18], 0
mov word [rsp + 0x44], 0x5c18
mov word [rsp + 0x46], 0x5c73
mov word [rsp + 0x48], 0x5c7d
mov word [rsp + 0x4a], 0x5c6a
mov word [rsp + 0x4c], 0x5c76
mov word [rsp + 0x4e], 0x5c7d
mov word [rsp + 0x50], 0x5c74
mov word [rsp + 0x52], 0x5c2b
mov word [rsp + 0x54], 0x5c2a
mov word [rsp + 0x56], 0x5c36
mov word [rsp + 0x58], 0x5c7c
mov word [rsp + 0x5a], 0x5c74
mov word [rsp + 0x5c], 0x5c74
mov word [rsp + 0x5e], 0
mov ecx, 0x1a
call fcn.1400018f0
Function at 0x140009bfe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov word [rsp + 0x26], 0xa00c
movzx eax, word [rsp + 0x26]
xor eax, 0x6b
mov word [rsp + 0x28], ax
movzx eax, word [rsp + 0x26]
inc eax
xor eax, 0x65
mov word [rsp + 0x2a], ax
movzx eax, word [rsp + 0x26]
add eax, 2
xor eax, 0x72
mov word [rsp + 0x2c], ax
movzx eax, word [rsp + 0x26]
add eax, 3
xor eax, 0x6e
mov word [rsp + 0x2e], ax
movzx eax, word [rsp + 0x26]
add eax, 4
xor eax, 0x65
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x26]
add eax, 5
xor eax, 0x6c
mov word [rsp + 0x32], ax
movzx eax, word [rsp + 0x26]
add eax, 6
xor eax, 0x33
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x26]
add eax, 7
xor eax, 0x32
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x26]
add eax, 8
xor eax, 0x2e
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x26]
add eax, 9
xor eax, 0x64
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x26]
add eax, 0xa
xor eax, 0x6c
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x26]
add eax, 0xb
xor eax, 0x6c
mov word [rsp + 0x3e], ax
mov word [rsp + 0x40], 0
mov ecx, 0x1a
call fcn.1400018f0
mov rdi, rax
xor eax, eax
nop word cs:[rax + rax]
movzx ecx, word [rsp + rax*2 + 0x28]
movzx edx, word [rsp + 0x26]
add edx, eax
xor dx, cx
mov word [rdi + rax*2], dx
inc rax
cmp rax, 0xc
jne 0x140009c40
mov word [rdi + 0x18], 0
mov word [rsp + 0x44], 0x5c18
mov word [rsp + 0x46], 0x5c73
mov word [rsp + 0x48], 0x5c7d
mov word [rsp + 0x4a], 0x5c6a
mov word [rsp + 0x4c], 0x5c76
mov word [rsp + 0x4e], 0x5c7d
mov word [rsp + 0x50], 0x5c74
mov word [rsp + 0x52], 0x5c2b
mov word [rsp + 0x54], 0x5c2a
mov word [rsp + 0x56], 0x5c36
mov word [rsp + 0x58], 0x5c7c
mov word [rsp + 0x5a], 0x5c74
mov word [rsp + 0x5c], 0x5c74
mov word [rsp + 0x5e], 0
mov ecx, 0x1a
call fcn.1400018f0
Function at 0x140009c1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov word [rsp + 0x26], 0xa00c
movzx eax, word [rsp + 0x26]
xor eax, 0x6b
mov word [rsp + 0x28], ax
movzx eax, word [rsp + 0x26]
inc eax
xor eax, 0x65
mov word [rsp + 0x2a], ax
movzx eax, word [rsp + 0x26]
add eax, 2
xor eax, 0x72
mov word [rsp + 0x2c], ax
movzx eax, word [rsp + 0x26]
add eax, 3
xor eax, 0x6e
mov word [rsp + 0x2e], ax
movzx eax, word [rsp + 0x26]
add eax, 4
xor eax, 0x65
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x26]
add eax, 5
xor eax, 0x6c
mov word [rsp + 0x32], ax
movzx eax, word [rsp + 0x26]
add eax, 6
xor eax, 0x33
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x26]
add eax, 7
xor eax, 0x32
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x26]
add eax, 8
xor eax, 0x2e
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x26]
add eax, 9
xor eax, 0x64
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x26]
add eax, 0xa
xor eax, 0x6c
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x26]
add eax, 0xb
xor eax, 0x6c
mov word [rsp + 0x3e], ax
mov word [rsp + 0x40], 0
mov ecx, 0x1a
call fcn.1400018f0
mov rdi, rax
xor eax, eax
nop word cs:[rax + rax]
movzx ecx, word [rsp + rax*2 + 0x28]
movzx edx, word [rsp + 0x26]
add edx, eax
xor dx, cx
mov word [rdi + rax*2], dx
inc rax
cmp rax, 0xc
jne 0x140009c40
mov word [rdi + 0x18], 0
mov word [rsp + 0x44], 0x5c18
mov word [rsp + 0x46], 0x5c73
mov word [rsp + 0x48], 0x5c7d
mov word [rsp + 0x4a], 0x5c6a
mov word [rsp + 0x4c], 0x5c76
mov word [rsp + 0x4e], 0x5c7d
mov word [rsp + 0x50], 0x5c74
mov word [rsp + 0x52], 0x5c2b
mov word [rsp + 0x54], 0x5c2a
mov word [rsp + 0x56], 0x5c36
mov word [rsp + 0x58], 0x5c7c
mov word [rsp + 0x5a], 0x5c74
mov word [rsp + 0x5c], 0x5c74
mov word [rsp + 0x5e], 0
mov ecx, 0x1a
call fcn.1400018f0
Function at 0x140009cce
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 1
nop word cs:[rax + rax]
movzx edx, word [rsp + rcx*2 + 0x44]
xor dx, word [rsp + 0x44]
mov word [rax + rcx*2 - 2], dx
inc rcx
cmp rcx, 0xd
jne 0x140009ce0
mov word [rax + 0x18], 0
mov byte [rsp + 0x43], 0x69
movzx ecx, byte [rsp + 0x43]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x140009d26
cmp r9w, r10w
je 0x140009d73
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [rax + r8]
lea ebx, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp bx, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x140009d20
add r8, 2
cmp r9w, r10w
je 0x140009d30
jmp 0x140009d20
mov rdx, qword [rcx + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov r8d, 0x12337fde
call fcn.140004690
mov rcx, rdi
call rax
mov rax, qword [rsi]
mov rsi, qword [rax]
mov word [rsp + 0x26], 0x36ca
movzx eax, word [rsp + 0x26]
xor eax, 0x6b
mov word [rsp + 0x28], ax
movzx eax, word [rsp + 0x26]
inc eax
xor eax, 0x65
mov word [rsp + 0x2a], ax
movzx eax, word [rsp + 0x26]
add eax, 2
xor eax, 0x72
mov word [rsp + 0x2c], ax
movzx eax, word [rsp + 0x26]
add eax, 3
xor eax, 0x6e
mov word [rsp + 0x2e], ax
movzx eax, word [rsp + 0x26]
add eax, 4
xor eax, 0x65
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x26]
add eax, 5
xor eax, 0x6c
mov word [rsp + 0x32], ax
movzx eax, word [rsp + 0x26]
add eax, 6
xor eax, 0x33
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x26]
add eax, 7
xor eax, 0x32
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x26]
add eax, 8
xor eax, 0x2e
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x26]
add eax, 9
xor eax, 0x64
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x26]
add eax, 0xa
xor eax, 0x6c
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x26]
add eax, 0xb
xor eax, 0x6c
mov word [rsp + 0x3e], ax
mov word [rsp + 0x40], 0
mov ecx, 0x1a
call fcn.1400018f0
xor ecx, ecx
nop word [rax + rax]
movzx edx, word [rsp + rcx*2 + 0x28]
movzx r8d, word [rsp + 0x26]
add r8d, ecx
xor r8w, dx
mov word [rax + rcx*2], r8w
inc rcx
cmp rcx, 0xc
jne 0x140009e70
mov word [rax + 0x18], 0
mov byte [rsp + 0x44], 0x69
movzx ecx, byte [rsp + 0x44]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x140009ec6
cmp r9w, r10w
je 0x140009f13
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [rax + r8]
lea edi, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp di, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x140009ec0
add r8, 2
cmp r9w, r10w
je 0x140009ed0
jmp 0x140009ec0
mov rdx, qword [rcx + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov r8d, 0xe6ff932e
call fcn.140004690
mov edx, dword [rsi + 0x50]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
add rsp, 0x60
pop rbx
pop rdi
pop rsi
jmp rax
Function at 0x140009e35
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov ecx, 1
nop word cs:[rax + rax]
movzx edx, word [rsp + rcx*2 + 0x44]
xor dx, word [rsp + 0x44]
mov word [rax + rcx*2 - 2], dx
inc rcx
cmp rcx, 0xd
jne 0x140009ce0
mov word [rax + 0x18], 0
mov byte [rsp + 0x43], 0x69
movzx ecx, byte [rsp + 0x43]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x140009d26
cmp r9w, r10w
je 0x140009d73
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [rax + r8]
lea ebx, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp bx, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x140009d20
add r8, 2
cmp r9w, r10w
je 0x140009d30
jmp 0x140009d20
mov rdx, qword [rcx + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov r8d, 0x12337fde
call fcn.140004690
mov rcx, rdi
call rax
mov rax, qword [rsi]
mov rsi, qword [rax]
mov word [rsp + 0x26], 0x36ca
movzx eax, word [rsp + 0x26]
xor eax, 0x6b
mov word [rsp + 0x28], ax
movzx eax, word [rsp + 0x26]
inc eax
xor eax, 0x65
mov word [rsp + 0x2a], ax
movzx eax, word [rsp + 0x26]
add eax, 2
xor eax, 0x72
mov word [rsp + 0x2c], ax
movzx eax, word [rsp + 0x26]
add eax, 3
xor eax, 0x6e
mov word [rsp + 0x2e], ax
movzx eax, word [rsp + 0x26]
add eax, 4
xor eax, 0x65
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x26]
add eax, 5
xor eax, 0x6c
mov word [rsp + 0x32], ax
movzx eax, word [rsp + 0x26]
add eax, 6
xor eax, 0x33
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x26]
add eax, 7
xor eax, 0x32
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x26]
add eax, 8
xor eax, 0x2e
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x26]
add eax, 9
xor eax, 0x64
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x26]
add eax, 0xa
xor eax, 0x6c
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x26]
add eax, 0xb
xor eax, 0x6c
mov word [rsp + 0x3e], ax
mov word [rsp + 0x40], 0
mov ecx, 0x1a
call fcn.1400018f0
xor ecx, ecx
nop word [rax + rax]
movzx edx, word [rsp + rcx*2 + 0x28]
movzx r8d, word [rsp + 0x26]
add r8d, ecx
xor r8w, dx
mov word [rax + rcx*2], r8w
inc rcx
cmp rcx, 0xc
jne 0x140009e70
mov word [rax + 0x18], 0
mov byte [rsp + 0x44], 0x69
movzx ecx, byte [rsp + 0x44]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x140009ec6
cmp r9w, r10w
je 0x140009f13
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [rax + r8]
lea edi, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp di, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x140009ec0
add r8, 2
cmp r9w, r10w
je 0x140009ed0
jmp 0x140009ec0
mov rdx, qword [rcx + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov r8d, 0xe6ff932e
call fcn.140004690
mov edx, dword [rsi + 0x50]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
add rsp, 0x60
pop rbx
pop rdi
pop rsi
jmp rax
Function at 0x14000ab60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov word [rsp + 0x46], 0x74
mov word [rsp + 0x48], 0x6e
mov word [rsp + 0x4a], 0x7b
mov word [rsp + 0x4c], 0x77
mov word [rsp + 0x4e], 0x6e
mov word [rsp + 0x50], 0x75
mov word [rsp + 0x52], 0x3c
mov word [rsp + 0x54], 0x3b
mov word [rsp + 0x56], 0x37
mov word [rsp + 0x58], 0x6d
mov word [rsp + 0x5a], 0x75
mov word [rsp + 0x5c], 0x75
mov word [rsp + 0x5e], 0
mov ecx, 0x1a
call fcn.1400018f0
mov rdi, rax
xor eax, eax
nop word cs:[rax + rax]
movzx ecx, word [rsp + rax*2 + 0x46]
add ecx, 0xfffffff7
mov word [rdi + rax*2], cx
inc rax
cmp rax, 0xc
jne 0x14000abe0
mov word [rdi + 0x18], 0
mov word [rsp + 0x2a], 0x62ab
movzx eax, word [rsp + 0x2a]
xor eax, 0x6b
mov word [rsp + 0x2c], ax
movzx eax, word [rsp + 0x2a]
inc eax
xor eax, 0x65
mov word [rsp + 0x2e], ax
movzx eax, word [rsp + 0x2a]
add eax, 2
xor eax, 0x72
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x2a]
add eax, 3
xor eax, 0x6e
mov word [rsp + 0x32], ax
movzx eax, word [rsp + 0x2a]
add eax, 4
xor eax, 0x65
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x2a]
add eax, 5
xor eax, 0x6c
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x2a]
add eax, 6
xor eax, 0x33
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x2a]
add eax, 7
xor eax, 0x32
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x2a]
add eax, 8
xor eax, 0x2e
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x2a]
add eax, 9
xor eax, 0x64
mov word [rsp + 0x3e], ax
movzx eax, word [rsp + 0x2a]
add eax, 0xa
or al, byte [rbx - 0x76999310]
and al, 0x40
movzx eax, word [rsp + 0x2a]
add eax, 0xb
xor eax, 0x6c
mov word [rsp + 0x42], ax
mov word [rsp + 0x44], 0
mov ecx, 0x1a
invalid
invalid
insb byte [rdi], dx
Function at 0x14000aca5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov word [rsp + 0x46], 0x74
mov word [rsp + 0x48], 0x6e
mov word [rsp + 0x4a], 0x7b
mov word [rsp + 0x4c], 0x77
mov word [rsp + 0x4e], 0x6e
mov word [rsp + 0x50], 0x75
mov word [rsp + 0x52], 0x3c
mov word [rsp + 0x54], 0x3b
mov word [rsp + 0x56], 0x37
mov word [rsp + 0x58], 0x6d
mov word [rsp + 0x5a], 0x75
mov word [rsp + 0x5c], 0x75
mov word [rsp + 0x5e], 0
mov ecx, 0x1a
call fcn.1400018f0
mov rdi, rax
xor eax, eax
nop word cs:[rax + rax]
movzx ecx, word [rsp + rax*2 + 0x46]
add ecx, 0xfffffff7
mov word [rdi + rax*2], cx
inc rax
cmp rax, 0xc
jne 0x14000abe0
mov word [rdi + 0x18], 0
mov word [rsp + 0x2a], 0x62ab
movzx eax, word [rsp + 0x2a]
xor eax, 0x6b
mov word [rsp + 0x2c], ax
movzx eax, word [rsp + 0x2a]
inc eax
xor eax, 0x65
mov word [rsp + 0x2e], ax
movzx eax, word [rsp + 0x2a]
add eax, 2
xor eax, 0x72
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x2a]
add eax, 3
xor eax, 0x6e
mov word [rsp + 0x32], ax
movzx eax, word [rsp + 0x2a]
add eax, 4
xor eax, 0x65
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x2a]
add eax, 5
xor eax, 0x6c
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x2a]
add eax, 6
xor eax, 0x33
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x2a]
add eax, 7
xor eax, 0x32
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x2a]
add eax, 8
xor eax, 0x2e
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x2a]
add eax, 9
xor eax, 0x64
mov word [rsp + 0x3e], ax
movzx eax, word [rsp + 0x2a]
add eax, 0xa
or al, byte [rbx - 0x76999310]
and al, 0x40
movzx eax, word [rsp + 0x2a]
add eax, 0xb
xor eax, 0x6c
mov word [rsp + 0x42], ax
mov word [rsp + 0x44], 0
mov ecx, 0x1a
invalid
invalid
insb byte [rdi], dx

Function at 0x14000acf5
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
or al, byte [rbx - 0x76999310]
and al, 0x40
movzx edx, word [rsp + rcx*2 + 0x2c]
movzx r8d, word [rsp + 0x2a]
add r8d, ecx
xor r8w, dx
mov word [rax + rcx*2], r8w
inc rcx
cmp rcx, 0xc
jne 0x14000ace0
mov word [rax + 0x18], 0
mov byte [rsp + 0x29], 0x69
movzx ecx, byte [rsp + 0x29]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
Function at 0x14000ad9f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x14000ad36
cmp r9w, r10w
je 0x14000ad83
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [rax + r8]
lea ebx, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp bx, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x14000ad30
add r8, 2
cmp r9w, r10w
je 0x14000ad40
jmp 0x14000ad30
mov rdx, qword [rcx + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov r8d, 0x12337fde
call fcn.140004690
mov rcx, rdi
call rax
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov rsi, qword [rcx]
mov rdi, qword [rax]
mov word [rsp + 0x2a], 0x75
mov word [rsp + 0x2c], 0x6f
mov word [rsp + 0x2e], 0x7c
mov word [rsp + 0x30], pe_nt_image_headers64
add byte [rsi - 0x39], ah
and al, 0x32
outsd dx, dword [rsi]
add byte [rsi - 0x39], ah
and al, 0x34
jbe 0x14000add5
mov word [rsp + 0x36], 0x3d
mov word [rsp + 0x38], 0x3c
mov word [rsp + 0x3a], 0x38
mov word [rsp + 0x3c], 0x6e
mov word [rsp + 0x3e], 0x76