joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a970
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x7083708d
mov dword [rbp - 0x1c], 0x70f570e0
mov ebx, 0x70a1
mov dword [rbp - 0x18], 0x708370f3
mov dword [rbp - 0x14], 0x7081709b
mov dword [rbp - 0x10], 0x70a17083
mov dword [rbp - 0xc], 0x8dc670a1
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000a9c6
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000a9e8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x70d6
mov dword [rbp - 0x50], 0x70f470fa
mov ecx, 0x3e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x4c], 0x70b370bb
mov dword [rbp - 0x48], 0x70be70a2
mov dword [rbp - 0x44], 0x70b270b9
mov dword [rbp - 0x40], 0x70ec70f4
mov dword [rbp - 0x3c], 0x70f470f6
mov dword [rbp - 0x38], 0x70957085
mov dword [rbp - 0x34], 0x70a470b7
mov dword [rbp - 0x30], 0x709a70b2
mov dword [rbp - 0x2c], 0x70a570bf
mov dword [rbp - 0x28], 0x708470a2
mov dword [rbp - 0x24], 0x70b770b3
mov dword [rbp - 0x20], 0x70b370b2
mov dword [rbp - 0x1c], 0x70a570a4
mov dword [rbp - 0x18], 0x70f47081
mov dword [rbp - 0x10], 0x8dc670d6
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x1f
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000aa87
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x14000aaac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70ef
mov dword [rbp - 0x20], 0x70cd70c3
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x709d708a
mov dword [rbp - 0x18], 0x7080709d
mov dword [rbp - 0x14], 0x70cd709d
mov dword [rbp - 0x10], 0x70cf70d5
mov dword [rbp - 8], 0x8dc670ef
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ab05
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000ab24
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x70fb70aa
mov dword [rbp - 0x2c], 0x70e970e5
mov ebx, 0x7088
mov dword [rbp - 0x28], 0x70fc70fa
mov dword [rbp - 0x24], 0x70eb70d7
mov dword [rbp - 0x20], 0x70fa70e9
mov dword [rbp - 0x1c], 0x70fb70ec
mov dword [rbp - 0x18], 0x70b270aa
mov dword [rbp - 0x14], 0x708870f3
mov dword [rbp - 0x10], 0x8dc67088
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ab8f
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000abb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x70f670ba
mov dword [rbp - 0x1c], 0x70f570f9
mov ebx, 0x7098
mov dword [rbp - 0x18], 0x70ba70fd
mov dword [rbp - 0x14], 0x70b870a2
mov dword [rbp - 0x10], 0x709870ba
mov dword [rbp - 0xc], 0x8dc67098
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ac06
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000ac28
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x708e7080
mov dword [rbp - 0x1c], 0x70cd70cf
mov ebx, 0x70ac
mov dword [rbp - 0x18], 0x70c870de
mov dword [rbp - 0x14], 0x708e70df
mov dword [rbp - 0x10], 0x708c7096
mov dword [rbp - 0xc], 0x70ac70f7
mov dword [rbp - 8], 0x8dc670ac
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ac85
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000aca4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x1c
mov dword [rbp - 0x20], 0x70b470ba
mov dword [rbp - 0x1c], 0x70f370e4
mov ebx, 0x7096
mov dword [rbp - 0x18], 0x70f270f7
mov dword [rbp - 0x14], 0x70e470f3
mov dword [rbp - 0x10], 0x70b470e5
mov dword [rbp - 0xc], 0x70b670ac
mov dword [rbp - 8], 0x709670cd
mov dword [rbp - 4], 0x8dc67096
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xe
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ad08
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000ad28
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70df
mov dword [rbp - 0x20], 0x70bc70fd
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x70ad70be
mov dword [rbp - 0x18], 0x70ac70bb
mov dword [rbp - 0x14], 0x70e570fd
mov dword [rbp - 0x10], 0x708470ff
mov dword [rbp - 8], 0x8dc670df
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ad81
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000ada0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x70e170ef
mov dword [rbp - 0x1c], 0x70a270a0
mov ebx, 0x70c3
mov dword [rbp - 0x18], 0x70a770b1
mov dword [rbp - 0x14], 0x70e170b0
mov dword [rbp - 0x10], 0x70e370f9
mov dword [rbp - 0xc], 0x70c37098
mov dword [rbp - 8], 0x8dc670c3
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000adfd
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000ae1c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70f1
mov dword [rbp - 0x20], 0x70d370dd
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x70837094
mov dword [rbp - 0x18], 0x709e7083
mov dword [rbp - 0x14], 0x70d37083
mov dword [rbp - 0x10], 0x70d170cb
mov dword [rbp - 8], 0x8dc670f1
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ae75
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000ae94
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x70bf
mov dword [rbp - 0x40], 0x709d7093
mov ecx, 0x3a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x3c], 0x70da70d2
mov dword [rbp - 0x38], 0x70d770cb
mov dword [rbp - 0x34], 0x70db70d0
mov dword [rbp - 0x30], 0x7085709d
mov dword [rbp - 0x2c], 0x709d709f
mov dword [rbp - 0x28], 0x70fc70ec
mov dword [rbp - 0x24], 0x70cd70de
mov dword [rbp - 0x20], 0x70f370db
mov dword [rbp - 0x1c], 0x70cc70d6
mov dword [rbp - 0x18], 0x70fc70cb
mov dword [rbp - 0x14], 0x70cd70de
mov dword [rbp - 0x10], 0x70cc70db
mov dword [rbp - 0xc], 0x709d70e8
mov dword [rbp - 4], 0x8dc670bf
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1d
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000af2c
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000af4c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x70f770f9
mov dword [rbp - 0x2c], 0x70bb70bc
mov ebx, 0x70d5
mov dword [rbp - 0x28], 0x70a770a1
mov dword [rbp - 0x24], 0x70b170ba
mov dword [rbp - 0x20], 0x70b670a0
mov dword [rbp - 0x1c], 0x70b170b0
mov dword [rbp - 0x18], 0x70ef70f7
mov dword [rbp - 0x14], 0x70d570ae
mov dword [rbp - 0x10], 0x8dc670d5
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000afb7
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000afd8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x38
mov dword [rbp - 0x40], 0x708370cc
mov dword [rbp - 0x3c], 0x709a708b
mov ebx, 0x70ee
mov dword [rbp - 0x38], 0x70817086
mov dword [rbp - 0x34], 0x70cc708a
mov dword [rbp - 0x30], 0x70ce70d4
mov dword [rbp - 0x2c], 0x70bd70cc
mov dword [rbp - 0x28], 0x708f70ad
mov dword [rbp - 0x24], 0x708a709c
mov dword [rbp - 0x20], 0x708770a2
mov dword [rbp - 0x1c], 0x709a709d
mov dword [rbp - 0x18], 0x708f70ad
mov dword [rbp - 0x14], 0x708a709c
mov dword [rbp - 0x10], 0x70b9709d
mov dword [rbp - 0xc], 0x70ee70cc
mov dword [rbp - 8], 0x8dc670ee
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1c
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b06d
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000b08c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70c4
mov dword [rbp - 0x20], 0x70e670e8
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x70b670a1
mov dword [rbp - 0x18], 0x70ab70b6
mov dword [rbp - 0x14], 0x70e670b6
mov dword [rbp - 0x10], 0x70e470fe
mov dword [rbp - 8], 0x8dc670c4
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b0e5
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000b104
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70a0
mov dword [rbp - 0x20], 0x7082708c
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x70d470d3
mov dword [rbp - 0x18], 0x70d470c1
mov dword [rbp - 0x14], 0x708270c5
mov dword [rbp - 0x10], 0x7080709a
mov dword [rbp - 0xc], 0x70c47085
mov dword [rbp - 4], 0x8dc670a0
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b164
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000b184
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70bc
mov dword [rbp - 0x20], 0x709e7090
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x70ce70d9
mov dword [rbp - 0x18], 0x70d370ce
mov dword [rbp - 0x14], 0x709e70ce
mov dword [rbp - 0x10], 0x709c7086
mov dword [rbp - 8], 0x8dc670bc
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b1dd
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000b1fc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70d7
mov dword [rbp - 0x20], 0x70f570fb
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x70a570b2
mov dword [rbp - 0x18], 0x70b870a5
mov dword [rbp - 0x14], 0x70f570a5
mov dword [rbp - 0x10], 0x70f770ed
mov dword [rbp - 8], 0x8dc670d7
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b255
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000b274
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x70f0
mov dword [rbp - 0x50], 0x70d270dc
mov ecx, 0x46
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x4c], 0x7095709d
mov dword [rbp - 0x48], 0x70987084
mov dword [rbp - 0x44], 0x7094709f
mov dword [rbp - 0x40], 0x70ca70d2
mov dword [rbp - 0x3c], 0x70d270d0
mov dword [rbp - 0x38], 0x70b370a3
mov dword [rbp - 0x34], 0x70827091
mov dword [rbp - 0x30], 0x70b57094
mov dword [rbp - 0x2c], 0x70847083
mov dword [rbp - 0x28], 0x70927091
mov dword [rbp - 0x24], 0x7099709c
mov dword [rbp - 0x20], 0x70987083
mov dword [rbp - 0x1c], 0x709f70b3
mov dword [rbp - 0x18], 0x7084709e
mov dword [rbp - 0x14], 0x70887095
mov dword [rbp - 0x10], 0x70d27084
mov dword [rbp - 8], 0x8dc670f0
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x23
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b326
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14000b34c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x70c7
mov dword [rbp - 0x50], 0x70e570eb
mov ecx, 0x46
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x4c], 0x70a270aa
mov dword [rbp - 0x48], 0x70af70b3
mov dword [rbp - 0x44], 0x70a370a8
mov dword [rbp - 0x40], 0x70fd70e5
mov dword [rbp - 0x3c], 0x70e570e7
mov dword [rbp - 0x38], 0x70847094
mov dword [rbp - 0x34], 0x70b570a6
mov dword [rbp - 0x30], 0x708070a3
mov dword [rbp - 0x2c], 0x70b370a2
mov dword [rbp - 0x28], 0x70b37094
mov dword [rbp - 0x24], 0x70b370a6
mov dword [rbp - 0x20], 0x70b470b2
mov dword [rbp - 0x1c], 0x70af7084
mov dword [rbp - 0x18], 0x70a970a6
mov dword [rbp - 0x14], 0x70a270a0
mov dword [rbp - 0x10], 0x70e57090
mov dword [rbp - 8], 0x8dc670c7
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x23
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b3fe
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14000b8e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x7096
mov dword [rbp - 0x20], 0x70ba70b4
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x70e270b4
mov dword [rbp - 0x18], 0x70b470e5
mov dword [rbp - 0x14], 0x70b370ac
mov dword [rbp - 0x10], 0x70e370fa
mov dword [rbp - 0xc], 0x70ba70eb
mov dword [rbp - 4], 0x8dc67096
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b940
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000b960
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x70a2
mov dword [rbp - 0x40], 0x70ef70fe
mov ecx, 0x36
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x3c], 0x70d870cd
mov dword [rbp - 0x38], 0x70ce70cb
mov dword [rbp - 0x34], 0x70c370ce
mov dword [rbp - 0x30], 0x70e470fe
mov dword [rbp - 0x2c], 0x70d070cb
mov dword [rbp - 0x28], 0x70c470c7
mov dword [rbp - 0x24], 0x70da70cd
mov dword [rbp - 0x20], 0x70f270fe
mov dword [rbp - 0x1c], 0x70cd70d0
mov dword [rbp - 0x18], 0x70cb70c4
mov dword [rbp - 0x14], 0x70c770ce
mov dword [rbp - 0x10], 0x70fe70d1
mov dword [rbp - 8], 0x8dc670a2
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1b
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b9f1
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000ba10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x34
mov dword [rbp - 0x40], 0x70ce70d5
mov dword [rbp - 0x3c], 0x70e670e6
mov ebx, 0x7089
mov dword [rbp - 0x38], 0x70e570ee
mov dword [rbp - 0x34], 0x70d570ec
mov dword [rbp - 0x30], 0x70e170ca
mov dword [rbp - 0x2c], 0x70e670fb
mov dword [rbp - 0x28], 0x70ec70e4
mov dword [rbp - 0x24], 0x70dc70d5
mov dword [rbp - 0x20], 0x70ec70fa
mov dword [rbp - 0x1c], 0x70a970fb
mov dword [rbp - 0x18], 0x70e870cd
mov dword [rbp - 0x14], 0x70e870fd
mov dword [rbp - 0x10], 0x708970d5
mov dword [rbp - 0xc], 0x8dc67089
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1a
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ba9e
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000bac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x709570d8
mov dword [rbp - 0x1c], 0x709f708a
mov ebx, 0x70fa
mov dword [rbp - 0x18], 0x709b7088
mov dword [rbp - 0x14], 0x70a270bd
mov dword [rbp - 0x10], 0x70c070d8
mov dword [rbp - 0xc], 0x70fa70a1
mov dword [rbp - 8], 0x8dc670fa
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bb1d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000bb3c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x7002
mov dword [rbp - 0x20], 0x702e7020
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x70767020
mov dword [rbp - 0x18], 0x70207071
mov dword [rbp - 0x14], 0x70277038
mov dword [rbp - 0x10], 0x7077706e
mov dword [rbp - 0xc], 0x702e707f
mov dword [rbp - 4], 0x8dc67002
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bb9c
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000bbbc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov ecx, 0x50
mov dword [rbp - 0x60], 0x70ba70a9
mov dword [rbp - 0x5c], 0x70907085
mov ebx, 0x70f5
mov dword [rbp - 0x58], 0x70947087
mov dword [rbp - 0x54], 0x70a670d5
mov dword [rbp - 0x50], 0x7093709a
mov dword [rbp - 0x4c], 0x70827081
mov dword [rbp - 0x48], 0x70877094
mov dword [rbp - 0x44], 0x70a97090
mov dword [rbp - 0x40], 0x708570ba
mov dword [rbp - 0x3c], 0x70877090
mov dword [rbp - 0x38], 0x70d57094
mov dword [rbp - 0x34], 0x70ad70b2
mov dword [rbp - 0x30], 0x70a670d5
mov dword [rbp - 0x2c], 0x70947081
mov dword [rbp - 0x28], 0x70997097
mov dword [rbp - 0x24], 0x70a97090
mov dword [rbp - 0x20], 0x709c70bd
mov dword [rbp - 0x1c], 0x70817086
mov dword [rbp - 0x18], 0x7087709a
mov dword [rbp - 0x14], 0x70f5708c
mov dword [rbp - 0x10], 0x8dc670f5
call fcn.1400026b0
lea r9, [rbp - 0x60]
mov rdx, rax
sub r9, rax
mov r8d, 0x28
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bc8c
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14000bcc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70b4
mov dword [rbp - 0x20], 0x70dd7096
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x70cc70d1
mov dword [rbp - 0x18], 0x70d870c4
mov dword [rbp - 0x14], 0x70c670db
mov dword [rbp - 0x10], 0x709670d1
mov dword [rbp - 0xc], 0x70ef708e
mov dword [rbp - 4], 0x8dc670b4
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bd20
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000bd40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70e8
mov dword [rbp - 0x20], 0x70c470ca
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x709c70ca
mov dword [rbp - 0x18], 0x70ca709b
mov dword [rbp - 0x14], 0x70cd70d2
mov dword [rbp - 0x10], 0x709d7084
mov dword [rbp - 0xc], 0x70c47095
mov dword [rbp - 4], 0x8dc670e8
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bda0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000bdc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x708f70c2
mov dword [rbp - 0x1c], 0x70857090
mov ebx, 0x70e0
mov dword [rbp - 0x18], 0x70817092
mov dword [rbp - 0x14], 0x70da70c2
mov dword [rbp - 0x10], 0x70e070bb
mov dword [rbp - 0xc], 0x8dc670e0
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000be16
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000be38
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70d6
mov dword [rbp - 0x20], 0x70fa70f4
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x70a270f4
mov dword [rbp - 0x18], 0x70f470a5
mov dword [rbp - 0x14], 0x70f370ec
mov dword [rbp - 0x10], 0x70a370ba
mov dword [rbp - 0xc], 0x70fa70ab
mov dword [rbp - 4], 0x8dc670d6
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000be98
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000beb8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x70e57081
mov dword [rbp - 0x1c], 0x70d170ca
mov ebx, 0x70a3
mov dword [rbp - 0x18], 0x70c570c6
mov dword [rbp - 0x14], 0x70db70cc
mov dword [rbp - 0x10], 0x70997081
mov dword [rbp - 0xc], 0x70a370f8
mov dword [rbp - 8], 0x8dc670a3
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bf15
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret