joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004b6c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x40
mov dword [rbp - 0x40], 0x570041
mov dword [rbp - 0x3c], 0x57005e
mov dword [rbp - 0x38], 0x460051
mov dword [rbp - 0x34], 0x380032
lea ebx, [rcx - 0x20]
mov dword [rbp - 0x30], 0x540032
lea edi, [rcx - 0x2e]
mov dword [rbp - 0x2c], 0x5d0040
mov dword [rbp - 0x28], 0x32005f
mov dword [rbp - 0x24], 0x7b0045
mov dword [rbp - 0x20], 0x21007c
mov dword [rbp - 0x1c], 0x4d0020
mov dword [rbp - 0x18], 0x7d005e
mov dword [rbp - 0x14], 0x7b0075
mov dword [rbp - 0x10], 0x730071
mov dword [rbp - 0xc], 0x56007e
mov dword [rbp - 8], 0x61007b
mov dword [rbp - 4], 0x120079
call fcn.140002534
lea r8, [rbp - 0x40]
mov rdx, rax
sub r8, rax
movzx ecx, word [r8 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub rbx, 1
jne 0x140004c08
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret

Function at 0x140004c30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x7b0045
mov dword [rbp - 0x1c], 0x21007c
mov dword [rbp - 0x18], 0x4d0020
mov dword [rbp - 0x14], 0x7d0044
lea ecx, [rbx + 8]
mov dword [rbp - 0x10], 0x67007e
mov dword [rbp - 0xc], 0x77007f
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 5]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004c86
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140004ca8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x7b0045
mov dword [rbp - 0x2c], 0x21007c
mov dword [rbp - 0x28], 0x4d0020
mov dword [rbp - 0x24], 0x610047
lea ecx, [rbx + 0x12]
mov dword [rbp - 0x20], 0x600077
mov dword [rbp - 0x1c], 0x710053
mov dword [rbp - 0x18], 0x7d0071
mov dword [rbp - 0x14], 0x7c0067
mov dword [rbp - 0x10], 0x120066
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, ebx
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004d0e
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140004d30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x7b0045
mov dword [rbp - 0x2c], 0x21007c
mov dword [rbp - 0x28], 0x4d0020
mov dword [rbp - 0x24], 0x660041
lea ecx, [rbx + 0x18]
mov dword [rbp - 0x20], 0x600073
mov dword [rbp - 0x1c], 0x670066
mov dword [rbp - 0x18], 0x510062
mov dword [rbp - 0x14], 0x7f007d
mov dword [rbp - 0x10], 0x73007f
mov dword [rbp - 0xc], 0x76007c
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004da2
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140004dc4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x600055
mov dword [rbp - 0x1c], 0x67007d
mov dword [rbp - 0x18], 0x510062
mov dword [rbp - 0x14], 0x7f007d
lea ecx, [rbx + 0xc]
mov dword [rbp - 0x10], 0x7d0062
mov dword [rbp - 0xc], 0x77007c
mov dword [rbp - 8], 0x66007c
mov word [rbp - 4], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004e21
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140004e44
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x20
mov dword [rbp - 0x20], 0x7b0045
mov dword [rbp - 0x1c], 0x21007c
mov dword [rbp - 0x18], 0x4d0020
mov dword [rbp - 0x14], 0x600055
lea ebx, [rcx - 0xe]
mov dword [rbp - 0x10], 0x67007d
mov dword [rbp - 0xc], 0x470062
mov dword [rbp - 8], 0x770061
mov dword [rbp - 4], 0x120060
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004ea4
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140004ec4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x7d005e
mov dword [rbp - 0x1c], 0x730071
mov dword [rbp - 0x18], 0x53007e
mov dword [rbp - 0x14], 0x710071
lea ecx, [rbx + 8]
mov dword [rbp - 0x10], 0x67007d
mov dword [rbp - 0xc], 0x66007c
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 5]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004f1a
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140004f3c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x730030
mov dword [rbp - 0x2c], 0x710060
mov dword [rbp - 0x28], 0x4d007a
mov dword [rbp - 0x24], 0x710061
lea ecx, [rbx + 0x18]
mov dword [rbp - 0x20], 0x67007d
mov dword [rbp - 0x1c], 0x300066
mov dword [rbp - 0x18], 0x300028
mov dword [rbp - 0x14], 0x220037
mov dword [rbp - 0x10], 0x760020
mov dword [rbp - 0xc], 0x3e0030
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140004fae
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140004fd0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x6b0041
mov dword [rbp - 0x1c], 0x660061
mov dword [rbp - 0x18], 0x7f0077
mov dword [rbp - 0x14], 0x7b0056
lea ecx, [rbx + 0xe]
mov dword [rbp - 0x10], 0x770060
mov dword [rbp - 0xc], 0x660071
mov dword [rbp - 8], 0x60007d
mov dword [rbp - 4], 0x12006b
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140005030
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400073f8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov ebx, 0xf
mov dword [rbp - 0x10], 0x7d45615b
mov ecx, ebx
mov dword [rbp - 0xc], 0x42262465
mov dword [rbp - 8], 0x77717d60
mov word [rbp - 4], 0x6161
mov byte [rbp - 2], 0x12
call fcn.140002534
lea r8, [rbp - 0x10]
mov rdi, rax
sub r8, rax
mov rdx, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140007442
mov ebx, 0xd
mov dword [rbp - 0x10], 0x7c607779
mov ecx, ebx
mov dword [rbp - 0xc], 0x20217e77
mov dword [rbp - 8], 0x7e7e763c
mov byte [rbp - 4], 0x12
call fcn.140002534
lea r8, [rbp - 0x10]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140007483
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400074d2
and dword [rbp + 0x10], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x1400074d2
cmp dword [rbp + 0x10], 1
sete al
jmp 0x1400074d4
xor al, al
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x1400074e4
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x20], 9
je 0x140007507
cmp word [rsp + 0x20], 6
je 0x140007507
xor al, al
jmp 0x140007509
mov al, 1
add rsp, 0x58
ret
Function at 0x140007c2c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
movdqa xmm0, xmmword [0x14001b900]
mov ebx, 0x120
movdqa xmm1, xmmword [0x14001baf0]
mov ecx, ebx
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x14001bce0]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm1, xmmword [0x14001bae0]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x14001b9f0]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x14001bc90]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x14001bb40]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x14001bb20]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x14001bd70]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm1, xmmword [0x14001b9c0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x14001bb70]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x14001bbc0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x14001bb30]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm1, xmmword [0x14001bc40]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm0, xmmword [0x14001bcd0]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm1, xmmword [0x14001ba90]
movdqa xmmword [rbp], xmm0
movdqa xmm0, xmmword [0x14001bd80]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm1, xmmword [str.pw_2t_]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmmword [rbp + 0x30], xmm1
call fcn.140002534
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140007d45
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rbp
ret

Function at 0x140007d68
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
movdqa xmm0, xmmword [0x14001b900]
mov ebx, 0x7d
movdqa xmm1, xmmword [0x14001baf0]
mov ecx, ebx
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [0x14001bd30]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm0, xmmword [0x14001b990]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm1, xmmword [str.gf2Uwf2_s]
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm0, xmmword [0x14001ba50]
movdqa xmmword [rbp + 7], xmm1
movdqa xmm1, xmmword [0x14001bad0]
movdqa xmmword [rbp + 0x37], xmm0
movdqa xmmword [rbp + 0x27], xmm1
mov dword [rbp + 0x47], 0x7d743d32
mov dword [rbp + 0x4b], 0x66737f60
mov dword [rbp + 0x4f], 0x64617128
mov byte [rbp + 0x53], 0x12
call fcn.140002534
lea r8, [rbp - 0x29]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140007e04
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
Function at 0x140007e28
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
movdqa xmm0, xmmword [0x14001b900]
mov ebx, 0x6d
movdqa xmm1, xmmword [0x14001baf0]
mov ecx, ebx
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [0x14001b920]
movdqa xmmword [rbp - 9], xmm1
movdqa xmm1, xmmword [str.Uwf2Qsbf_Q]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm0, xmmword [0x14001bb60]
movdqa xmmword [rbp + 0x17], xmm1
movdqa xmm1, xmmword [0x14001bbe0]
movdqa xmmword [rbp + 0x27], xmm0
movdqa xmmword [rbp + 0x37], xmm1
mov dword [rbp + 0x47], 0x7d743d32
mov dword [rbp + 0x4b], 0x66737f60
mov dword [rbp + 0x4f], 0x64617128
mov byte [rbp + 0x53], 0x12
call fcn.140002534
lea r8, [rbp - 0x19]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140007eb7
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret

Function at 0x140007edc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x7f0030
mov dword [rbp - 0x3c], 0x660077
mov dword [rbp - 0x38], 0x7d007a
mov dword [rbp - 0x34], 0x570076
lea ecx, [rbx + 0x26]
mov dword [rbp - 0x30], 0x600060
mov dword [rbp - 0x2c], 0x60007d
mov dword [rbp - 0x28], 0x280030
mov dword [rbp - 0x24], 0x510030
mov dword [rbp - 0x20], 0x770060
mov dword [rbp - 0x1c], 0x660073
mov dword [rbp - 0x18], 0x420077
mov dword [rbp - 0x14], 0x62007b
mov dword [rbp - 0x10], 0x300077
mov dword [rbp - 0xc], 0x12003e
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xa]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140007f66
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x140007f88
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x14001b900]
mov ebx, 0x5b
movdqa xmm1, xmmword [0x14001ba10]
mov ecx, ebx
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x14001bcb0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x14001b970]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x14001ba30]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x7f607d74
mov dword [rbp - 0xc], 0x71286673
mov word [rbp - 8], 0x6461
mov byte [rbp - 6], 0x12
call fcn.140002534
lea r8, [rbp - 0x60]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008007
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x14000802c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x14001b900]
mov ebx, 0x58
movdqa xmm1, xmmword [0x14001ba10]
mov ecx, ebx
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x14001bc10]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x14001bab0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x14001b940]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x2866737f
mov dword [rbp - 0xc], 0x12646171
call fcn.140002534
lea r8, [rbp - 0x60]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x1400080a1
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret

Function at 0x1400080c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
movdqa xmm0, xmmword [0x14001b900]
mov ebx, 0x9a
movdqa xmm1, xmmword [0x14001baf0]
mov ecx, ebx
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm0, xmmword [0x14001ba20]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [0x14001b9e0]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm1, xmmword [0x14001bb50]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm0, xmmword [str.v_waa_B_vgqf_s]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm1, xmmword [0x14001bbd0]
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm0, xmmword [0x14001bbb0]
movdqa xmmword [rbp + 7], xmm1
movdqa xmm1, xmmword [0x14001bc00]
movdqa xmmword [rbp + 0x37], xmm0
movdqa xmmword [rbp + 0x27], xmm1
mov dword [rbp + 0x47], 0x737f607d
mov dword [rbp + 0x4b], 0x61712866
mov word [rbp + 0x4f], 0x1264
call fcn.140002534
lea r8, [rbp - 0x49]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008175
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rbp
ret

Function at 0x140008198
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
movdqa xmm0, xmmword [0x14001b900]
mov ebx, 0xae
movdqa xmm1, xmmword [0x14001baf0]
mov ecx, ebx
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm0, xmmword [0x14001bb10]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm1, xmmword [0x14001bcc0]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [0x14001b910]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm1, xmmword [str.s_v_ptv_____e]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [0x14001ba60]
movdqa xmmword [rbp - 9], xmm1
movdqa xmm1, xmmword [0x14001b9b0]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm0, xmmword [0x14001bb80]
movdqa xmmword [rbp + 0x17], xmm1
movdqa xmm1, xmmword [0x14001bd60]
movdqa xmmword [rbp + 0x27], xmm0
movdqa xmmword [rbp + 0x37], xmm1
mov dword [rbp + 0x47], 0x743d327c
mov dword [rbp + 0x4b], 0x737f607d
mov dword [rbp + 0x4f], 0x61712866
mov word [rbp + 0x53], 0x1264
call fcn.140002534
lea r8, [rbp - 0x59]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x14000825d
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rbp
ret
Function at 0x140008280
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xa0
movdqa xmm0, xmmword [0x14001b900]
mov ebx, 0x80
movdqa xmm1, xmmword [0x14001baf0]
mov ecx, ebx
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x14001baa0]
movdqa xmmword [rax - 0x78], xmm1
movdqa xmm1, xmmword [0x14001bca0]
movdqa xmmword [rax - 0x58], xmm1
movdqa xmm1, xmmword [0x14001bc70]
movdqa xmmword [rax - 0x68], xmm0
movdqa xmm0, xmmword [0x14001b980]
movdqa xmmword [rax - 0x38], xmm1
movdqa xmm1, xmmword [str.gb2t_]
movdqa xmmword [rax - 0x48], xmm0
movdqa xmm0, xmmword [0x14001ba80]
movdqa xmmword [rax - 0x18], xmm1
movdqa xmmword [rax - 0x28], xmm0
call fcn.140002534
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x14000830b
add rsp, 0xa0
pop rbx
ret

Function at 0x140008328
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x14001b900]
mov ebx, 0x59
movdqa xmm1, xmmword [0x14001ba10]
mov ecx, ebx
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x14001bcb0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x14001bd40]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x14001bb00]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x66737f60
mov dword [rbp - 0xc], 0x64617128
mov byte [rbp - 8], 0x12
call fcn.140002534
lea r8, [rbp - 0x60]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x1400083a1
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret

Function at 0x1400083c4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xa0
movdqa xmm0, xmmword [0x14001b900]
mov ebx, 0x80
movdqa xmm1, xmmword [0x14001baf0]
mov ecx, ebx
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x14001ba40]
movdqa xmmword [rax - 0x78], xmm1
movdqa xmm1, xmmword [0x14001bc80]
movdqa xmmword [rax - 0x58], xmm1
movdqa xmm1, xmmword [0x14001bc60]
movdqa xmmword [rax - 0x68], xmm0
movdqa xmm0, xmmword [0x14001ba70]
movdqa xmmword [rax - 0x38], xmm1
movdqa xmm1, xmmword [str.kbw2t_]
movdqa xmmword [rax - 0x48], xmm0
movdqa xmm0, xmmword [0x14001b9d0]
movdqa xmmword [rax - 0x18], xmm1
movdqa xmmword [rax - 0x28], xmm0
call fcn.140002534
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x14000844f
add rsp, 0xa0
pop rbx
ret
Function at 0x14000846c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x14001b900]
mov ebx, 0x5f
movdqa xmm1, xmmword [0x14001baf0]
mov ecx, ebx
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x14001bc30]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x14001bc50]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x14001bd20]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x3d32667c
mov dword [rbp - 0xc], 0x7f607d74
mov dword [rbp - 8], 0x71286673
mov word [rbp - 4], 0x6461
mov byte [rbp - 2], 0x12
call fcn.140002534
lea r8, [rbp - 0x60]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x1400084f2
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret

Function at 0x140008518
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
movdqa xmm0, xmmword [0x14001b900]
mov ebx, 0x4d
movdqa xmm1, xmmword [0x14001baf0]
mov ecx, ebx
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x14001b930]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm1, xmmword [0x14001bd00]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0x7d743d32
mov dword [rbp - 0xc], 0x66737f60
mov dword [rbp - 8], 0x64617128
mov byte [rbp - 4], 0x12
call fcn.140002534
lea r8, [rbp - 0x50]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008588
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x1400085a8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x14001b900]
mov ebx, 0x5e
movdqa xmm1, xmmword [0x14001baf0]
mov ecx, ebx
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x14001bd10]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x14001bc20]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x14001bb90]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x743d3261
mov dword [rbp - 0xc], 0x737f607d
mov dword [rbp - 8], 0x61712866
mov word [rbp - 4], 0x1264
call fcn.140002534
lea r8, [rbp - 0x60]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x14000862a
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret

Function at 0x140008650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x710030
mov dword [rbp - 0x1c], 0x7f007d
mov dword [rbp - 0x18], 0x73007f
mov dword [rbp - 0x14], 0x76007c
lea ecx, [rbx + 0xa]
mov dword [rbp - 0x10], 0x300061
mov dword [rbp - 0xc], 0x320028
mov dword [rbp - 8], 0x120049
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400086a9
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400086cc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x14001b900]
mov ebx, 0x5d
movdqa xmm1, xmmword [0x14001baf0]
mov ecx, ebx
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x14001ba00]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x14001bbf0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x14001b9a0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x7d743d32
mov dword [rbp - 0xc], 0x66737f60
mov dword [rbp - 8], 0x64617128
mov byte [rbp - 4], 0x12
call fcn.140002534
lea r8, [rbp - 0x60]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x14000874c
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret

Function at 0x140008770
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x7f0030
mov dword [rbp - 0x3c], 0x660077
mov dword [rbp - 0x38], 0x7d007a
mov dword [rbp - 0x34], 0x570076
lea ecx, [rbx + 0x2e]
mov dword [rbp - 0x30], 0x600060
mov dword [rbp - 0x2c], 0x60007d
mov dword [rbp - 0x28], 0x280030
mov dword [rbp - 0x24], 0x510030
mov dword [rbp - 0x20], 0x770060
mov dword [rbp - 0x1c], 0x660073
mov dword [rbp - 0x18], 0x420077
mov dword [rbp - 0x14], 0x7d0060
mov dword [rbp - 0x10], 0x770071
mov dword [rbp - 0xc], 0x610061
mov dword [rbp - 8], 0x300045
mov dword [rbp - 4], 0x12003e
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xe]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140008808
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret