joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140046e40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x38], xmm6
mov rdi, rdx
mov rsi, rcx
mov r8, rcx
lea rdx, [rbp - 0x29]
lea rcx, [0x14013b310]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 9]
call fcn.140009d90
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x30]
test rbx, rbx
jne 0x140047057
mov rax, qword [0x14013ac40]
test rax, rax
jne 0x140046fff
mov dword [rbp - 0x39], 0x56535d7e
mov dword [rbp - 0x35], 0x40505b7e
mov dword [rbp - 0x31], 0x734b4053
mov dword [rbp + 7], 0x75007b
mov dword [rbp + 0xb], 0x7e0062
mov dword [rbp + 0xf], 0x7c0075
mov dword [rbp + 0x13], 0x20003
mov dword [rbp + 0x17], 0x54001e
mov dword [rbp + 0x1b], 0x5c005c
lea r15d, [rbx + 0x30]
movsd xmm0, qword [rbp - 0x39]
movsd qword [rbp - 0x29], xmm0
mov eax, dword [rbp - 0x31]
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x1d], 0x32
lea ebx, [r15 - 0x23]
mov r14, qword [0x14013a8f0]
test r14, r14
jne 0x140046f54
mov ecx, ebx
call fcn.140075634
mov r14, rax
mov qword [0x14013a8f0], rax
mov rdx, rax
lea r9, [rbp - 0x29]
sub r9, rax
mov r8d, ebx
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
xor cl, 0x32
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x140046f40
movdqu xmm6, xmmword [rbp + 7]
movaps xmmword [rbp - 0x29], xmm6
movsd xmm0, qword [rbp + 0x17]
movsd qword [rbp - 0x19], xmm0
mov word [rbp - 0x11], r15w
mov rcx, qword [0x14013a978]
test rcx, rcx
jne 0x140046fe6
mov ecx, 0x1a
call fcn.140075634
mov rcx, rax
mov qword [0x14013a978], rax
xor eax, eax
lea rdx, [rcx + 0x18]
lea r8, [rbp - 0x11]
cmp rcx, r8
ja 0x140046fa4
lea r8, [rbp - 0x29]
cmp rdx, r8
jae 0x140046fb9
movdqa xmm0, xmmword [0x1401209e0]
pxor xmm0, xmm6
movdqu xmmword [rcx], xmm0
mov eax, 8
lea rdx, [rcx + rax*2]
lea r8, [rbp - 0x29]
sub r8, rcx
sub rbx, rax
nop word [rax + rax]
movzx eax, word [rdx + r8]
xor ax, r15w
mov word [rdx], ax
lea rdx, [rdx + 2]
sub rbx, 1
jne 0x140046fd0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ac40], rax
mov rbx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14004700c
mov rbx, qword [rdi]
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140047019
mov rcx, qword [rsi]
call rax
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rsi
lea rdx, [rbp - 9]
lea rcx, [0x14013b310]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 0x29]
call fcn.140009d90
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov rcx, rsi
call fcn.140006470
nop
mov rcx, rdi
call fcn.140006470
mov rax, rbx
mov rbx, qword [rsp + 0xd0]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140047090
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x38], xmm6
mov rdi, rdx
mov rsi, rcx
mov r8, rcx
lea rdx, [rbp - 0x29]
lea rcx, [0x14013b310]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 9]
call fcn.140009d90
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x30]
test rbx, rbx
jne 0x1400472a7
mov rax, qword [0x14013a9c0]
test rax, rax
jne 0x14004724f
mov dword [rbp - 0x39], 0x56535d7e
mov dword [rbp - 0x35], 0x40505b7e
mov dword [rbp - 0x31], 0x734b4053
mov dword [rbp + 7], 0x75007b
mov dword [rbp + 0xb], 0x7e0062
mov dword [rbp + 0xf], 0x7c0075
mov dword [rbp + 0x13], 0x20003
mov dword [rbp + 0x17], 0x54001e
mov dword [rbp + 0x1b], 0x5c005c
lea r15d, [rbx + 0x30]
movsd xmm0, qword [rbp - 0x39]
movsd qword [rbp - 0x29], xmm0
mov eax, dword [rbp - 0x31]
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x1d], 0x32
lea ebx, [r15 - 0x23]
mov r14, qword [0x14013a8f0]
test r14, r14
jne 0x1400471a4
mov ecx, ebx
call fcn.140075634
mov r14, rax
mov qword [0x14013a8f0], rax
mov rdx, rax
lea r9, [rbp - 0x29]
sub r9, rax
mov r8d, ebx
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
xor cl, 0x32
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x140047190
movdqu xmm6, xmmword [rbp + 7]
movaps xmmword [rbp - 0x29], xmm6
movsd xmm0, qword [rbp + 0x17]
movsd qword [rbp - 0x19], xmm0
mov word [rbp - 0x11], r15w
mov rcx, qword [0x14013a978]
test rcx, rcx
jne 0x140047236
mov ecx, 0x1a
call fcn.140075634
mov rcx, rax
mov qword [0x14013a978], rax
xor eax, eax
lea rdx, [rcx + 0x18]
lea r8, [rbp - 0x11]
cmp rcx, r8
ja 0x1400471f4
lea r8, [rbp - 0x29]
cmp rdx, r8
jae 0x140047209
movdqa xmm0, xmmword [0x1401209e0]
pxor xmm0, xmm6
movdqu xmmword [rcx], xmm0
mov eax, 8
lea rdx, [rcx + rax*2]
lea r8, [rbp - 0x29]
sub r8, rcx
sub rbx, rax
nop word [rax + rax]
movzx eax, word [rdx + r8]
xor ax, r15w
mov word [rdx], ax
lea rdx, [rdx + 2]
sub rbx, 1
jne 0x140047220
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013a9c0], rax
mov rbx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14004725c
mov rbx, qword [rdi]
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140047269
mov rcx, qword [rsi]
call rax
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rsi
lea rdx, [rbp - 9]
lea rcx, [0x14013b310]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 0x29]
call fcn.140009d90
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov rcx, rsi
call fcn.140006470
nop
mov rcx, rdi
call fcn.140006470
mov rax, rbx
mov rbx, qword [rsp + 0xd0]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400472e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x38], xmm6
mov rdi, rdx
mov rsi, rcx
mov r8, rcx
lea rdx, [rbp - 0x29]
lea rcx, [0x14013b310]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 9]
call fcn.140009d90
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x30]
test rbx, rbx
jne 0x1400474f7
mov rax, qword [0x14013add0]
test rax, rax
jne 0x14004749f
mov dword [rbp - 0x39], 0x56535d7e
mov dword [rbp - 0x35], 0x40505b7e
mov dword [rbp - 0x31], 0x734b4053
mov dword [rbp + 7], 0x75007b
mov dword [rbp + 0xb], 0x7e0062
mov dword [rbp + 0xf], 0x7c0075
mov dword [rbp + 0x13], 0x20003
mov dword [rbp + 0x17], 0x54001e
mov dword [rbp + 0x1b], 0x5c005c
lea r15d, [rbx + 0x30]
movsd xmm0, qword [rbp - 0x39]
movsd qword [rbp - 0x29], xmm0
mov eax, dword [rbp - 0x31]
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x1d], 0x32
lea ebx, [r15 - 0x23]
mov r14, qword [0x14013a8f0]
test r14, r14
jne 0x1400473f4
mov ecx, ebx
call fcn.140075634
mov r14, rax
mov qword [0x14013a8f0], rax
mov rdx, rax
lea r9, [rbp - 0x29]
sub r9, rax
mov r8d, ebx
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
xor cl, 0x32
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x1400473e0
movdqu xmm6, xmmword [rbp + 7]
movaps xmmword [rbp - 0x29], xmm6
movsd xmm0, qword [rbp + 0x17]
movsd qword [rbp - 0x19], xmm0
mov word [rbp - 0x11], r15w
mov rcx, qword [0x14013a978]
test rcx, rcx
jne 0x140047486
mov ecx, 0x1a
call fcn.140075634
mov rcx, rax
mov qword [0x14013a978], rax
xor eax, eax
lea rdx, [rcx + 0x18]
lea r8, [rbp - 0x11]
cmp rcx, r8
ja 0x140047444
lea r8, [rbp - 0x29]
cmp rdx, r8
jae 0x140047459
movdqa xmm0, xmmword [0x1401209e0]
pxor xmm0, xmm6
movdqu xmmword [rcx], xmm0
mov eax, 8
lea rdx, [rcx + rax*2]
lea r8, [rbp - 0x29]
sub r8, rcx
sub rbx, rax
nop word [rax + rax]
movzx eax, word [rdx + r8]
xor ax, r15w
mov word [rdx], ax
lea rdx, [rdx + 2]
sub rbx, 1
jne 0x140047470
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013add0], rax
mov rbx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400474ac
mov rbx, qword [rdi]
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1400474b9
mov rcx, qword [rsi]
call rax
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rsi
lea rdx, [rbp - 9]
lea rcx, [0x14013b310]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 0x29]
call fcn.140009d90
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov rcx, rsi
call fcn.140006470
nop
mov rcx, rdi
call fcn.140006470
mov rax, rbx
mov rbx, qword [rsp + 0xd0]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140047530
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x38], xmm6
mov rdi, rdx
mov rsi, rcx
mov r8, rcx
lea rdx, [rbp - 0x29]
lea rcx, [0x14013b310]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 9]
call fcn.140009d90
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x30]
test rbx, rbx
jne 0x140047747
mov rax, qword [0x14013ad40]
test rax, rax
jne 0x1400476ef
mov dword [rbp - 0x39], 0x56535d7e
mov dword [rbp - 0x35], 0x40505b7e
mov dword [rbp - 0x31], 0x734b4053
mov dword [rbp + 7], 0x75007b
mov dword [rbp + 0xb], 0x7e0062
mov dword [rbp + 0xf], 0x7c0075
mov dword [rbp + 0x13], 0x20003
mov dword [rbp + 0x17], 0x54001e
mov dword [rbp + 0x1b], 0x5c005c
lea r15d, [rbx + 0x30]
movsd xmm0, qword [rbp - 0x39]
movsd qword [rbp - 0x29], xmm0
mov eax, dword [rbp - 0x31]
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x1d], 0x32
lea ebx, [r15 - 0x23]
mov r14, qword [0x14013a8f0]
test r14, r14
jne 0x140047644
mov ecx, ebx
call fcn.140075634
mov r14, rax
mov qword [0x14013a8f0], rax
mov rdx, rax
lea r9, [rbp - 0x29]
sub r9, rax
mov r8d, ebx
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
xor cl, 0x32
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x140047630
movdqu xmm6, xmmword [rbp + 7]
movaps xmmword [rbp - 0x29], xmm6
movsd xmm0, qword [rbp + 0x17]
movsd qword [rbp - 0x19], xmm0
mov word [rbp - 0x11], r15w
mov rcx, qword [0x14013a978]
test rcx, rcx
jne 0x1400476d6
mov ecx, 0x1a
call fcn.140075634
mov rcx, rax
mov qword [0x14013a978], rax
xor eax, eax
lea rdx, [rcx + 0x18]
lea r8, [rbp - 0x11]
cmp rcx, r8
ja 0x140047694
lea r8, [rbp - 0x29]
cmp rdx, r8
jae 0x1400476a9
movdqa xmm0, xmmword [0x1401209e0]
pxor xmm0, xmm6
movdqu xmmword [rcx], xmm0
mov eax, 8
lea rdx, [rcx + rax*2]
lea r8, [rbp - 0x29]
sub r8, rcx
sub rbx, rax
nop word [rax + rax]
movzx eax, word [rdx + r8]
xor ax, r15w
mov word [rdx], ax
lea rdx, [rdx + 2]
sub rbx, 1
jne 0x1400476c0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ad40], rax
mov rbx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400476fc
mov rbx, qword [rdi]
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140047709
mov rcx, qword [rsi]
call rax
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rsi
lea rdx, [rbp - 9]
lea rcx, [0x14013b310]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 0x29]
call fcn.140009d90
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov rcx, rsi
call fcn.140006470
nop
mov rcx, rdi
call fcn.140006470
mov rax, rbx
mov rbx, qword [rsp + 0xd0]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140049260
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140049284
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400492c7
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x1400492c7
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x1400493d2
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14004930a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140049319
movsx ecx, dil
jmp 0x140049373
lea r8, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x41]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x98]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
js 0x1400493d2
cmp eax, 1
jle 0x14004938d
cmp eax, 3
jne 0x1400493d2
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call fcn.14008a0f0
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400493d7
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x1400493bd
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call fcn.140088314
cmp rsi, rax
jne 0x1400493d2
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov eax, edi
jne 0x1400493d7
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x14004e350
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14004e3b1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14004e370
mov ecx, dword [r10]
jmp 0x14004e49a
cmp ecx, 0x4e0
jb 0x14004e49a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14004e3d0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14004e420
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140056980
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
lea rbp, [rax - 0x3b8]
sub rsp, 0x4a0
movaps xmmword [rax - 0x28], xmm6
mov rsi, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp - 0x70]
call fcn.140081bd0
mov dword [rbp + 0x3d0], 0x400
lea rax, [rsp + 0x20]
mov qword [rbp + 0x3d8], rax
movdqa xmm6, xmmword [0x140121850]
mov dword [rsp + 0x30], 0xc0c7dcda
mov word [rsp + 0x34], 0xaec9
movaps xmmword [rsp + 0x40], xmm6
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x50], eax
movzx eax, word [rsp + 0x34]
mov word [rsp + 0x54], ax
mov rdx, qword [0x14013b110]
test rdx, rdx
jne 0x140056a73
mov ebx, 0x16
mov ecx, ebx
call fcn.140075634
mov rdx, rax
mov qword [0x14013b110], rax
xor eax, eax
lea rcx, [rdx + 0x15]
lea r8, [rsp + 0x55]
cmp rdx, r8
ja 0x140056a37
lea r8, [rsp + 0x40]
cmp rcx, r8
jae 0x140056a4c
movdqa xmm0, xmmword [0x140121410]
pxor xmm0, xmm6
movdqu xmmword [rdx], xmm0
mov eax, 0x10
lea rcx, [rax + rdx]
lea r8, [rsp + 0x40]
sub r8, rdx
sub rbx, rax
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor al, 0xae
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rbx, 1
jne 0x140056a60
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x140056a94
lea rcx, [rsp + 0x20]
call fcn.1400064d0
nop
mov rax, qword [0x14013af30]
test rax, rax
jne 0x140056adb
lea ecx, [rax + 0xb]
call fcn.140075634
mov qword [0x14013af30], rax
mov dword [rax], 0x6d6c7275
mov dword [rax + 4], 0x642e6e6f
mov word [rax + 8], 0x6c6c
mov byte [rax + 0xa], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140056af5
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400064d0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.14005a030
lea r8, [rbp + 0x3d0]
lea rdx, [rbp - 0x70]
xor ecx, ecx
call rax
test eax, eax
jns 0x140056b3b
mov rcx, rsi
call fcn.14000c3a0
xor al, al
jmp 0x140056b8e
lea rax, [rbp - 0x70]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140056b40
lea rcx, [rdi + 0x18]
mov r8, rbx
lea rdx, [rbp - 0x70]
call fcn.1400064d0
cmp rdi, rsi
je 0x140056b6d
mov r8, qword [rsi + 8]
mov rdx, qword [rsi]
mov rcx, rdi
call fcn.14005b950
mov rax, qword [rdi + 8]
cmp qword [rdi], rax
je 0x140056b81
cmp qword [rdi + 0x28], 0
je 0x140056b81
mov bl, 1
jmp 0x140056b83
xor bl, bl
mov rcx, rsi
call fcn.14000c3a0
movzx eax, bl
mov rbx, qword [rsp + 0x4c0]
movaps xmm6, xmmword [rsp + 0x490]
add rsp, 0x4a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140059de0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x38], xmm6
mov rdi, rdx
mov rsi, rcx
mov r8, rcx
lea rdx, [rbp - 0x29]
lea rcx, [0x14013b450]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 9]
call fcn.140009d90
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x30]
test rbx, rbx
jne 0x140059ff7
mov rax, qword [0x14013af80]
test rax, rax
jne 0x140059f9f
mov dword [rbp - 0x39], 0x56535d7e
mov dword [rbp - 0x35], 0x40505b7e
mov dword [rbp - 0x31], 0x734b4053
mov dword [rbp + 7], 0x75007b
mov dword [rbp + 0xb], 0x7e0062
mov dword [rbp + 0xf], 0x7c0075
mov dword [rbp + 0x13], 0x20003
mov dword [rbp + 0x17], 0x54001e
mov dword [rbp + 0x1b], 0x5c005c
lea r15d, [rbx + 0x30]
movsd xmm0, qword [rbp - 0x39]
movsd qword [rbp - 0x29], xmm0
mov eax, dword [rbp - 0x31]
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x1d], 0x32
lea ebx, [r15 - 0x23]
mov r14, qword [0x14013ae88]
test r14, r14
jne 0x140059ef4
mov ecx, ebx
call fcn.140075634
mov r14, rax
mov qword [0x14013ae88], rax
mov rdx, rax
lea r9, [rbp - 0x29]
sub r9, rax
mov r8d, ebx
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
xor cl, 0x32
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x140059ee0
movdqu xmm6, xmmword [rbp + 7]
movaps xmmword [rbp - 0x29], xmm6
movsd xmm0, qword [rbp + 0x17]
movsd qword [rbp - 0x19], xmm0
mov word [rbp - 0x11], r15w
mov rcx, qword [0x14013aee0]
test rcx, rcx
jne 0x140059f86
mov ecx, 0x1a
call fcn.140075634
mov rcx, rax
mov qword [0x14013aee0], rax
xor eax, eax
lea rdx, [rcx + 0x18]
lea r8, [rbp - 0x11]
cmp rcx, r8
ja 0x140059f44
lea r8, [rbp - 0x29]
cmp rdx, r8
jae 0x140059f59
movdqa xmm0, xmmword [0x1401209e0]
pxor xmm0, xmm6
movdqu xmmword [rcx], xmm0
mov eax, 8
lea rdx, [rcx + rax*2]
lea r8, [rbp - 0x29]
sub r8, rcx
sub rbx, rax
nop word [rax + rax]
movzx eax, word [rdx + r8]
xor ax, r15w
mov word [rdx], ax
lea rdx, [rdx + 2]
sub rbx, 1
jne 0x140059f70
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013af80], rax
mov rbx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140059fac
mov rbx, qword [rdi]
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140059fb9
mov rcx, qword [rsi]
call rax
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rsi
lea rdx, [rbp - 9]
lea rcx, [0x14013b450]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 0x29]
call fcn.140009d90
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov rcx, rsi
call fcn.140006470
nop
mov rcx, rdi
call fcn.140006470
mov rax, rbx
mov rbx, qword [rsp + 0xd0]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005a030
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x38], xmm6
mov rdi, rdx
mov rsi, rcx
mov r8, rcx
lea rdx, [rbp - 0x29]
lea rcx, [0x14013b450]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 9]
call fcn.140009d90
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x30]
test rbx, rbx
jne 0x14005a247
mov rax, qword [0x14013b080]
test rax, rax
jne 0x14005a1ef
mov dword [rbp - 0x39], 0x56535d7e
mov dword [rbp - 0x35], 0x40505b7e
mov dword [rbp - 0x31], 0x734b4053
mov dword [rbp + 7], 0x75007b
mov dword [rbp + 0xb], 0x7e0062
mov dword [rbp + 0xf], 0x7c0075
mov dword [rbp + 0x13], 0x20003
mov dword [rbp + 0x17], 0x54001e
mov dword [rbp + 0x1b], 0x5c005c
lea r15d, [rbx + 0x30]
movsd xmm0, qword [rbp - 0x39]
movsd qword [rbp - 0x29], xmm0
mov eax, dword [rbp - 0x31]
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x1d], 0x32
lea ebx, [r15 - 0x23]
mov r14, qword [0x14013ae88]
test r14, r14
jne 0x14005a144
mov ecx, ebx
call fcn.140075634
mov r14, rax
mov qword [0x14013ae88], rax
mov rdx, rax
lea r9, [rbp - 0x29]
sub r9, rax
mov r8d, ebx
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
xor cl, 0x32
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x14005a130
movdqu xmm6, xmmword [rbp + 7]
movaps xmmword [rbp - 0x29], xmm6
movsd xmm0, qword [rbp + 0x17]
movsd qword [rbp - 0x19], xmm0
mov word [rbp - 0x11], r15w
mov rcx, qword [0x14013aee0]
test rcx, rcx
jne 0x14005a1d6
mov ecx, 0x1a
call fcn.140075634
mov rcx, rax
mov qword [0x14013aee0], rax
xor eax, eax
lea rdx, [rcx + 0x18]
lea r8, [rbp - 0x11]
cmp rcx, r8
ja 0x14005a194
lea r8, [rbp - 0x29]
cmp rdx, r8
jae 0x14005a1a9
movdqa xmm0, xmmword [0x1401209e0]
pxor xmm0, xmm6
movdqu xmmword [rcx], xmm0
mov eax, 8
lea rdx, [rcx + rax*2]
lea r8, [rbp - 0x29]
sub r8, rcx
sub rbx, rax
nop word [rax + rax]
movzx eax, word [rdx + r8]
xor ax, r15w
mov word [rdx], ax
lea rdx, [rdx + 2]
sub rbx, 1
jne 0x14005a1c0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013b080], rax
mov rbx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14005a1fc
mov rbx, qword [rdi]
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14005a209
mov rcx, qword [rsi]
call rax
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rsi
lea rdx, [rbp - 9]
lea rcx, [0x14013b450]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 0x29]
call fcn.140009d90
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov rcx, rsi
call fcn.140006470
nop
mov rcx, rdi
call fcn.140006470
mov rax, rbx
mov rbx, qword [rsp + 0xd0]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret