joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005b500
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x38], xmm6
mov rdi, rdx
mov rsi, rcx
mov r8, rcx
lea rdx, [rbp - 0x29]
lea rcx, [0x14013b450]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 9]
call fcn.140009d90
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x30]
test rbx, rbx
jne 0x14005b717
mov rax, qword [0x14013b088]
test rax, rax
jne 0x14005b6bf
mov dword [rbp - 0x39], 0x56535d7e
mov dword [rbp - 0x35], 0x40505b7e
mov dword [rbp - 0x31], 0x734b4053
mov dword [rbp + 7], 0x75007b
mov dword [rbp + 0xb], 0x7e0062
mov dword [rbp + 0xf], 0x7c0075
mov dword [rbp + 0x13], 0x20003
mov dword [rbp + 0x17], 0x54001e
mov dword [rbp + 0x1b], 0x5c005c
lea r15d, [rbx + 0x30]
movsd xmm0, qword [rbp - 0x39]
movsd qword [rbp - 0x29], xmm0
mov eax, dword [rbp - 0x31]
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x1d], 0x32
lea ebx, [r15 - 0x23]
mov r14, qword [0x14013ae88]
test r14, r14
jne 0x14005b614
mov ecx, ebx
call fcn.140075634
mov r14, rax
mov qword [0x14013ae88], rax
mov rdx, rax
lea r9, [rbp - 0x29]
sub r9, rax
mov r8d, ebx
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
xor cl, 0x32
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x14005b600
movdqu xmm6, xmmword [rbp + 7]
movaps xmmword [rbp - 0x29], xmm6
movsd xmm0, qword [rbp + 0x17]
movsd qword [rbp - 0x19], xmm0
mov word [rbp - 0x11], r15w
mov rcx, qword [0x14013aee0]
test rcx, rcx
jne 0x14005b6a6
mov ecx, 0x1a
call fcn.140075634
mov rcx, rax
mov qword [0x14013aee0], rax
xor eax, eax
lea rdx, [rcx + 0x18]
lea r8, [rbp - 0x11]
cmp rcx, r8
ja 0x14005b664
lea r8, [rbp - 0x29]
cmp rdx, r8
jae 0x14005b679
movdqa xmm0, xmmword [0x1401209e0]
pxor xmm0, xmm6
movdqu xmmword [rcx], xmm0
mov eax, 8
lea rdx, [rcx + rax*2]
lea r8, [rbp - 0x29]
sub r8, rcx
sub rbx, rax
nop word [rax + rax]
movzx eax, word [rdx + r8]
xor ax, r15w
mov word [rdx], ax
lea rdx, [rdx + 2]
sub rbx, 1
jne 0x14005b690
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013b088], rax
mov rbx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14005b6cc
mov rbx, qword [rdi]
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14005b6d9
mov rcx, qword [rsi]
call rax
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rsi
lea rdx, [rbp - 9]
lea rcx, [0x14013b450]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 0x29]
call fcn.140009d90
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov rcx, rsi
call fcn.140006470
nop
mov rcx, rdi
call fcn.140006470
mov rax, rbx
mov rbx, qword [rsp + 0xd0]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005e8f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
movaps xmmword [rax - 0x38], xmm6
mov r14, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rbp - 0x49], r15d
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 7
mov word [rcx], r15w
mov dword [rbp - 0x49], 1
mov rdx, qword [rdx + 0x10]
add rdx, 1
jne 0x14005e94e
mov qword [rcx + 0x10], rdx
mov word [rcx + rdx*2], r15w
jmp 0x14005e956
xor r8d, r8d
call fcn.1400062f0
lea rax, [rbp - 0x19]
mov qword [rbp + 0x7f], rax
movdqa xmm6, xmmword [0x1401216f0]
mov dword [rbp - 0x29], 0xaad8cbc2
movaps xmmword [rbp - 0x69], xmm6
mov eax, dword [rbp - 0x29]
mov dword [rbp - 0x59], eax
mov rdx, qword [0x14013b550]
test rdx, rdx
jne 0x14005e9f3
mov ebx, 0x14
mov ecx, ebx
call fcn.140075634
mov rdx, rax
mov qword [0x14013b550], rax
mov rax, r15
lea rcx, [rdx + 0x13]
lea r8, [rbp - 0x56]
cmp rdx, r8
ja 0x14005e9b2
lea r8, [rbp - 0x69]
cmp rcx, r8
jae 0x14005e9c7
movdqa xmm0, xmmword [0x1401213e0]
pxor xmm0, xmm6
movdqu xmmword [rdx], xmm0
mov eax, 0x10
lea rcx, [rax + rdx]
lea r8, [rbp - 0x69]
sub r8, rdx
sub rbx, rax
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor al, 0xaa
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rbx, 1
jne 0x14005e9e0
mov qword [rbp - 9], r15
mov qword [rbp - 1], 0xf
mov byte [rbp - 0x19], 0
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14005ea10
lea rcx, [rbp - 0x19]
call fcn.1400064d0
nop
mov dword [rbp - 0x69], 0xe6faede3
mov dword [rbp - 0x65], 0x9a9be4ed
mov dword [rbp - 0x61], 0xc4c4cc86
movsd xmm0, qword [rbp - 0x69]
movsd qword [rbp - 0x39], xmm0
mov eax, dword [rbp - 0x61]
mov dword [rbp - 0x31], eax
mov byte [rbp - 0x2d], 0xa8
mov rdx, qword [0x14013ba00]
test rdx, rdx
jne 0x14005ea93
mov edi, 0xd
mov ecx, edi
call fcn.140075634
mov rdx, rax
mov qword [0x14013ba00], rax
mov rcx, rax
lea r8, [rbp - 0x39]
sub r8, rax
nop dword [rax]
movzx eax, byte [r8 + rcx]
xor al, 0xa8
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x14005ea80
mov qword [rbp + 0x17], r15
mov qword [rbp + 0x1f], 0xf
mov byte [rbp + 7], 0
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14005eaa3
mov r8, rbx
lea rcx, [rbp + 7]
call fcn.1400064d0
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14006ed00
mov edx, dword [rsi + 0x10]
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14005ead6
mov rcx, qword [rsi]
mov r8, r14
cmp qword [r14 + 0x18], 0x10
jb 0x14005eae3
mov r8, qword [r14]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rcx
mov r9d, dword [r14 + 0x10]
xor edx, edx
xor ecx, ecx
call rax
nop
mov rcx, r14
call fcn.140006470
mov rax, rsi
mov rbx, qword [rsp + 0x110]
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005f460
Capabilities:
Create thread
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rcx
mov ecx, 4
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov eax, dword [rcx + rdx]
cmp dword [0x14013e718], eax
jle 0x14005f53b
lea rcx, [0x14013e718]
call fcn.1400758c8
cmp dword [0x14013e718], 0xffffffff
jne 0x14005f53b
xorps xmm0, xmm0
movss dword [0x14013e740], xmm0
xor edi, edi
mov qword [0x14013e748], rdi
mov qword [0x14013e750], rdi
lea ecx, [rdi + 0x20]
call fcn.1400753a0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x14013e748], rax
mov qword [0x14013e758], rdi
xorps xmm0, xmm0
movdqa xmmword [0x14013e760], xmm0
mov qword [0x14013e770], 7
mov qword [0x14013e778], 8
movss xmm0, dword [0x140120914]
movss dword [0x14013e740], xmm0
mov r8, rax
lea edx, [rdi + 0x10]
lea rcx, [0x14013e758]
call fcn.140006690
nop
lea rcx, [0x1400a8310]
call fcn.140075614
nop
lea rcx, [0x14013e718]
call fcn.140075868
mov qword [rsp + 0x58], rbx
movzx edx, bl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs r8, 0x100000001b3
imul rdx, r8
mov rax, rbx
shr rax, 8
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rbx
shr rax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rbx
shr rax, 0x18
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rbx
shr rax, 0x20
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rbx
shr rax, 0x28
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rbx
shr rax, 0x30
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rbx
shr rax, 0x38
xor rdx, rax
imul rdx, r8
and rdx, qword [0x14013e770]
add rdx, rdx
mov rcx, qword [0x14013e758]
mov rax, qword [rcx + rdx*8 + 8]
mov r8, qword [0x14013e748]
cmp rax, r8
je 0x14005f619
mov rcx, qword [rcx + rdx*8]
cmp rbx, qword [rax + 0x10]
je 0x14005f60f
nop
cmp rax, rcx
je 0x14005f619
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x14005f600
test rax, rax
je 0x14005f619
cmp rax, r8
jne 0x14005f65b
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x20]
call fcn.140071f00
mov rdi, qword [rax]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x30]
call fcn.140071f00
mov r8, qword [rax]
add r8, 0x18
cmp byte [rdi + 0x18], 0
jne 0x14005f65b
xor edx, edx
mov rcx, rbx
call fcn.14008b6ac
cmp rax, 0xffffffffffffffff
je 0x14005f65b
mov byte [rdi + 0x18], 1
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x30]
call fcn.140071f00
mov rcx, qword [rax]
movzx eax, byte [rcx + 0x18]
neg al
sbb eax, eax
btr eax, 0x1f
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400667f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rsi, rcx
cvttss2si r8d, xmm1
mov word [rbp + 0x6f], 0x739b
mov byte [rbp + 0x71], 0x64
xor edx, edx
movzx eax, r8b
test r8d, r8d
cmovg edx, eax
mov byte [rbp + 0x72], dl
mov rax, qword [0x14013bb98]
test rax, rax
jne 0x140066851
lea ecx, [rax + 9]
call fcn.140075634
mov qword [0x14013bb98], rax
mov dword [rax], 0x72657375
mov dword [rax + 4], 0x656d616e
mov byte [rax + 8], 0
mov rdx, rax
lea rcx, [rbp + 0x27]
call fcn.140062bc0
mov rdi, rax
cmp qword [rax + 0x18], 0x10
jb 0x14006686a
mov rdi, qword [rax]
cmp byte [0x14013b270], 0
je 0x1400668f6
mov dword [rbp - 0x19], 0xa6a6af82
mov dword [rbp - 0x15], 0xefeae6a5
mov dword [rbp - 0x11], 0xeaf0eab9
mov word [rbp - 0xd], 0xcae3
movsd xmm0, qword [rbp - 0x19]
movsd qword [rbp - 9], xmm0
mov eax, dword [rbp - 0x11]
mov dword [rbp - 1], eax
movzx eax, word [rbp - 0xd]
mov word [rbp + 3], ax
mov rax, qword [0x14013b8d0]
test rax, rax
jne 0x140066974
mov ebx, 0xe
mov ecx, ebx
call fcn.140075634
mov qword [0x14013b8d0], rax
mov rdx, rax
lea r8, [rbp - 9]
sub r8, rax
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
xor cl, 0xca
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub rbx, 1
jne 0x1400668e0
jmp 0x140066974
mov dword [rbp - 9], 0x2e243c03
mov dword [rbp - 5], 0xece03e29
mov dword [rbp - 1], 0xf6ecbfe9
mov word [rbp + 3], 0xe5ec
movsd xmm0, qword [rbp - 9]
movsd qword [rbp - 0x19], xmm0
mov eax, dword [rbp - 1]
mov dword [rbp - 0x11], eax
movzx eax, word [rbp + 3]
mov word [rbp - 0xd], ax
mov byte [rbp - 0xb], 0xcc
mov rax, qword [0x14013b9c0]
test rax, rax
jne 0x140066974
mov ebx, 0xf
mov ecx, ebx
call fcn.140075634
mov qword [0x14013b9c0], rax
mov rdx, rax
lea r9, [rbp - 0x19]
sub r9, rax
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
xor cl, 0xcc
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub rbx, 1
jne 0x140066960
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.140063d60
mov r9, rax
mov rax, qword [rsi + 0x10]
mov eax, dword [rax]
cdq
sub eax, edx
sar eax, 1
mov r10d, eax
mov rax, qword [rsi + 8]
mov eax, dword [rax]
cdq
sub eax, edx
sar eax, 1
mov byte [rsp + 0x30], 1
mov ecx, dword [rbp + 0x6f]
mov dword [rsp + 0x20], ecx
mov r8d, 1
mov edx, r10d
mov ecx, eax
call fcn.1400025c0
nop
lea rcx, [rbp + 0x27]
call fcn.140006470
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
movss xmm1, dword [rdx]
add rcx, 8
jmp 0x1400667f0
Function at 0x140069dc0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x140069de2
xor eax, eax
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140069e21
mov r8, qword [rcx + 0x58]
movsxd r9, dword [r8]
lea rcx, [rdx + r9*2]
cmp rdx, rcx
jae 0x140069e21
lea eax, [r9 - 1]
mov dword [r8], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 2]
mov qword [rcx], rax
movzx eax, si
mov word [rdx], si
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x90], rbp
je 0x140069f33
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140069e68
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140069e91
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.14008bcd4
cmp ax, di
je 0x140069f33
movzx edi, si
jmp 0x140069f33
lea r8, [rsp + 0xa0]
mov word [rsp + 0x40], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x42]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0xa8]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
js 0x140069f33
cmp eax, 1
jle 0x140069eed
cmp eax, 3
jne 0x140069f33
movzx ecx, word [rsp + 0x40]
jmp 0x140069e74
mov rbp, qword [rsp + 0xa0]
lea rax, [rsp + 0x48]
sub rbp, rax
je 0x140069f1d
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rbp
mov edx, 1
call fcn.140088314
cmp rbp, rax
jne 0x140069f33
lea rax, [rsp + 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0xa8], rax
movzx eax, si
jne 0x140069f36
movzx eax, di
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x14006bf30
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14006bffa
cmp byte [rcx + 0x72], 0
je 0x14006bffa
mov rax, qword [rcx]
mov qword [rsp + 0x68], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x14006bfed
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x14006bfaa
sub eax, 1
je 0x14006bfae
cmp eax, 2
jne 0x14006bfed
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x72], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x14006bfdb
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call fcn.140088314
cmp rdi, rax
jne 0x14006bfed
cmp byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x14006d390
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x38], xmm6
mov rdi, rdx
mov rsi, rcx
mov r8, rcx
lea rdx, [rbp - 0x29]
lea rcx, [0x14013b490]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 9]
call fcn.140009d90
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x30]
test rbx, rbx
jne 0x14006d5a7
mov rax, qword [0x14013b7f8]
test rax, rax
jne 0x14006d54f
mov dword [rbp - 0x39], 0x56535d7e
mov dword [rbp - 0x35], 0x40505b7e
mov dword [rbp - 0x31], 0x734b4053
mov dword [rbp + 7], 0x75007b
mov dword [rbp + 0xb], 0x7e0062
mov dword [rbp + 0xf], 0x7c0075
mov dword [rbp + 0x13], 0x20003
mov dword [rbp + 0x17], 0x54001e
mov dword [rbp + 0x1b], 0x5c005c
lea r15d, [rbx + 0x30]
movsd xmm0, qword [rbp - 0x39]
movsd qword [rbp - 0x29], xmm0
mov eax, dword [rbp - 0x31]
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x1d], 0x32
lea ebx, [r15 - 0x23]
mov r14, qword [0x14013b178]
test r14, r14
jne 0x14006d4a4
mov ecx, ebx
call fcn.140075634
mov r14, rax
mov qword [0x14013b178], rax
mov rdx, rax
lea r9, [rbp - 0x29]
sub r9, rax
mov r8d, ebx
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
xor cl, 0x32
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x14006d490
movdqu xmm6, xmmword [rbp + 7]
movaps xmmword [rbp - 0x29], xmm6
movsd xmm0, qword [rbp + 0x17]
movsd qword [rbp - 0x19], xmm0
mov word [rbp - 0x11], r15w
mov rcx, qword [0x14013b528]
test rcx, rcx
jne 0x14006d536
mov ecx, 0x1a
call fcn.140075634
mov rcx, rax
mov qword [0x14013b528], rax
xor eax, eax
lea rdx, [rcx + 0x18]
lea r8, [rbp - 0x11]
cmp rcx, r8
ja 0x14006d4f4
lea r8, [rbp - 0x29]
cmp rdx, r8
jae 0x14006d509
movdqa xmm0, xmmword [0x1401209e0]
pxor xmm0, xmm6
movdqu xmmword [rcx], xmm0
mov eax, 8
lea rdx, [rcx + rax*2]
lea r8, [rbp - 0x29]
sub r8, rcx
sub rbx, rax
nop word [rax + rax]
movzx eax, word [rdx + r8]
xor ax, r15w
mov word [rdx], ax
lea rdx, [rdx + 2]
sub rbx, 1
jne 0x14006d520
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013b7f8], rax
mov rbx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14006d55c
mov rbx, qword [rdi]
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14006d569
mov rcx, qword [rsi]
call rax
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rsi
lea rdx, [rbp - 9]
lea rcx, [0x14013b490]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 0x29]
call fcn.140009d90
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov rcx, rsi
call fcn.140006470
nop
mov rcx, rdi
call fcn.140006470
mov rax, rbx
mov rbx, qword [rsp + 0xd0]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006d5e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x38], xmm6
mov rdi, rdx
mov rsi, rcx
mov r8, rcx
lea rdx, [rbp - 0x29]
lea rcx, [0x14013b490]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 9]
call fcn.140009d90
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x30]
test rbx, rbx
jne 0x14006d7f7
mov rax, qword [0x14013bc80]
test rax, rax
jne 0x14006d79f
mov dword [rbp - 0x39], 0x56535d7e
mov dword [rbp - 0x35], 0x40505b7e
mov dword [rbp - 0x31], 0x734b4053
mov dword [rbp + 7], 0x75007b
mov dword [rbp + 0xb], 0x7e0062
mov dword [rbp + 0xf], 0x7c0075
mov dword [rbp + 0x13], 0x20003
mov dword [rbp + 0x17], 0x54001e
mov dword [rbp + 0x1b], 0x5c005c
lea r15d, [rbx + 0x30]
movsd xmm0, qword [rbp - 0x39]
movsd qword [rbp - 0x29], xmm0
mov eax, dword [rbp - 0x31]
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x1d], 0x32
lea ebx, [r15 - 0x23]
mov r14, qword [0x14013b178]
test r14, r14
jne 0x14006d6f4
mov ecx, ebx
call fcn.140075634
mov r14, rax
mov qword [0x14013b178], rax
mov rdx, rax
lea r9, [rbp - 0x29]
sub r9, rax
mov r8d, ebx
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
xor cl, 0x32
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x14006d6e0
movdqu xmm6, xmmword [rbp + 7]
movaps xmmword [rbp - 0x29], xmm6
movsd xmm0, qword [rbp + 0x17]
movsd qword [rbp - 0x19], xmm0
mov word [rbp - 0x11], r15w
mov rcx, qword [0x14013b528]
test rcx, rcx
jne 0x14006d786
mov ecx, 0x1a
call fcn.140075634
mov rcx, rax
mov qword [0x14013b528], rax
xor eax, eax
lea rdx, [rcx + 0x18]
lea r8, [rbp - 0x11]
cmp rcx, r8
ja 0x14006d744
lea r8, [rbp - 0x29]
cmp rdx, r8
jae 0x14006d759
movdqa xmm0, xmmword [0x1401209e0]
pxor xmm0, xmm6
movdqu xmmword [rcx], xmm0
mov eax, 8
lea rdx, [rcx + rax*2]
lea r8, [rbp - 0x29]
sub r8, rcx
sub rbx, rax
nop word [rax + rax]
movzx eax, word [rdx + r8]
xor ax, r15w
mov word [rdx], ax
lea rdx, [rdx + 2]
sub rbx, 1
jne 0x14006d770
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013bc80], rax
mov rbx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14006d7ac
mov rbx, qword [rdi]
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14006d7b9
mov rcx, qword [rsi]
call rax
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rsi
lea rdx, [rbp - 9]
lea rcx, [0x14013b490]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 0x29]
call fcn.140009d90
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov rcx, rsi
call fcn.140006470
nop
mov rcx, rdi
call fcn.140006470
mov rax, rbx
mov rbx, qword [rsp + 0xd0]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006d830
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x38], xmm6
mov rdi, rdx
mov rsi, rcx
mov r8, rcx
lea rdx, [rbp - 0x29]
lea rcx, [0x14013b490]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 9]
call fcn.140009d90
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x30]
test rbx, rbx
jne 0x14006da47
mov rax, qword [0x14013b928]
test rax, rax
jne 0x14006d9ef
mov dword [rbp - 0x39], 0x56535d7e
mov dword [rbp - 0x35], 0x40505b7e
mov dword [rbp - 0x31], 0x734b4053
mov dword [rbp + 7], 0x75007b
mov dword [rbp + 0xb], 0x7e0062
mov dword [rbp + 0xf], 0x7c0075
mov dword [rbp + 0x13], 0x20003
mov dword [rbp + 0x17], 0x54001e
mov dword [rbp + 0x1b], 0x5c005c
lea r15d, [rbx + 0x30]
movsd xmm0, qword [rbp - 0x39]
movsd qword [rbp - 0x29], xmm0
mov eax, dword [rbp - 0x31]
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x1d], 0x32
lea ebx, [r15 - 0x23]
mov r14, qword [0x14013b178]
test r14, r14
jne 0x14006d944
mov ecx, ebx
call fcn.140075634
mov r14, rax
mov qword [0x14013b178], rax
mov rdx, rax
lea r9, [rbp - 0x29]
sub r9, rax
mov r8d, ebx
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
xor cl, 0x32
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x14006d930
movdqu xmm6, xmmword [rbp + 7]
movaps xmmword [rbp - 0x29], xmm6
movsd xmm0, qword [rbp + 0x17]
movsd qword [rbp - 0x19], xmm0
mov word [rbp - 0x11], r15w
mov rcx, qword [0x14013b528]
test rcx, rcx
jne 0x14006d9d6
mov ecx, 0x1a
call fcn.140075634
mov rcx, rax
mov qword [0x14013b528], rax
xor eax, eax
lea rdx, [rcx + 0x18]
lea r8, [rbp - 0x11]
cmp rcx, r8
ja 0x14006d994
lea r8, [rbp - 0x29]
cmp rdx, r8
jae 0x14006d9a9
movdqa xmm0, xmmword [0x1401209e0]
pxor xmm0, xmm6
movdqu xmmword [rcx], xmm0
mov eax, 8
lea rdx, [rcx + rax*2]
lea r8, [rbp - 0x29]
sub r8, rcx
sub rbx, rax
nop word [rax + rax]
movzx eax, word [rdx + r8]
xor ax, r15w
mov word [rdx], ax
lea rdx, [rdx + 2]
sub rbx, 1
jne 0x14006d9c0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013b928], rax
mov rbx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14006d9fc
mov rbx, qword [rdi]
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14006da09
mov rcx, qword [rsi]
call rax
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rsi
lea rdx, [rbp - 9]
lea rcx, [0x14013b490]
call fcn.14000a080
mov rcx, qword [rax]
add rcx, 0x30
mov r8, rdi
lea rdx, [rbp - 0x29]
call fcn.140009d90
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov rcx, rsi
call fcn.140006470
nop
mov rcx, rdi
call fcn.140006470
mov rax, rbx
mov rbx, qword [rsp + 0xd0]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret