joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003f90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Gprs_tflickrjp_tlawyers_tdefine_tbookings_tbiweeklypmtcalc_tarticle_tzipcode_toldweb_tparts_tpiter_trelationship_tsustainability_tnoframes_tincludetop_twpicludes_timports_tscheduling_tequipment_teipatron_texample_tinmueble_tportlets_tbigdog_tlogreport_tnegocio_tbath_tstrony_ttreballadors_tencrypt_tdbm_ttempimages_toldshop_tdocumentfiles_tplatforms_tpassive_tveranstaltungen_tmusicas_tlearnmore_twbb_tlogo_tpromo_tkleinanzeigen_toldblog_tshareasale_tbobcat_tntopic_tnewsite_tprovost_tsecreto_tmaxprice_tdefault_tstarsrate_tskripte_trecettes_twebvideo_tcfg_tnationwide_tinvia_titch_tempuriabrava_twolverin_timagemap
mov r10, rax
sub rbx, rax
movabs rdi, 0x764bc88c79fe26d1
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xc]
mul rcx
add r11d, 0xc
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xc
jb 0x140003fe0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400041d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Gprs_tflickrjp_tlawyers_tdefine_tbookings_tbiweeklypmtcalc_tarticle_tzipcode_toldweb_tparts_tpiter_trelationship_tsustainability_tnoframes_tincludetop_twpicludes_timports_tscheduling_tequipment_teipatron_texample_tinmueble_tportlets_tbigdog_tlogreport_tnegocio_tbath_tstrony_ttreballadors_tencrypt_tdbm_ttempimages_toldshop_tdocumentfiles_tplatforms_tpassive_tveranstaltungen_tmusicas_tlearnmore_twbb_tlogo_tpromo_tkleinanzeigen_toldblog_tshareasale_tbobcat_tntopic_tnewsite_tprovost_tsecreto_tmaxprice_tdefault_tstarsrate_tskripte_trecettes_twebvideo_tcfg_tnationwide_tinvia_titch_tempuriabrava_twolverin_timagemap
mov r10, rax
sub rbx, rax
movabs rdi, 0x764bc88c79fe26d1
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 6]
mov rax, rdi
mov rcx, r8
mul r8
add r11d, 6
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 7]
mov byte [r9 - 7], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 6
jb 0x140004220
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004e60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Gprs_tflickrjp_tlawyers_tdefine_tbookings_tbiweeklypmtcalc_tarticle_tzipcode_toldweb_tparts_tpiter_trelationship_tsustainability_tnoframes_tincludetop_twpicludes_timports_tscheduling_tequipment_teipatron_texample_tinmueble_tportlets_tbigdog_tlogreport_tnegocio_tbath_tstrony_ttreballadors_tencrypt_tdbm_ttempimages_toldshop_tdocumentfiles_tplatforms_tpassive_tveranstaltungen_tmusicas_tlearnmore_twbb_tlogo_tpromo_tkleinanzeigen_toldblog_tshareasale_tbobcat_tntopic_tnewsite_tprovost_tsecreto_tmaxprice_tdefault_tstarsrate_tskripte_trecettes_twebvideo_tcfg_tnationwide_tinvia_titch_tempuriabrava_twolverin_timagemap
mov r10, rax
sub rbx, rax
movabs rdi, 0x764bc88c79fe26d1
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 0xc]
mov rax, rdi
mov rcx, r8
mul r8
add r11d, 6
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 0xe]
movsx eax, al
mov word [r9 - 0xe], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 0xc]
movsx eax, al
mov word [r9 - 0xc], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 0xa]
movsx eax, al
mov word [r9 - 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 6
jb 0x140004eb0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004fd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xe]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Gprs_tflickrjp_tlawyers_tdefine_tbookings_tbiweeklypmtcalc_tarticle_tzipcode_toldweb_tparts_tpiter_trelationship_tsustainability_tnoframes_tincludetop_twpicludes_timports_tscheduling_tequipment_teipatron_texample_tinmueble_tportlets_tbigdog_tlogreport_tnegocio_tbath_tstrony_ttreballadors_tencrypt_tdbm_ttempimages_toldshop_tdocumentfiles_tplatforms_tpassive_tveranstaltungen_tmusicas_tlearnmore_twbb_tlogo_tpromo_tkleinanzeigen_toldblog_tshareasale_tbobcat_tntopic_tnewsite_tprovost_tsecreto_tmaxprice_tdefault_tstarsrate_tskripte_trecettes_twebvideo_tcfg_tnationwide_tinvia_titch_tempuriabrava_twolverin_timagemap
mov r10, rax
sub rbx, rax
movabs rdi, 0x764bc88c79fe26d1
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
lea rcx, [r8 + 8]
mov rax, rdi
mul rcx
add r11d, 0xb
lea r9, [r9 + 0x16]
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x22a
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 0xb
jb 0x140005020
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140008fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x72
mov dword [rbp - 0x20], 0x35000c
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x3d0020
mov dword [rbp - 0x18], 0x2a004c
mov dword [rbp - 0x14], 0x28002e
mov dword [rbp - 0x10], 0x2e0030
call fcn.140004fd0
mov rcx, rax
call 0x140009d00
mov qword [0x1400191b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x63
mov dword [rbp - 0x20], 0x35000c
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x3d0020
mov dword [rbp - 0x18], 0x2a004c
mov dword [rbp - 0x14], 0x5b005f
call fcn.1400022a0
mov rcx, rax
call 0x140009d00
lea rcx, [rbp - 0x20]
mov qword [0x1400191a8], rax
mov dword [rbp - 0x20], 0x40029
mov dword [rbp - 0x1c], 0x1f0016
mov dword [rbp - 0x18], 0x660065
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x140009d00
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140009d62
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000d2b0
test al, al
jne 0x140009d74
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140009d30
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009d00
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x72
mov dword [rbp - 0x20], 0x35000c
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x3d0020
mov dword [rbp - 0x18], 0x2a004c
mov dword [rbp - 0x14], 0x28002e
mov dword [rbp - 0x10], 0x2e0030
call fcn.140004fd0
mov rcx, rax
call 0x140009d00
mov qword [0x1400191b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x63
mov dword [rbp - 0x20], 0x35000c
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x3d0020
mov dword [rbp - 0x18], 0x2a004c
mov dword [rbp - 0x14], 0x5b005f
call fcn.1400022a0
mov rcx, rax
call 0x140009d00
lea rcx, [rbp - 0x20]
mov qword [0x1400191a8], rax
mov dword [rbp - 0x20], 0x40029
mov dword [rbp - 0x1c], 0x1f0016
mov dword [rbp - 0x18], 0x660065
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x140009d00
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140009d62
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000d2b0
test al, al
jne 0x140009d74
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140009d30
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000c4f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000c71e
mov word [rbp + 0x50], 0x7047
mov word [rbp + 0x58], 0x7047
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000c5a4
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000c590
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000c5d5
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000c5c0
cmp rdi, rbx
jne 0x14000c6f2
mov r13, rsi
mov word [rbp - 0x50], 0x7047
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000c616
lea rcx, [rbp - 0x50]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000c602
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000c718
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x700026
call fcn.140002490
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000c688
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x70003d
call fcn.140002490
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000c688
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x700026
mov dword [rbp - 0x42], 0x700006
call fcn.140002490
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x700026
call fcn.140002490
movzx eax, word [rax]
cmp edi, eax
jl 0x14000c6e5
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x70003d
call fcn.140002490
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000c6e5
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x700026
mov dword [rbp - 0x32], 0x700006
call fcn.140002490
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000c6f2
inc r14
jmp 0x14000c5f0
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000c71e
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000c560
mov rax, qword [rbp - 8]
jmp 0x14000c720
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000cfd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400191c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x180014
mov dword [rbp - 0x1c], 0x1f0017
mov dword [rbp - 0x18], 0x550065
mov dword [rbp - 0x14], 0x47005e
mov dword [rbp - 0x10], 0x70007
mov dword [rbp - 0xc], 0x6a001e
call fcn.1400029c0
mov rcx, rax
call rbx
mov rbx, qword [0x1400191c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400191a0], rax
mov dword [rbp - 0x20], 0x190010
mov dword [rbp - 0x1c], 0x1a001c
mov dword [rbp - 0x18], 0x30067
mov dword [rbp - 0x14], 0x470018
mov dword [rbp - 0x10], 0x70007
mov dword [rbp - 0xc], 0x6a001e
call fcn.1400029c0
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x140017bb0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140019130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400191b0], rax
mov word [rbp - 0x10], 0x2e01
mov byte [rbp - 0xe], 0x65
call fcn.140004620
mov rcx, qword [0x1400191a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140019130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x1f171814
mov dword [rbp - 0x1c], 0xc142365
mov dword [rbp - 0x18], 0xf061e00
mov word [rbp - 0x14], 0x927
call fcn.140001180
mov rcx, qword [0x1400191a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140019130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x16061e0e
mov dword [rbp - 0x1c], 0x1d09087b
mov dword [rbp - 0x18], 0x4171b2c
mov word [rbp - 0x14], 0x931
call fcn.140001180
mov rcx, qword [0x1400191b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140017c80]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140019130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400190e8], rax
mov byte [rbp - 0x10], 0x77
call fcn.140004330
mov rcx, qword [0x1400191b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140017c30]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140019130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400190f0], rax
mov dword [rbp - 0x10], 0x72001513
call fcn.140002660
mov rcx, qword [0x1400191b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140017b80]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140019130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400190e0], rax
mov byte [rbp - 0x10], 0x77
call fcn.140004330
mov rcx, qword [0x1400191b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140017c50]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140019130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400190d8], rax
mov dword [rbp - 0x10], 0x330b161e
mov byte [rbp - 0xc], 0x73
call fcn.140003130
mov rcx, qword [0x1400191b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140017c10]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140019130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x3819
mov byte [rbp - 0xe], 0x65
call fcn.140004620
mov rcx, qword [0x1400191b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp rax
Function at 0x140001260
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
movzx ecx, word [0x14007ad48]
movzx eax, byte [0x14007ad4a]
movsd xmm0, qword [0x14007ad40]
xor al, 0x3e
movsd qword [rbp - 0x50], xmm0
xor byte [rbp - 0x4f], 0x35
xor byte [rbp - 0x4e], 0x36
xor byte [rbp - 0x4d], 0x37
xor byte [rbp - 0x4c], 0x38
xor byte [rbp - 0x4b], 0x39
xor byte [rbp - 0x4a], 0x3a
xor byte [rbp - 0x49], 0x3b
mov word [rbp - 0x48], cx
xor cl, 0x3c
xor byte [rbp - 0x47], 0x3d
mov byte [rbp - 0x48], cl
lea rcx, [rbp - 0x50]
mov byte [rbp - 0x50], 0x77
mov byte [rbp - 0x46], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r9, rax
test rax, rax
je 0x1400014b7
movzx ecx, word [0x14007ad60]
movups xmm0, xmmword [str.zAcD_KyWSN__2_75F]
mov word [rbp - 0x20], cx
movzx ecx, byte [0x14007ad62]
mov qword [rsp + 0x80], rbx
xor ebx, ebx
cmp dword [reloc.WS2_32.dll_accept], 2
mov byte [rbp - 0x1e], cl
mov ecx, ebx
movups xmmword [rbp - 0x30], xmm0
jl 0x140001449
movdqa xmm0, xmmword [str.4444444444444444]
lea rdx, [rbp - 0x2c]
movdqa xmm5, xmmword [0x14007ad70]
movdqa xmm4, xmmword [0x14007adb0]
movdqa xmmword [rbp - 0x40], xmm0
mov r8d, dword [rbp - 0x40]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [str.6666]
nop dword [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14007ad90]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14007ad90]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x140001340
movaps xmm6, xmmword [rsp + 0x60]
cmp ecx, 0x13
jge 0x14000148d
movsxd rax, ecx
lea r8, [rbp - 0x30]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x13
jl 0x140001460
lea rdx, [rbp - 0x30]
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14009ce90], rax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
add rsp, 0x70
pop rbp
ret