joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x24
mov dword [rbp - 0x30], 0x72f772c9
mov dword [rbp - 0x2c], 0x72ad72f0
mov ebx, 0x729e
mov dword [rbp - 0x28], 0x72c172ac
mov dword [rbp - 0x24], 0x72ed72cb
mov dword [rbp - 0x20], 0x72ec72fb
mov dword [rbp - 0x1c], 0x72fd72df
mov dword [rbp - 0x18], 0x72f172fd
mov dword [rbp - 0x14], 0x72f072eb
mov dword [rbp - 0x10], 0x729e72ea
mov dword [rbp - 0xc], 0x8cc6729e
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayUnaccessData
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400055e2
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140005604
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x72e472a7
mov dword [rbp - 0x2c], 0x72e672f7
mov ebx, 0x7285
mov dword [rbp - 0x28], 0x72da72ed
mov dword [rbp - 0x24], 0x72fc72f6
mov dword [rbp - 0x20], 0x72f172f6
mov dword [rbp - 0x1c], 0x72e872e0
mov dword [rbp - 0x18], 0x72bf72a7
mov dword [rbp - 0x14], 0x728572a7
mov dword [rbp - 0x10], 0x8cc67285
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000566f
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140005690
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x38
mov dword [rbp - 0x40], 0x72dd72cb
mov dword [rbp - 0x3c], 0x72dd72d4
mov ebx, 0x7298
mov dword [rbp - 0x38], 0x72cc72db
mov dword [rbp - 0x34], 0x72b272b8
mov dword [rbp - 0x30], 0x72de72b8
mov dword [rbp - 0x2c], 0x72d772ca
mov dword [rbp - 0x28], 0x72b872d5
mov dword [rbp - 0x24], 0x72f172cf
mov dword [rbp - 0x20], 0x72ab72f6
mov dword [rbp - 0x1c], 0x72c772aa
mov dword [rbp - 0x18], 0x72ea72c8
mov dword [rbp - 0x14], 0x72fb72f7
mov dword [rbp - 0x10], 0x72eb72fd
mov dword [rbp - 0xc], 0x729872eb
mov dword [rbp - 8], 0x8cc67298
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1c
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005725
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140005744
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x729c
mov dword [rbp - 0x50], 0x72d972cf
mov ecx, 0x46
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x4c], 0x72d972d0
mov dword [rbp - 0x48], 0x72c872df
mov dword [rbp - 0x44], 0x72b672bc
mov dword [rbp - 0x40], 0x72da72bc
mov dword [rbp - 0x3c], 0x72d372ce
mov dword [rbp - 0x38], 0x72bc72d1
mov dword [rbp - 0x34], 0x72f572cb
mov dword [rbp - 0x30], 0x72af72f2
mov dword [rbp - 0x2c], 0x72c372ae
mov dword [rbp - 0x28], 0x72f372df
mov dword [rbp - 0x24], 0x72ec72f1
mov dword [rbp - 0x20], 0x72e872e9
mov dword [rbp - 0x1c], 0x72ee72f9
mov dword [rbp - 0x18], 0x72e572cf
mov dword [rbp - 0x14], 0x72e872ef
mov dword [rbp - 0x10], 0x72f172f9
mov dword [rbp - 8], 0x8cc6729c
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x23
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400057f1
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x140005814
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x71077119
mov dword [rbp - 0x1c], 0x710d7119
mov ebx, 0x7149
mov dword [rbp - 0x18], 0x713f712c
mov dword [rbp - 0x14], 0x712a7120
mov dword [rbp - 0x10], 0x7100712c
mov dword [rbp - 0xc], 0x7149710d
mov dword [rbp - 8], 0x8cc67149
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005871
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140005890
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x34
mov dword [rbp - 0x40], 0x70c370c4
mov dword [rbp - 0x3c], 0x70b97095
mov ebx, 0x70e6
mov dword [rbp - 0x38], 0x70a770a4
mov dword [rbp - 0x34], 0x70b970a2
mov dword [rbp - 0x30], 0x70bf70b2
mov dword [rbp - 0x2c], 0x70a370b6
mov dword [rbp - 0x28], 0x70dc70c4
mov dword [rbp - 0x24], 0x70c370c4
mov dword [rbp - 0x20], 0x70c67082
mov dword [rbp - 0x1c], 0x70db70c7
mov dword [rbp - 0x18], 0x70c370c6
mov dword [rbp - 0x14], 0x70c47082
mov dword [rbp - 0x10], 0x70e670ec
mov dword [rbp - 0xc], 0x8cc670e6
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1a
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000591e
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140005940
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x71a9718b
mov dword [rbp - 0x1c], 0x71b871b4
mov ebx, 0x71db
mov dword [rbp - 0x18], 0x71a871be
mov dword [rbp - 0x14], 0x719271a8
mov dword [rbp - 0x10], 0x71db71bf
mov dword [rbp - 0xc], 0x8cc671db
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005996
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400059b8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x71bc
mov dword [rbp - 0x30], 0x71ef71f3
mov ecx, 0x1e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x2c], 0x71ce71ec
mov dword [rbp - 0x28], 0x71d871d3
mov dword [rbp - 0x24], 0x71df71c9
mov dword [rbp - 0x20], 0x71ef71c8
mov dword [rbp - 0x1c], 0x71d571c9
mov dword [rbp - 0x18], 0x71d971c8
mov dword [rbp - 0x10], 0x8cc671bc
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0xf
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005a1f
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140005a40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x72f672c8
mov dword [rbp - 0x2c], 0x72ac72f1
mov ebx, 0x729f
mov dword [rbp - 0x28], 0x72c072ad
mov dword [rbp - 0x24], 0x72ed72d8
mov dword [rbp - 0x20], 0x72ea72f0
mov dword [rbp - 0x1c], 0x72ca72ef
mov dword [rbp - 0x18], 0x72fa72ec
mov dword [rbp - 0x14], 0x729f72ed
mov dword [rbp - 0x10], 0x8cc6729f
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005aab
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140005acc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x71c171f6
mov dword [rbp - 0x1c], 0x71d871dd
mov ebx, 0x71b4
mov dword [rbp - 0x18], 0x71e071d0
mov dword [rbp - 0x14], 0x71c471cd
mov dword [rbp - 0x10], 0x71b471d1
mov dword [rbp - 0xc], 0x8cc671b4
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005b22
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140005b44
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov ebx, 0x729d
mov dword [rbp - 0x69], 0x72d872ce
mov ecx, 0xae
mov dword [rbp + 0x43], ebx
mov dword [rbp - 0x65], 0x72d872d1
mov dword [rbp - 0x61], 0x72c972de
mov dword [rbp - 0x5d], 0x72b772bd
mov dword [rbp - 0x59], 0x72db72bd
mov dword [rbp - 0x55], 0x72d272cf
mov dword [rbp - 0x51], 0x72bd72d0
mov dword [rbp - 0x4d], 0x72f472ca
mov dword [rbp - 0x49], 0x72ae72f3
mov dword [rbp - 0x45], 0x72c272af
mov dword [rbp - 0x41], 0x72f372cd
mov dword [rbp - 0x3d], 0x72d872cd
mov dword [rbp - 0x39], 0x72e972f3
mov dword [rbp - 0x35], 0x72e972f4
mov dword [rbp - 0x31], 0x72bd72e4
mov dword [rbp - 0x2d], 0x72d572ca
mov dword [rbp - 0x29], 0x72cf72d8
mov dword [rbp - 0x25], 0x72bd72d8
mov dword [rbp - 0x21], 0x72f172de
mov dword [rbp - 0x1d], 0x72ee72fc
mov dword [rbp - 0x19], 0x72da72ee
mov dword [rbp - 0x15], 0x72f472e8
mov dword [rbp - 0x11], 0x72a072f9
mov dword [rbp - 0xd], 0x72e672bf
mov dword [rbp - 9], 0x72ad72a8
mov dword [rbp - 5], 0x72f972f9
mov dword [rbp - 1], 0x72af72a8
mov dword [rbp + 3], 0x72ad72ae
mov dword [rbp + 7], 0x72ff72b0
mov dword [rbp + 0xb], 0x72a572fc
mov dword [rbp + 0xf], 0x72b072fc
mov dword [rbp + 0x13], 0x72ac72ac
mov dword [rbp + 0x17], 0x72ac72f9
mov dword [rbp + 0x1b], 0x72ff72b0
mov dword [rbp + 0x1f], 0x72a872fb
mov dword [rbp + 0x23], 0x72b072f9
mov dword [rbp + 0x27], 0x72ad72ad
mov dword [rbp + 0x2b], 0x72ad72ad
mov dword [rbp + 0x2f], 0x72a572fb
mov dword [rbp + 0x33], 0x72a872ad
mov dword [rbp + 0x37], 0x72a872fb
mov dword [rbp + 0x3b], 0x72ad72ae
mov dword [rbp + 0x3f], 0x72bf72e0
mov dword [rbp + 0x47], 0x8cc6729d
call fcn.1400026b0
lea r9, [rbp - 0x69]
mov rdx, rax
sub r9, rax
mov r8d, 0x57
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005cb9
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x140005cec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x718c
mov dword [rbp - 0x20], 0x71cd71c1
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x71cd71cf
mov dword [rbp - 0x18], 0x71e871e8
mov dword [rbp - 0x14], 0x71e971fe
mov dword [rbp - 0x10], 0x71ff71ff
mov dword [rbp - 8], 0x8cc6718c
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005d45
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140005d64
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x719f71bd
mov dword [rbp - 0x1c], 0x7193719f
mov ebx, 0x71fc
mov dword [rbp - 0x18], 0x71927189
mov dword [rbp - 0x14], 0x71a87188
mov dword [rbp - 0x10], 0x718c7185
mov dword [rbp - 0xc], 0x71fc7199
mov dword [rbp - 8], 0x8cc671fc
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005dc1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140005de0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x38
mov dword [rbp - 0x40], 0x72d172c7
mov dword [rbp - 0x3c], 0x72d172d8
mov ebx, 0x7294
mov dword [rbp - 0x38], 0x72c072d7
mov dword [rbp - 0x34], 0x72be72b4
mov dword [rbp - 0x30], 0x72d272b4
mov dword [rbp - 0x2c], 0x72db72c6
mov dword [rbp - 0x28], 0x72b472d9
mov dword [rbp - 0x24], 0x72fd72c3
mov dword [rbp - 0x20], 0x72a772fa
mov dword [rbp - 0x1c], 0x72cb72a6
mov dword [rbp - 0x18], 0x72e672c4
mov dword [rbp - 0x14], 0x72f072fb
mov dword [rbp - 0x10], 0x72f772e1
mov dword [rbp - 0xc], 0x729472e0
mov dword [rbp - 8], 0x8cc67294
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1c
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005e75
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x140005e94
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x71be
mov dword [rbp - 0x30], 0x71ed71f1
mov ecx, 0x1e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x2c], 0x71cc71ff
mov dword [rbp - 0x28], 0x71d671dd
mov dword [rbp - 0x24], 0x71ca71d7
mov dword [rbp - 0x20], 0x71dd71db
mov dword [rbp - 0x1c], 0x71cb71ca
mov dword [rbp - 0x18], 0x71db71cc
mov dword [rbp - 0x10], 0x8cc671be
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0xf
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005efb
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140005f1c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x7292
mov dword [rbp - 0x30], 0x72fc72d3
mov ecx, 0x22
mov dword [rbp - 0x10], ebx
mov dword [rbp - 0x2c], 0x72fb72e6
mov dword [rbp - 0x28], 0x72fb72c4
mov dword [rbp - 0x24], 0x72e772e0
mov dword [rbp - 0x20], 0x72c272e1
mov dword [rbp - 0x1c], 0x72fd72e0
mov dword [rbp - 0x18], 0x72e772f6
mov dword [rbp - 0x14], 0x72e672f1
mov dword [rbp - 0xc], 0x8cc67292
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x11
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005f8a
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x1400078ec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
movdqa xmm0, xmmword [0x140011640]
mov ebx, 0xf
mov ecx, ebx
mov dword [rsp + 0x30], 0x8cc67151
movdqu xmmword [rsp + 0x20], xmm0
call fcn.1400026b0
lea r8, [rsp + 0x20]
mov rdi, rax
sub r8, rax
mov rdx, rax
mov cl, byte [r8 + rdx]
xor cl, 0x51
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140007926
movdqa xmm0, xmmword [str.:4_4bc]
mov ebx, 0xd
mov ecx, ebx
mov dword [rsp + 0x30], 0x8cc67151
movdqu xmmword [rsp + 0x20], xmm0
call fcn.1400026b0
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x51
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140007965
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400079b7
and dword [rsp + 0x50], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x1400079b7
cmp dword [rsp + 0x50], 1
sete al
jmp 0x1400079b9
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1400079c4
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x20], 9
je 0x1400079e7
cmp word [rsp + 0x20], 6
je 0x1400079e7
xor al, al
jmp 0x1400079e9
mov al, 1
add rsp, 0x58
ret

Function at 0x140007ed4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x7112
mov dword [rbp - 0x20], 0x71617130
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x71767166
mov dword [rbp - 0x18], 0x7167717d
mov dword [rbp - 0x14], 0x71307166
mov dword [rbp - 0x10], 0x71307128
mov dword [rbp - 8], 0x8cc67112
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140007f2d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140007f4c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x80
movdqa xmm0, xmmword [0x140011d60]
mov ebx, 0x4d
movdqa xmm1, xmmword [0x140011b30]
mov ecx, ebx
movdqa xmmword [rax - 0x68], xmm0
movdqa xmm0, xmmword [0x140011d00]
movdqa xmmword [rax - 0x48], xmm0
movdqa xmm0, xmmword [str.o____._u__9O]
movdqa xmmword [rax - 0x58], xmm1
movdqa xmm1, xmmword [0x140011870]
movdqa xmmword [rax - 0x28], xmm0
movdqa xmmword [rax - 0x38], xmm1
mov dword [rax - 0x18], 0x8cc6714f
call fcn.1400026b0
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x4f
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140007fb6
add rsp, 0x80
pop rbx
ret
Function at 0x140007fd4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x140011d30]
mov ebx, 0x5b
movdqa xmm1, xmmword [0x140011790]
mov ecx, ebx
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x140011890]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x140011c60]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [str.e81__:_]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x253a272e
mov dword [rbp - 0xc], 0x2b723c29
mov dword [rbp - 8], 0x483e3b
mov dword [rbp - 4], 0x8cc67148
call fcn.1400026b0
lea r8, [rbp - 0x60]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x48
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008057
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret

Function at 0x14000807c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x28
mov dword [rbp - 0x30], 0x7072703c
mov dword [rbp - 0x2c], 0x706d707f
mov ebx, 0x701e
mov dword [rbp - 0x28], 0x705b706a
mov dword [rbp - 0x24], 0x706c706c
mov dword [rbp - 0x20], 0x706c7071
mov dword [rbp - 0x1c], 0x7024703c
mov dword [rbp - 0x18], 0x703b703c
mov dword [rbp - 0x14], 0x7026702e
mov dword [rbp - 0x10], 0x703c7046
mov dword [rbp - 0xc], 0x701e7032
mov dword [rbp - 8], 0x8cc6701e
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400080f5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140008114
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xb0
movdqa xmm0, xmmword [0x140011ce0]
mov ebx, 0x80
movdqa xmm1, xmmword [0x1400118d0]
mov ecx, ebx
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x140011930]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm1, xmmword [0x140011b90]
movdqa xmmword [rax - 0x78], xmm0
movdqa xmm0, xmmword [0x140011d90]
movdqa xmmword [rax - 0x68], xmm1
movdqa xmm1, xmmword [0x140011a30]
movdqa xmmword [rax - 0x58], xmm0
movdqa xmm0, xmmword [0x140011920]
movdqa xmmword [rax - 0x48], xmm1
movdqa xmm1, xmmword [0x140011c30]
movdqa xmmword [rax - 0x38], xmm0
movdqa xmmword [rax - 0x28], xmm1
mov dword [rax - 0x18], 0x8cc67157
call fcn.1400026b0
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x57
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x1400081a7
add rsp, 0xb0
pop rbx
ret
Function at 0x1400081c4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x90
movdqa xmm0, xmmword [0x140011cc0]
mov ebx, 0x5f
movdqa xmm1, xmmword [0x1400118b0]
mov ecx, ebx
movdqa xmmword [rax - 0x78], xmm0
movdqa xmm0, xmmword [0x140011a40]
movdqa xmmword [rax - 0x68], xmm1
movdqa xmm1, xmmword [0x140011af0]
movdqa xmmword [rax - 0x58], xmm0
movdqa xmm0, xmmword [0x140011a50]
movdqa xmmword [rax - 0x48], xmm1
movdqa xmm1, xmmword [str.8_vy09__7_l5__V]
movdqa xmmword [rax - 0x38], xmm0
movdqa xmmword [rax - 0x28], xmm1
mov dword [rax - 0x18], 0x8cc67156
call fcn.1400026b0
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x56
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x14000823b
add rsp, 0x90
pop rbx
ret

Function at 0x140008258
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x140011d10]
xor eax, eax
movdqa xmm1, xmmword [0x140011780]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x1400118e0]
movdqa xmmword [rbp - 0x40], xmm0
lea ebx, [rax + 0x59]
movdqa xmm0, xmmword [0x140011900]
mov ecx, ebx
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x140011ba0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x3e2b2738
mov dword [rbp - 0xc], 0x3c392970
mov byte [rbp - 8], 0x4a
mov word [rbp - 7], ax
mov byte [rbp - 5], al
mov dword [rbp - 4], 0x8cc6714a
call fcn.1400026b0
lea r8, [rbp - 0x60]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x4a
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x1400082df
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret

Function at 0x140008304
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x28
mov dword [rbp - 0x30], 0x7052701c
mov dword [rbp - 0x2c], 0x704d705f
mov ebx, 0x703e
mov dword [rbp - 0x28], 0x707b704a
mov dword [rbp - 0x24], 0x704c704c
mov dword [rbp - 0x20], 0x704c7051
mov dword [rbp - 0x1c], 0x7004701c
mov dword [rbp - 0x18], 0x701b701c
mov dword [rbp - 0x14], 0x7006700e
mov dword [rbp - 0x10], 0x701c7066
mov dword [rbp - 0xc], 0x703e7012
mov dword [rbp - 8], 0x8cc6703e
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000837d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000839c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
movdqa xmm0, xmmword [0x140011d70]
mov ebx, 0x9a
movdqa xmm1, xmmword [0x140011ac0]
mov ecx, ebx
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm0, xmmword [0x1400117a0]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [str.______r___8__q]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm1, xmmword [0x140011a60]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm0, xmmword [0x140011880]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm1, xmmword [0x1400119a0]
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm0, xmmword [0x1400119d0]
movdqa xmmword [rbp + 7], xmm1
movdqa xmm1, xmmword [0x1400119b0]
movdqa xmmword [rbp + 0x37], xmm0
movdqa xmmword [rbp + 0x27], xmm1
mov dword [rbp + 0x47], 0x2d213e23
mov dword [rbp + 0x4b], 0x3f2f7638
mov dword [rbp + 0x4f], 0x4c3a
mov dword [rbp + 0x53], 0x8cc6714c
call fcn.1400026b0
lea r8, [rbp - 0x49]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x4c
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008455
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rbp
ret

Function at 0x140008478
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x28
mov dword [rbp - 0x30], 0x706a7024
mov dword [rbp - 0x2c], 0x70757067
mov ebx, 0x7006
mov dword [rbp - 0x28], 0x70437072
mov dword [rbp - 0x24], 0x70747074
mov dword [rbp - 0x20], 0x70747069
mov dword [rbp - 0x1c], 0x703c7024
mov dword [rbp - 0x18], 0x70237024
mov dword [rbp - 0x14], 0x703e7036
mov dword [rbp - 0x10], 0x7024705e
mov dword [rbp - 0xc], 0x7006702a
mov dword [rbp - 8], 0x8cc67006
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400084f1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140008510
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xb0
movdqa xmm0, xmmword [0x140011ca0]
mov ebx, 0x7d
movdqa xmm1, xmmword [0x140011910]
mov ecx, ebx
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x140011bb0]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm1, xmmword [0x140011b70]
movdqa xmmword [rax - 0x78], xmm0
movdqa xmm0, xmmword [0x140011da0]
movdqa xmmword [rax - 0x68], xmm1
movdqa xmm1, xmmword [0x1400118c0]
movdqa xmmword [rax - 0x58], xmm0
movdqa xmm0, xmmword [str.0345]
movdqa xmmword [rax - 0x48], xmm1
movdqa xmm1, xmmword [str.q7__0_k2_Q]
movdqa xmmword [rax - 0x38], xmm0
movdqa xmmword [rax - 0x28], xmm1
mov dword [rax - 0x18], 0x8cc67151
call fcn.1400026b0
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x51
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x1400085a3
add rsp, 0xb0
pop rbx
ret