joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ac18
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x710031
mov dword [rbp - 0x2c], 0x7c0061
mov dword [rbp - 0x28], 0x600064
mov dword [rbp - 0x24], 0x610076
lea ecx, [rbx + 0x15]
mov dword [rbp - 0x20], 0x7b004c
mov dword [rbp - 0x1c], 0x60007a
mov dword [rbp - 0x18], 0x7c0067
mov dword [rbp - 0x14], 0x6a0061
mov dword [rbp - 0x10], 0x290031
mov dword [rbp - 0xc], 0x130068
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 1]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ac86
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000aca8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x50], 0x5c004f
mov dword [rbp - 0x4c], 0x760063
mov dword [rbp - 0x48], 0x720061
mov dword [rbp - 0x44], 0x400033
lea ecx, [rbx + 0x37]
mov dword [rbp - 0x40], 0x75007c
mov dword [rbp - 0x3c], 0x640067
mov dword [rbp - 0x38], 0x610072
mov dword [rbp - 0x34], 0x4f0076
mov dword [rbp - 0x30], 0x63005c
mov dword [rbp - 0x2c], 0x610076
mov dword [rbp - 0x28], 0x330072
mov dword [rbp - 0x24], 0x670040
mov dword [rbp - 0x20], 0x710072
mov dword [rbp - 0x1c], 0x76007f
mov dword [rbp - 0x18], 0x5b004f
mov dword [rbp - 0x14], 0x60007a
mov dword [rbp - 0x10], 0x7c0067
mov dword [rbp - 0xc], 0x6a0061
mov word [rbp - 8], bx
call fcn.14000257c
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0x12]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ad60
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14000ad90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x40], 0x54004f
mov dword [rbp - 0x3c], 0x7c007c
mov dword [rbp - 0x38], 0x7f0074
mov dword [rbp - 0x34], 0x4f0076
lea ecx, [rbx + 0x21]
mov dword [rbp - 0x30], 0x7b0050
mov dword [rbp - 0x2c], 0x7c0061
mov dword [rbp - 0x28], 0x76007e
mov dword [rbp - 0x24], 0x46004f
mov dword [rbp - 0x20], 0x760060
mov dword [rbp - 0x1c], 0x330061
mov dword [rbp - 0x18], 0x720057
mov dword [rbp - 0x14], 0x720067
mov dword [rbp - 0x10], 0x13004f
call fcn.14000257c
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 7]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ae13
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x14000ae34
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x560031
mov dword [rbp - 0x2c], 0x740077
mov dword [rbp - 0x28], 0x500076
mov dword [rbp - 0x24], 0x61007b
lea ecx, [rbx + 0xf]
mov dword [rbp - 0x20], 0x7e007c
mov dword [rbp - 0x1c], 0x66007a
mov dword [rbp - 0x18], 0x31007e
mov dword [rbp - 0x14], 0x480029
mov word [rbp - 0x10], bx
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ae98
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000aeb8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x40], 0x5e004f
mov dword [rbp - 0x3c], 0x70007a
mov dword [rbp - 0x38], 0x7c0061
mov dword [rbp - 0x34], 0x7c0060
lea ecx, [rbx + 0x25]
mov dword [rbp - 0x30], 0x670075
mov dword [rbp - 0x2c], 0x4f004f
mov dword [rbp - 0x28], 0x770056
mov dword [rbp - 0x24], 0x760074
mov dword [rbp - 0x20], 0x46004f
mov dword [rbp - 0x1c], 0x760060
mov dword [rbp - 0x18], 0x330061
mov dword [rbp - 0x14], 0x720057
mov dword [rbp - 0x10], 0x720067
mov dword [rbp - 0xc], 0x13004f
call fcn.14000257c
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 9]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000af42
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000b0a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14001081c
lea rcx, [rbp + 0x18]
call fcn.14000ad90
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.140012ae0
test eax, eax
jne 0x14000b1a6
lea edi, [rax + 0x13]
mov dword [rbp - 0x30], 0x500031
lea ecx, [rax + 0x16]
mov word [rbp - 0x1c], di
mov dword [rbp - 0x2c], 0x61007b
mov dword [rbp - 0x28], 0x7e007c
mov dword [rbp - 0x24], 0x310076
mov dword [rbp - 0x20], 0x480029
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 8]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b11b
mov rdx, rax
mov rcx, rbx
call fcn.140001970
mov edi, 0x10
jmp 0x14000b176
lea rdx, str._url_:_
call fcn.140001970
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.1400019fc
mov rcx, qword [rbp - 0x40]
call fcn.140002480
mov r8d, dword [rbp - 0x38]
lea rdx, str.___ts_:_lu_
mov rcx, rbx
call fcn.140001a50
mov r8, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.140010854
mov rcx, rbx
test eax, eax
je 0x14000b142
mov edx, 0x2c
call fcn.140001a9c
lea rdx, [0x140014e3c]
mov rcx, rbx
call fcn.140001970
lea rcx, [rbp - 0x18]
call fcn.140010810
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14000b1c4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14001081c
lea rcx, [rbp + 0x18]
call fcn.14000aa04
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.140012c90
test eax, eax
jne 0x14000b2cd
lea ecx, [rax + 0x18]
mov dword [rbp - 0x30], 0x550031
mov dword [rbp - 0x2c], 0x61007a
lea edi, [rax + 0x13]
mov dword [rbp - 0x28], 0x750076
mov dword [rbp - 0x24], 0x6b007c
mov dword [rbp - 0x20], 0x290031
mov dword [rbp - 0x1c], 0x130048
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 7]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b242
mov rdx, rax
mov rcx, rbx
call fcn.140001970
mov edi, 0x10
jmp 0x14000b29d
lea rdx, str._url_:_
call fcn.140001970
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.1400019fc
mov rcx, qword [rbp - 0x40]
call fcn.140002480
mov r8d, dword [rbp - 0x38]
lea rdx, str.___ts_:_lu_
mov rcx, rbx
call fcn.140001a50
mov r8, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.140010854
mov rcx, rbx
test eax, eax
je 0x14000b269
mov edx, 0x2c
call fcn.140001a9c
lea rdx, [0x140014e3c]
mov rcx, rbx
call fcn.140001970
lea rcx, [rbp - 0x18]
call fcn.140010810
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14000b3a8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14001081c
lea rcx, [rbp + 0x18]
call fcn.14000aca8
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.140012f38
test eax, eax
jne 0x14000b4aa
lea ecx, [rax + 0x14]
mov dword [rbp - 0x30], 0x7c0031
mov dword [rbp - 0x2c], 0x760063
lea edi, [rax + 0x13]
mov dword [rbp - 0x28], 0x720061
mov dword [rbp - 0x24], 0x290031
mov dword [rbp - 0x20], 0x130048
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 9]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b41f
mov rdx, rax
mov rcx, rbx
call fcn.140001970
mov edi, 0x10
jmp 0x14000b47a
lea rdx, str._url_:_
call fcn.140001970
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.1400019fc
mov rcx, qword [rbp - 0x40]
call fcn.140002480
mov r8d, dword [rbp - 0x38]
lea rdx, str.___ts_:_lu_
mov rcx, rbx
call fcn.140001a50
mov r8, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.140010854
mov rcx, rbx
test eax, eax
je 0x14000b446
mov edx, 0x2c
call fcn.140001a9c
lea rdx, [0x140014e3c]
mov rcx, rbx
call fcn.140001970
lea rcx, [rbp - 0x18]
call fcn.140010810
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14000b4c8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14001081c
lea rcx, [rbp + 0x18]
call fcn.14000ab24
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.140012f38
test eax, eax
jne 0x14000b5d1
lea ecx, [rax + 0x18]
mov dword [rbp - 0x30], 0x7c0031
mov dword [rbp - 0x2c], 0x760063
lea edi, [rax + 0x13]
mov dword [rbp - 0x28], 0x720061
mov dword [rbp - 0x24], 0x4b0054
mov dword [rbp - 0x20], 0x290031
mov dword [rbp - 0x1c], 0x130048
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 7]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b546
mov rdx, rax
mov rcx, rbx
call fcn.140001970
mov edi, 0x10
jmp 0x14000b5a1
lea rdx, str._url_:_
call fcn.140001970
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.1400019fc
mov rcx, qword [rbp - 0x40]
call fcn.140002480
mov r8d, dword [rbp - 0x38]
lea rdx, str.___ts_:_lu_
mov rcx, rbx
call fcn.140001a50
mov r8, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.140010854
mov rcx, rbx
test eax, eax
je 0x14000b56d
mov edx, 0x2c
call fcn.140001a9c
lea rdx, [0x1400146b0]
mov rcx, rbx
call fcn.140001970
lea rcx, [rbp - 0x18]
call fcn.140010810
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14000b5f0
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x168]
sub rsp, 0x260
mov rsi, r9
mov dword [rsp + 0x40], 0xff
mov r14, r8
lea rax, [rsp + 0x48]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000b6d3
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], rbx
lea r8, [rsp + 0x60]
and qword [rsp + 0x28], rbx
xor edx, edx
and qword [rsp + 0x20], rbx
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000b6c8
lea ebx, [rdi + 1]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call r14
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x60]
and qword [rsp + 0x28], 0
add edi, ebx
and qword [rsp + 0x20], 0
mov edx, edi
mov dword [rsp + 0x40], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14000b67c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x260]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000b6f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x50
lea rax, [r11 - 0x18]
xor ebx, ebx
mov qword [r11 - 0x28], rax
mov rdi, r9
lea rax, [r11 - 0x14]
mov qword [r11 - 0x30], rbx
mov rsi, r8
mov qword [r11 - 0x38], rax
lea r9d, [rbx + 2]
mov rbp, rdx
mov r14, rcx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000b789
mov ecx, dword [rsp + 0x40]
lea edx, [rbx + 1]
call fcn.140002454
lea rcx, [rsp + 0x40]
mov qword [rdi], rax
mov qword [rsp + 0x30], rcx
lea r9d, [rbx + 2]
mov qword [rsp + 0x28], rax
mov r8, rsi
lea rax, [rsp + 0x44]
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000b781
lea ebx, [rax + 1]
jmp 0x14000b789
mov rcx, qword [rdi]
call fcn.140002480
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x14000b964
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x60], 0x660043
mov dword [rbp - 0x5c], 0x60007f
mov dword [rbp - 0x58], 0x330076
mov dword [rbp - 0x54], 0x760040
lea ecx, [rbx + 0x43]
mov dword [rbp - 0x50], 0x660070
mov dword [rbp - 0x4c], 0x760061
mov dword [rbp - 0x48], 0x50004f
mov dword [rbp - 0x44], 0x7d007c
mov dword [rbp - 0x40], 0x76007d
mov dword [rbp - 0x3c], 0x670070
mov dword [rbp - 0x38], 0x7c007a
mov dword [rbp - 0x34], 0x40007d
mov dword [rbp - 0x30], 0x7c0067
mov dword [rbp - 0x2c], 0x760061
mov dword [rbp - 0x28], 0x70004f
mov dword [rbp - 0x24], 0x7d007c
mov dword [rbp - 0x20], 0x60007d
mov dword [rbp - 0x1c], 0x7c0067
mov dword [rbp - 0x18], 0x760061
mov dword [rbp - 0x14], 0x77003d
mov dword [rbp - 0x10], 0x670072
mov word [rbp - 0xc], bx
call fcn.14000257c
lea r9, [rbp - 0x60]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0x18]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ba30
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14000ba60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x610031
mov dword [rbp - 0x2c], 0x630077
mov dword [rbp - 0x28], 0x290031
mov dword [rbp - 0x24], 0x310068
lea ecx, [rbx + 0x13]
mov dword [rbp - 0x20], 0x760060
mov dword [rbp - 0x1c], 0x650061
mov dword [rbp - 0x18], 0x610076
mov dword [rbp - 0x14], 0x310060
mov dword [rbp - 0x10], 0x480029
mov word [rbp - 0xc], bx
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, ebx
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000baca
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000baec
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x700031
mov dword [rbp - 0x2c], 0x7d007c
mov dword [rbp - 0x28], 0x60007d
mov dword [rbp - 0x24], 0x7c0067
lea ecx, [rbx + 0x13]
mov dword [rbp - 0x20], 0x760061
mov dword [rbp - 0x1c], 0x77003d
mov dword [rbp - 0x18], 0x670072
mov dword [rbp - 0x14], 0x290031
mov dword [rbp - 0x10], 0x310033
mov word [rbp - 0xc], bx
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, ebx
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bb56
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000bb78
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x750031
mov dword [rbp - 0x2c], 0x61007c
mov dword [rbp - 0x28], 0x7a0067
mov dword [rbp - 0x24], 0x76007d
lea ecx, [rbx + 0x1d]
mov dword [rbp - 0x20], 0x310067
mov dword [rbp - 0x1c], 0x680029
mov dword [rbp - 0x18], 0x670031
mov dword [rbp - 0x14], 0x7d0066
mov dword [rbp - 0x10], 0x76007d
mov dword [rbp - 0xc], 0x60007f
mov dword [rbp - 8], 0x290031
mov dword [rbp - 4], 0x130048
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 5]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bbf4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000bc14
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov ecx, 0x7c
mov dword [rbp - 0x49], 0x7a0050
mov dword [rbp - 0x45], 0x700060
mov dword [rbp - 0x41], 0x4f007c
mov dword [rbp - 0x3d], 0x7a0050
lea ebx, [rcx - 0x69]
mov dword [rbp - 0x39], 0x700060
mov dword [rbp - 0x35], 0x33007c
mov dword [rbp - 0x31], 0x7d0052
mov dword [rbp - 0x2d], 0x50006a
mov dword [rbp - 0x29], 0x7d007c
mov dword [rbp - 0x25], 0x76007d
mov dword [rbp - 0x21], 0x670070
mov dword [rbp - 0x1d], 0x400033
mov dword [rbp - 0x19], 0x700076
mov dword [rbp - 0x15], 0x610066
mov dword [rbp - 0x11], 0x330076
mov dword [rbp - 0xd], 0x7c005e
mov dword [rbp - 9], 0x7a0071
mov dword [rbp - 5], 0x7a007f
mov dword [rbp - 1], 0x6a0067
mov dword [rbp + 3], 0x500033
mov dword [rbp + 7], 0x7a007f
mov dword [rbp + 0xb], 0x7d0076
mov dword [rbp + 0xf], 0x4f0067
mov dword [rbp + 0x13], 0x610063
mov dword [rbp + 0x17], 0x750076
mov dword [rbp + 0x1b], 0x610076
mov dword [rbp + 0x1f], 0x7d0076
mov dword [rbp + 0x23], 0x760070
mov dword [rbp + 0x27], 0x3d0060
mov dword [rbp + 0x2b], 0x7e006b
mov dword [rbp + 0x2f], 0x13007f
call fcn.14000257c
lea r9, [rbp - 0x49]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0x2b]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bd2b
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret

Function at 0x14000bd64
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x630031
mov dword [rbp - 0x1c], 0x7f0066
mov dword [rbp - 0x18], 0x760060
mov dword [rbp - 0x14], 0x760060
lea ecx, [rbx + 0xd]
mov dword [rbp - 0x10], 0x660070
mov dword [rbp - 0xc], 0x760061
mov dword [rbp - 8], 0x290031
mov dword [rbp - 4], 0x130068
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bdc4
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000bde4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x610031
mov dword [rbp - 0x2c], 0x740076
mov dword [rbp - 0x28], 0x60007a
mov dword [rbp - 0x24], 0x610067
lea ecx, [rbx + 0x19]
mov dword [rbp - 0x20], 0x4c006a
mov dword [rbp - 0x1c], 0x610063
mov dword [rbp - 0x18], 0x75007c
mov dword [rbp - 0x14], 0x7f007a
mov dword [rbp - 0x10], 0x600076
mov dword [rbp - 0xc], 0x290031
mov dword [rbp - 8], 0x130048
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000be59
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000be7c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x40], 0x700031
mov dword [rbp - 0x3c], 0x60007a
mov dword [rbp - 0x38], 0x7c0070
mov dword [rbp - 0x34], 0x290031
lea ecx, [rbx + 0x2b]
mov dword [rbp - 0x30], 0x330068
mov dword [rbp - 0x2c], 0x630031
mov dword [rbp - 0x28], 0x760061
mov dword [rbp - 0x24], 0x760075
mov dword [rbp - 0x20], 0x760061
mov dword [rbp - 0x1c], 0x70007d
mov dword [rbp - 0x18], 0x600076
mov dword [rbp - 0x14], 0x6b003d
mov dword [rbp - 0x10], 0x7f007e
mov dword [rbp - 0xc], 0x290031
mov dword [rbp - 8], 0x680033
mov word [rbp - 4], bx
call fcn.14000257c
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xc]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bf16
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret

Function at 0x14000bf3c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x40], 0x600031
mov dword [rbp - 0x3c], 0x7d007c
mov dword [rbp - 0x38], 0x70007a
mov dword [rbp - 0x34], 0x720064
lea ecx, [rbx + 0x29]
mov dword [rbp - 0x30], 0x7f007f
mov dword [rbp - 0x2c], 0x290031
mov dword [rbp - 0x28], 0x310068
mov dword [rbp - 0x24], 0x7e0070
mov dword [rbp - 0x20], 0x4c0077
mov dword [rbp - 0x1c], 0x610063
mov dword [rbp - 0x18], 0x75007c
mov dword [rbp - 0x14], 0x7f007a
mov dword [rbp - 0x10], 0x600076
mov dword [rbp - 0xc], 0x290031
mov dword [rbp - 8], 0x130048
call fcn.14000257c
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xb]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bfcd
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x14000bff0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x20], 0x770033
mov dword [rbp - 0x1c], 0x60007a
mov dword [rbp - 0x18], 0x7f0063
mov dword [rbp - 0x14], 0x6a0072
lea ecx, [rbx + 0xd]
mov dword [rbp - 0x10], 0x610063
mov dword [rbp - 0xc], 0x75007c
mov dword [rbp - 8], 0x7f007a
mov dword [rbp - 4], 0x130076
call fcn.14000257c
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c050
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000cc10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, SafeArrayUnaccessData
mov dword [rbp - 0x30], 0x710031
mov dword [rbp - 0x2c], 0x7c0061
mov dword [rbp - 0x28], 0x600064
mov dword [rbp - 0x24], 0x610076
lea ecx, [rbx + 0x19]
mov dword [rbp - 0x20], 0x71004c
mov dword [rbp - 0x1c], 0x7c007c
mov dword [rbp - 0x18], 0x7e0078
mov dword [rbp - 0x14], 0x610072
mov dword [rbp - 0x10], 0x600078
mov dword [rbp - 0xc], 0x290031
mov dword [rbp - 8], 0x130068
call fcn.14000257c
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000cc85
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret