joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006920
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1400d4098]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor ebx, ebx
movdqa xmm0, xmmword [0x1400c39f0]
movdqu xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [str.__p__p_]
movdqu xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400c3820]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x70156370
mov dword [rbp - 5], 0x60706060
mov dword [rbp - 1], 0x11607060
xor eax, eax
mov byte [rbp + 3], al
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x39]
xor byte [rbp + rcx - 0x38], al
inc rcx
cmp rcx, 0x3b
jb 0x140006990
mov byte [rbp + 3], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f], xmm1
lea rax, [rbp - 0x38]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x1400069c1
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0xf]
call fcn.1400154b0
nop
movdqa xmm0, xmmword [0x1400c3550]
movdqu xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400c3170]
movdqu xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400c3730]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x4b2e584b
mov dword [rbp - 5], 0x5b4b5b5b
mov dword [rbp - 1], 0x2a5b4b5b
xor eax, eax
mov byte [rbp + 3], al
nop dword [rax]
movzx eax, byte [rbp - 0x39]
xor byte [rbp + rbx - 0x38], al
inc rbx
cmp rbx, 0x3b
jb 0x140006a20
mov byte [rbp + 3], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3f], xmm1
lea rax, [rbp - 0x38]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140006a50
mov r8, rdi
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x2f]
call fcn.1400154b0
nop
cmp byte [0x1400d5179], 0
je 0x140006a89
lea r8, [0x1400d5200]
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.140003be0
jmp 0x140006a9a
lea rdx, [rbp + 0xf]
lea rcx, [0x1400d5200]
call fcn.1400045e0
nop
mov rdx, qword [rbp + 0x47]
cmp rdx, 0x10
jb 0x140006ad9
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ad3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006ad3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x140006b17
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006b12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400aac90
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140006b40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1400d4098]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor ebx, ebx
movdqa xmm0, xmmword [0x1400c2dc0]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400c2f80]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [str.h_fih_f]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400c2de0]
movdqa xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x6d0c1c14
mov dword [rbp - 5], 0x1d690c1c
xor eax, eax
mov byte [rbp - 1], al
mov ecx, ebx
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rcx - 0x48], al
inc rcx
cmp rcx, 0x47
jb 0x140006bb0
mov byte [rbp - 1], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f], xmm1
lea rax, [rbp - 0x48]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140006be1
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0xf]
call fcn.1400154b0
nop
movdqa xmm0, xmmword [0x1400c3900]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400c3b40]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [0x1400c3b30]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400c38f0]
movdqa xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x9687870
mov dword [rbp - 5], 0x790d6878
xor eax, eax
mov byte [rbp - 1], al
nop
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rbx - 0x48], al
inc rbx
cmp rbx, 0x47
jb 0x140006c40
mov byte [rbp - 1], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3f], xmm1
lea rax, [rbp - 0x48]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140006c70
mov r8, rdi
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x2f]
call fcn.1400154b0
nop
cmp byte [0x1400d514d], 0
je 0x140006ca9
lea r8, [0x1400d5250]
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.140003be0
jmp 0x140006cba
lea rdx, [rbp + 0xf]
lea rcx, [0x1400d5250]
call fcn.1400045e0
nop
mov rdx, qword [rbp + 0x47]
cmp rdx, 0x10
jb 0x140006cf9
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006cf3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006cf3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x140006d37
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006d32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400aac90
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140006d60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1400d4098]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor ebx, ebx
movdqa xmm0, xmmword [0x1400c3680]
movdqu xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400c34a0]
movdqu xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400c3360]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x54444454
mov dword [rbp - 5], 0x41544444
mov dword [rbp - 1], 0x47315444
xor eax, eax
mov byte [rbp + 3], al
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x39]
xor byte [rbp + rcx - 0x38], al
inc rcx
cmp rcx, 0x3b
jb 0x140006dd0
mov byte [rbp + 3], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f], xmm1
lea rax, [rbp - 0x38]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140006e01
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0xf]
call fcn.1400154b0
nop
movdqa xmm0, xmmword [0x1400c3a40]
movdqu xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400c37d0]
movdqu xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400c38a0]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x72626272
mov dword [rbp - 5], 0x67726262
mov dword [rbp - 1], 0x61177262
xor eax, eax
mov byte [rbp + 3], al
nop dword [rax]
movzx eax, byte [rbp - 0x39]
xor byte [rbp + rbx - 0x38], al
inc rbx
cmp rbx, 0x3b
jb 0x140006e60
mov byte [rbp + 3], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3f], xmm1
lea rax, [rbp - 0x38]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140006e90
mov r8, rdi
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x2f]
call fcn.1400154b0
nop
cmp byte [0x1400d5135], 0
je 0x140006ec9
lea r8, [0x1400d5268]
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.140003be0
jmp 0x140006eda
lea rdx, [rbp + 0xf]
lea rcx, [0x1400d5268]
call fcn.1400045e0
nop
mov rdx, qword [rbp + 0x47]
cmp rdx, 0x10
jb 0x140006f19
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006f13
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x140006f57
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006f52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400aac90
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140007e70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1400d4098]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor ebx, ebx
movdqa xmm0, xmmword [0x1400c3350]
movdqu xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400c3020]
movdqu xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400c3630]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x41515141
mov dword [rbp - 5], 0x51415151
mov dword [rbp - 1], 0x20504151
xor eax, eax
mov byte [rbp + 3], al
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x39]
xor byte [rbp + rcx - 0x38], al
inc rcx
cmp rcx, 0x3b
jb 0x140007ee0
mov byte [rbp + 3], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f], xmm1
lea rax, [rbp - 0x38]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140007f11
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0xf]
call fcn.1400154b0
nop
movdqa xmm0, xmmword [0x1400c2d20]
movdqu xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400c3800]
movdqu xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400c2e40]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x3131303
mov dword [rbp - 5], 0x13031313
mov dword [rbp - 1], 0x62120313
xor eax, eax
mov byte [rbp + 3], al
nop dword [rax]
movzx eax, byte [rbp - 0x39]
xor byte [rbp + rbx - 0x38], al
inc rbx
cmp rbx, 0x3b
jb 0x140007f70
mov byte [rbp + 3], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3f], xmm1
lea rax, [rbp - 0x38]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140007fa0
mov r8, rdi
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x2f]
call fcn.1400154b0
nop
cmp byte [0x1400d5147], 0
je 0x140007fd9
lea r8, [0x1400d5360]
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.140003be0
jmp 0x140007fea
lea rdx, [rbp + 0xf]
lea rcx, [0x1400d5360]
call fcn.1400045e0
nop
mov rdx, qword [rbp + 0x47]
cmp rdx, 0x10
jb 0x140008029
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008023
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008023
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x140008067
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008062
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008062
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400aac90
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140008090
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov rax, qword [0x1400d4098]
xor rax, rsp
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [0x1400c3b10]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400c38e0]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x1400c3940]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x781c1e78
mov word [rsp + 0x54], 0x6e1e
xor eax, eax
mov byte [rsp + 0x56], al
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x35
jb 0x1400080f0
mov byte [rsp + 0x56], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
lea rax, [rsp + 0x21]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140008124
lea rdx, [rsp + 0x21]
lea rcx, [rsp + 0x58]
call fcn.1400154b0
nop
lea rdx, [rsp + 0x58]
lea rcx, [0x1400d5688]
call fcn.1400045e0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140008190
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000818b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000818b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400aac90
add rsp, 0x88
ret

Function at 0x1400081b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1400d4098]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400c2f00]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400c2d50]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400c3a00]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x16050f16
mov dword [rbp + 0x1b], 0x160674
mov dword [rbp + 0x1f], 0x21675
xor eax, eax
mov byte [rbp + 0x23], al
xor ecx, ecx
nop
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x140008210
mov byte [rbp + 0x23], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140008240
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.1400154b0
nop
lea rdx, [rbp + 0x27]
lea rcx, [0x1400d5298]
call fcn.1400045e0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x1400082a7
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400082a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400082a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400aac90
add rsp, 0x90
pop rbp
ret
Function at 0x1400082c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1400d4098]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400c33e0]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400c3710]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm0, xmmword [0x1400c3030]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm1, xmmword [0x1400c33d0]
movdqa xmmword [rbp + 7], xmm1
mov dword [rbp + 0x17], 0x2143535b
mov dword [rbp + 0x1b], 0x5b264327
xor eax, eax
mov byte [rbp + 0x1f], al
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 0x47
jb 0x140008330
mov byte [rbp + 0x1f], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x28]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140008360
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x27]
call fcn.1400154b0
nop
lea rdx, [rbp + 0x27]
lea rcx, [0x1400d56d8]
call fcn.1400045e0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x1400083c7
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400083c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400083c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400aac90
add rsp, 0xa0
pop rbp
ret

Function at 0x1400083e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xb8
mov rax, qword [0x1400d4098]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movdqa xmm0, xmmword [0x1400c35f0]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400c3460]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x1400c3400]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1400c35e0]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x1400c3500]
movdqa xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x41345137
xor eax, eax
mov byte [rsp + 0x74], al
xor ecx, ecx
nop
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x53
jb 0x140008450
mov byte [rsp + 0x74], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x90], xmm1
lea rax, [rsp + 0x21]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140008490
lea rdx, [rsp + 0x21]
lea rcx, [rsp + 0x80]
call fcn.1400154b0
nop
lea rdx, [rsp + 0x80]
lea rcx, [0x1400d5280]
call fcn.1400045e0
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x140008508
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008503
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008503
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400aac90
add rsp, 0xb8
ret
Function at 0x140008690
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1400d4098]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400c3390]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400c3040]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400c35d0]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x42525242
mov dword [rbp + 0x1b], 0x52425252
mov dword [rbp + 0x1f], 0x23534252
xor eax, eax
mov byte [rbp + 0x23], al
xor ecx, ecx
nop
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x1400086f0
mov byte [rbp + 0x23], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140008720
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.1400154b0
nop
lea rdx, [rbp + 0x27]
lea rcx, [0x1400d5360]
call fcn.1400045e0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140008787
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008782
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008782
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400aac90
add rsp, 0x90
pop rbp
ret

Function at 0x1400089b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1400d4098]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400c3790]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400c3240]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm0, xmmword [0x1400c3580]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm1, xmmword [0x1400c37a0]
movdqa xmmword [rbp + 7], xmm1
mov dword [rbp + 0x17], 0x475e4c4e
mov dword [rbp + 0x1b], 0x4b3b5e38
xor eax, eax
mov byte [rbp + 0x1f], al
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 0x47
jb 0x140008a20
mov byte [rbp + 0x1f], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x28]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140008a50
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x27]
call fcn.1400154b0
nop
lea rdx, [rbp + 0x27]
lea rcx, [0x1400d52b0]
call fcn.1400045e0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140008ab7
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ab2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008ab2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400aac90
add rsp, 0xa0
pop rbp
ret
Function at 0x140008ad0
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1400d4098]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400c3ae0]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [str.agwo]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm0, xmmword [0x1400c3850]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm1, xmmword [0x1400c3af0]
movdqa xmmword [rbp + 7], xmm1
mov dword [rbp + 0x17], 0x6e776567
mov dword [rbp + 0x1b], 0x62127711
xor eax, eax
mov byte [rbp + 0x1f], al
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 0x47
jb 0x140008b40
mov byte [rbp + 0x1f], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x28]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140008b70
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x27]
call fcn.1400154b0
nop
lea rdx, [rbp + 0x27]
lea rcx, [0x1400d52b0]
call fcn.1400045e0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140008bd7
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008bd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008bd2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400aac90
add rsp, 0xa0
pop rbp
ret

Function at 0x140008bf0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1400d4098]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400c34c0]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400c36f0]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400c3620]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x47575747
mov dword [rbp + 0x1b], 0x52475757
mov dword [rbp + 0x1f], 0x54224757
xor eax, eax
mov byte [rbp + 0x23], al
xor ecx, ecx
nop
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x140008c50
mov byte [rbp + 0x23], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140008c80
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.1400154b0
nop
lea rdx, [rbp + 0x27]
lea rcx, [0x1400d5268]
call fcn.1400045e0
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140008ce7
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ce2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008ce2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab1d8
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400aac90
add rsp, 0x90
pop rbp
ret