joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008828
Capabilities:
Create pipe
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov edi, reloc.OLEAUT32.dll_SafeArrayGetElement
mov r8d, edi
lea rcx, [rbp - 0x59]
xor edx, edx
call fcn.1400023d8
and qword [rbp + 0x7f], 0
lea r8, [rbp - 0x59]
xor r9d, r9d
mov dword [rbp - 0x59], edi
lea rdx, [rbp + 0x7f]
mov dword [rbp - 0x49], 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1400088b8
lea rcx, [rbp + 0x6f]
call fcn.140007edc
mov rdx, rax
mov rcx, rsi
call fcn.140001930
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._lastError_:__08X__
mov rcx, rsi
mov r8d, eax
call fcn.140001a10
xor eax, eax
jmp 0x1400089ca
and qword [rbp - 0x69], 0
lea rcx, [r14 + 0x28]
xor r9d, r9d
lea r8, [rbp - 0x59]
lea rdx, [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1400088e1
lea rcx, [rbp + 0x6f]
call fcn.140007edc
jmp 0x14000888e
and qword [rbp - 0x61], 0
lea rdx, [r14 + 0x50]
xor r9d, r9d
lea r8, [rbp - 0x59]
lea rcx, [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14000890a
lea rcx, [rbp + 0x6f]
call fcn.140007edc
jmp 0x14000888e
mov r8, rdi
lea rcx, [rbp - 0x41]
xor edx, edx
call fcn.1400023d8
mov edi, 0x68
lea rcx, [rbp - 0x29]
mov r8d, edi
xor edx, edx
call fcn.1400023d8
mov rax, qword [rbp + 0x7f]
mov rcx, rbx
mov qword [rbp + 0x2f], rax
mov rax, qword [rbp - 0x69]
mov qword [rbp + 0x37], rax
mov rax, qword [rbp - 0x61]
mov qword [rbp + 0x27], rax
mov dword [rbp - 0x29], edi
mov dword [rbp + 0x13], 0x100
call fcn.140007998
mov rdi, rax
xor r9d, r9d
lea rax, [rbp - 0x41]
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov rdx, rdi
lea rax, [rbp - 0x29]
xor ecx, ecx
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000200
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, rdi
mov ebx, eax
call fcn.140002438
test ebx, ebx
jne 0x1400089b3
lea rcx, [rbp + 0x6f]
call fcn.140008770
jmp 0x14000888e
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x41]
mov eax, 1
mov qword [r14 + 0x58], rcx
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400089e4
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rsi, rcx
mov rdi, rdx
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edx, dword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.1400091d0
mov edx, dword [rsp + 0xd4]
mov rcx, rax
call fcn.1400091d0
mov edx, dword [rsp + 0xd0]
mov rcx, rax
call fcn.1400091d0
lea rcx, [rsp + 0xd0]
mov r14, rax
call fcn.140009248
mov r13d, eax
mov rcx, rdi
lea rax, [rsp + 0x20]
sub r14, rax
call fcn.14000251c
lea rcx, [rax + 0x100]
call fcn.140002460
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call fcn.140007770
lea rdx, str.__echo
mov rcx, rax
call fcn.140007770
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140007770
lea rdx, [0x14001b85c]
mov rcx, rax
call fcn.140007770
mov rcx, qword [rsi + 0x50]
sub eax, ebx
mov r8d, eax
xor r9d, r9d
mov rdx, rbx
call fcn.140008ee8
mov rcx, rbx
call fcn.140002438
xor r12d, r12d
mov rcx, qword [rsi]
lea rbp, [rsi + 8]
mov r15, qword [rsi + 0x18]
test rcx, rcx
je 0x140008ae9
mov rdx, rbp
call fcn.140008e58
test eax, eax
je 0x140008bb5
mov rdi, qword [rsi + 0x18]
cmp rdi, r15
je 0x140008b4c
cmp rdi, r14
jb 0x140008b4c
cmp r15, r14
mov rbx, r14
cmovae rbx, r15
xor r15d, r15d
sub rdi, rbx
sub rbx, r14
add rbx, qword [rbp]
test rdi, rdi
je 0x140008b42
mov r8d, r14d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000778c
test al, al
je 0x140008b34
inc r12d
cmp r12d, 2
jge 0x140008bd8
inc r15d
inc rbx
movsxd rax, r15d
cmp rax, rdi
jb 0x140008b13
cmp r12d, 2
jge 0x140008bd8
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x140008b62
lea rdx, [rsi + 0x30]
call fcn.140008e58
test eax, eax
je 0x140008bb5
mov rcx, qword [rsi + 0x58]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140008bb5
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp dword [rsi + 0x64], 0
je 0x140008ac9
lea rcx, [rsp + 0xd0]
call fcn.140009248
sub eax, r13d
cmp eax, dword [rsi + 0x64]
jbe 0x140008ac9
mov rcx, qword [rsi + 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, qword [rsi + 0x58]
mov edx, 0xc8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140008bb5
mov rcx, qword [rsi]
test rcx, rcx
je 0x140008c02
mov rdx, rbp
call fcn.140008e58
test eax, eax
je 0x140008bb5
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x140008c18
lea rdx, [rsi + 0x30]
call fcn.140008e58
test eax, eax
je 0x140008bb5
mov rcx, qword [rsi + 0x58]
lea rdx, [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140008c33
cmp dword [rsi + 0x60], 0x103
jne 0x140008bb5
mov al, 1
jmp 0x140008bb7
Function at 0x140008c38
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_SleepEx]
mov eax, dword [str.exit_r_n]
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx + 0x50]
xor r9d, r9d
mov dword [rsp + 0x30], eax
movzx eax, word [0x14001b864]
mov word [rsp + 0x34], ax
mov al, byte [0x14001b866]
lea r8d, [r9 + 7]
mov byte [rsp + 0x36], al
call fcn.140008ee8
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rcx, [rsp + 0x38]
call fcn.140009248
mov edi, eax
mov rcx, qword [rbx]
test rcx, rcx
je 0x140008cb3
lea rdx, [rbx + 8]
call fcn.140008e58
test eax, eax
je 0x140008d0d
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140008cc9
lea rdx, [rbx + 0x30]
call fcn.140008e58
test eax, eax
je 0x140008d0d
mov rcx, qword [rbx + 0x58]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140008d1a
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp dword [rbx + 0x64], 0
je 0x140008c9e
lea rcx, [rsp + 0x38]
call fcn.140009248
sub eax, edi
cmp eax, dword [rbx + 0x64]
jbe 0x140008c9e
mov rcx, qword [rbx + 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
cmp eax, 0xffffffff
je 0x140008d0d
mov rcx, qword [rbx]
test rcx, rcx
je 0x140008d34
lea rdx, [rbx + 8]
call fcn.140008e58
test eax, eax
je 0x140008d0d
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140008d4a
lea rdx, [rbx + 0x30]
call fcn.140008e58
test eax, eax
je 0x140008d0d
mov rcx, qword [rbx + 0x58]
lea rdx, [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140008d0d
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140008d0f

Function at 0x140008e58
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x30
and qword [rax - 0x10], 0
mov rbx, rdx
and dword [rax + 0x18], 0
lea rax, [rax + 0x18]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x140008edb
mov eax, dword [rsp + 0x50]
test eax, eax
jne 0x140008e9d
mov eax, 1
jmp 0x140008edd
mov rdx, rax
mov rcx, rbx
call fcn.14000cb28
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x58]
and dword [rsp + 0x58], 0
mov rdx, rax
and qword [rsp + 0x20], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140008edb
mov edx, dword [rsp + 0x58]
mov rcx, rbx
call fcn.14000cb78
jmp 0x140008e96
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140008f70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
and dword [rsp + 0x30], 0
mov rbx, r9
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140008fa1
test rbx, rbx
je 0x140008f9f
mov eax, dword [rsp + 0x30]
mov qword [rbx], rax
mov al, 1
add rsp, 0x40
pop rbx
ret
Function at 0x140008fa8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, rdx
mov rsi, r8
lea rdx, [0x14001b464]
mov rdi, rcx
xor r12d, r12d
call fcn.140001930
lea ebx, [r12 + 0x12]
mov dword [rsp + 0x20], 0x710030
lea ecx, [rbx - 2]
mov dword [rsp + 0x24], 0x76007f
mov dword [rsp + 0x28], 0x280030
mov dword [rsp + 0x2c], 0x120030
call fcn.140002534
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
lea r9d, [r12 + 8]
lea r13d, [r12 + 2]
lea r14d, [r12 + 1]
movzx ecx, word [r8 + rdx]
xor cx, bx
mov word [rdx], cx
add rdx, r13
sub r9, r14
jne 0x140009023
mov rdx, rax
mov rcx, rdi
call fcn.140001930
mov rcx, rsi
call fcn.14000762c
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.140001984
mov rcx, rbx
call fcn.140002438
lea rdx, [0x14001b468]
mov rcx, rdi
call fcn.140001930
mov rdx, rsi
mov rcx, rbp
call fcn.1400089e4
test al, al
movzx r15d, r12b
lea rbx, [rbp + 8]
mov rdx, r13
mov rcx, rbx
cmovne r15d, r14d
call fcn.14000cb28
mov rcx, rax
mov r8, r13
xor edx, edx
call fcn.1400023d8
lea r14, [rbp + 0x30]
mov rdx, r13
mov rcx, r14
call fcn.14000cb28
mov rcx, rax
mov r8, r13
xor edx, edx
call fcn.1400023d8
mov esi, r12d
cmp qword [rbp + 0x18], r12
je 0x1400090cf
cmp qword [rbp + 0x18], r13
jb 0x1400090ea
mov rax, qword [rbx]
jmp 0x1400090e2
cmp qword [rbp + 0x40], r12
je 0x14000918c
cmp qword [rbp + 0x40], r13
jb 0x1400090ea
mov rax, qword [r14]
cmp byte [rax + 1], r12b
sete sil
lea rdx, str._stdout_:_
mov rcx, rdi
call fcn.140001930
test esi, esi
je 0x14000910a
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.140001984
jmp 0x140009128
mov rcx, qword [rbx]
call fcn.14000762c
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.140001984
mov rcx, rbx
call fcn.140002438
lea rdx, [0x14001b468]
mov rcx, rdi
call fcn.140001930
lea rdx, str._stderr_:_
mov rcx, rdi
call fcn.140001930
test esi, esi
je 0x140009157
mov rdx, qword [r14]
mov rcx, rdi
call fcn.140001984
jmp 0x140009175
mov rcx, qword [r14]
call fcn.14000762c
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.140001984
mov rcx, rbx
call fcn.140002438
lea rdx, [0x14001b468]
mov rcx, rdi
call fcn.140001930
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x40], r12
mov r8d, dword [rbp + 0x60]
lea rdx, str._exitCode_:__08X_
mov rcx, rdi
call fcn.140001a10
lea rdx, [0x14001b474]
mov rcx, rdi
call fcn.140001930
mov rbx, qword [rsp + 0x60]
mov al, r15b
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140009e8c
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, rdx
lea rdi, [rbp - 0x40]
mov r13, rcx
mov al, 0x41
mov byte [rdi], al
inc rdi
inc al
cmp al, 0x5a
jle 0x140009eb4
mov al, 0x61
lea rcx, [rbp - 0x26]
mov byte [rcx], al
inc rcx
inc al
cmp al, 0x7a
jle 0x140009ec5
mov al, 0x30
lea rcx, [rbp - 0xc]
mov byte [rcx], al
inc rcx
inc al
cmp al, 0x39
jle 0x140009ed6
lea rcx, [rdx*4]
mov word [rbp - 2], 0x2f2b
xor ebx, ebx
xor r14d, r14d
call fcn.140002460
xor r11d, r11d
mov r15, rax
test r12, r12
je 0x14000a052
mov eax, r11d
lea esi, [rbx + 3]
mov r10d, r11d
mov cl, byte [r13]
dec r12
mov byte [rbp + rax + 0x48], cl
inc ebx
mov r9b, byte [rbp + 0x4a]
inc rax
mov dl, byte [rbp + 0x49]
inc r13
mov dil, byte [rbp + 0x48]
cmp rax, rsi
jne 0x140009f94
mov al, dil
mov cl, dil
shr al, 2
and cl, sil
mov byte [rbp + 0x58], al
mov r8, r11
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, r9b
mov byte [rbp + 0x59], cl
mov cl, dl
shr al, 6
and cl, 0xf
shl cl, 2
add cl, al
mov al, r9b
and al, 0x3f
mov byte [rbp + 0x5a], cl
mov byte [rbp + 0x5b], al
add r14d, 4
movzx eax, byte [rbp + r8 + 0x58]
inc r8
movzx ecx, byte [rbp + rax - 0x40]
mov word [r15 + r10*2], cx
inc r10
cmp r8, 4
jl 0x140009f72
mov ebx, r11d
mov rax, r11
test r12, r12
jne 0x140009f11
test ebx, ebx
jle 0x14000a052
cmp ebx, esi
jge 0x140009fcf
mov eax, esi
movsxd rcx, ebx
sub eax, ebx
xor edx, edx
movsxd r8, eax
lea rax, [rbp + 0x48]
add rcx, rax
call fcn.1400023d8
mov r9b, byte [rbp + 0x4a]
xor r11d, r11d
mov dl, byte [rbp + 0x49]
mov dil, byte [rbp + 0x48]
mov al, dil
lea ecx, [rbx + 1]
shr al, 2
and dil, sil
mov byte [rbp + 0x58], al
mov al, dl
shr al, 4
and dl, 0xf
shl dil, 4
add dil, al
shl dl, 2
mov al, r9b
mov byte [rbp + 0x59], dil
shr al, 6
and r9b, 0x3f
add dl, al
mov byte [rbp + 0x5b], r9b
mov byte [rbp + 0x5a], dl
movsxd r8, ecx
test ecx, ecx
jle 0x14000a034
movsxd rax, r14d
mov rdx, r11
add r14d, ecx
lea rdi, [r15 + rax*2]
movzx eax, byte [rbp + rdx + 0x58]
inc rdx
movzx ecx, byte [rbp + rax - 0x40]
mov word [rdi], cx
lea rdi, [rdi + 2]
cmp rdx, r8
jl 0x14000a01b
cmp ebx, esi
jge 0x14000a052
movsxd rax, r14d
sub esi, ebx
movsxd rcx, esi
add r14d, esi
lea rdi, [r15 + rax*2]
mov eax, 0x3d
movzx eax, ax
rep stosw word [rdi], ax
mov rcx, qword [rbp + 0x50]
movsxd rax, r14d
mov word [r15 + rax*2], r11w
test rcx, rcx
je 0x14000a066
mov qword [rcx], rax
mov rbx, qword [rsp + 0xa0]
mov rax, r15
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000a088
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x30003e
mov dword [rbp - 0x1c], 0x770060
mov dword [rbp - 0x18], 0x760073
mov dword [rbp - 0x14], 0x600077
lea ecx, [rbx + 0xa]
mov dword [rbp - 0x10], 0x300061
mov dword [rbp - 0xc], 0x320028
mov dword [rbp - 8], 0x120049
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000a0e1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000a104
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x7f0030
mov dword [rbp - 0x3c], 0x660077
mov dword [rbp - 0x38], 0x7d007a
mov dword [rbp - 0x34], 0x300076
lea ecx, [rbx + 0x26]
mov dword [rbp - 0x30], 0x320028
mov dword [rbp - 0x2c], 0x410030
mov dword [rbp - 0x28], 0x730051
mov dword [rbp - 0x24], 0x760060
mov dword [rbp - 0x20], 0x7b005e
mov dword [rbp - 0x1c], 0x660061
mov dword [rbp - 0x18], 0x730051
mov dword [rbp - 0x14], 0x760060
mov dword [rbp - 0x10], 0x450061
mov dword [rbp - 0xc], 0x120030
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xa]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000a18e
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000a1b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x30003e
mov dword [rbp - 0x3c], 0x77007f
mov dword [rbp - 0x38], 0x7a0066
mov dword [rbp - 0x34], 0x76007d
lea ecx, [rbx + 0x28]
mov dword [rbp - 0x30], 0x280030
mov dword [rbp - 0x2c], 0x300032
mov dword [rbp - 0x28], 0x510041
mov dword [rbp - 0x24], 0x600073
mov dword [rbp - 0x20], 0x5e0076
mov dword [rbp - 0x1c], 0x61007b
mov dword [rbp - 0x18], 0x510066
mov dword [rbp - 0x14], 0x600073
mov dword [rbp - 0x10], 0x610076
mov dword [rbp - 0xc], 0x300045
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xb]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000a23e
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x14000a260
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x610030
mov dword [rbp - 0x1c], 0x73007f
mov dword [rbp - 0x18], 0x660060
mov dword [rbp - 0x14], 0x71004d
lea ecx, [rbx + 0xe]
mov dword [rbp - 0x10], 0x600073
mov dword [rbp - 0xc], 0x610076
mov dword [rbp - 8], 0x280030
mov dword [rbp - 4], 0x120069
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000a2c0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000a2e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x12
mov dword [rbp - 0x50], 0x30003e
mov dword [rbp - 0x4c], 0x77007f
mov dword [rbp - 0x48], 0x7a0066
mov dword [rbp - 0x44], 0x76007d
lea ecx, [rbx + 0x34]
mov dword [rbp - 0x40], 0x280030
mov dword [rbp - 0x3c], 0x300032
mov dword [rbp - 0x38], 0x510041
mov dword [rbp - 0x34], 0x600073
mov dword [rbp - 0x30], 0x570076
mov dword [rbp - 0x2c], 0x660061
mov dword [rbp - 0x28], 0x700073
mov dword [rbp - 0x24], 0x7b007e
mov dword [rbp - 0x20], 0x7a0061
mov dword [rbp - 0x1c], 0x7d0051
mov dword [rbp - 0x18], 0x66007c
mov dword [rbp - 0x14], 0x6a0077
mov dword [rbp - 0x10], 0x300066
mov word [rbp - 0xc], bx
call fcn.140002534
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0x11]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000a388
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14000a3b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x12
mov dword [rbp - 0x50], 0x30003e
mov dword [rbp - 0x4c], 0x77007f
mov dword [rbp - 0x48], 0x7a0066
mov dword [rbp - 0x44], 0x76007d
lea ecx, [rbx + 0x34]
mov dword [rbp - 0x40], 0x280030
mov dword [rbp - 0x3c], 0x300032
mov dword [rbp - 0x38], 0x510041
mov dword [rbp - 0x34], 0x600073
mov dword [rbp - 0x30], 0x550076
mov dword [rbp - 0x2c], 0x660077
mov dword [rbp - 0x28], 0x660041
mov dword [rbp - 0x24], 0x660073
mov dword [rbp - 0x20], 0x610067
mov dword [rbp - 0x1c], 0x7a0051
mov dword [rbp - 0x18], 0x7c0073
mov dword [rbp - 0x14], 0x770075
mov dword [rbp - 0x10], 0x300045
mov word [rbp - 0xc], bx
call fcn.140002534
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0x11]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000a458
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14000a480
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x3e
mov dword [rbp - 0x40], 0x30003e
mov dword [rbp - 0x3c], 0x77007f
mov dword [rbp - 0x38], 0x7a0066
mov dword [rbp - 0x34], 0x76007d
lea ebx, [rcx - 0x2c]
mov dword [rbp - 0x30], 0x280030
mov word [rbp - 4], bx
mov dword [rbp - 0x2c], 0x300032
mov dword [rbp - 0x28], 0x510041
mov dword [rbp - 0x24], 0x600073
mov dword [rbp - 0x20], 0x5e0076
mov dword [rbp - 0x1c], 0x61007b
mov dword [rbp - 0x18], 0x400066
mov dword [rbp - 0x14], 0x730077
mov dword [rbp - 0x10], 0x770076
mov dword [rbp - 0xc], 0x610060
mov dword [rbp - 8], 0x300045
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xd]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000a51a
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x14000ab40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x5f004e
mov dword [rbp - 0x3c], 0x68007d
mov dword [rbp - 0x38], 0x7e007b
mov dword [rbp - 0x34], 0x73007e
lea ecx, [rbx + 0x24]
mov dword [rbp - 0x30], 0x54004e
mov dword [rbp - 0x2c], 0x60007b
mov dword [rbp - 0x28], 0x740077
mov dword [rbp - 0x24], 0x6a007d
mov dword [rbp - 0x20], 0x42004e
mov dword [rbp - 0x1c], 0x7d0060
mov dword [rbp - 0x18], 0x7b0074
mov dword [rbp - 0x14], 0x77007e
mov dword [rbp - 0x10], 0x4e0061
mov word [rbp - 0xc], bx
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 9]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000abc7
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000abe8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x7b0030
mov dword [rbp - 0x1c], 0x6a0077
mov dword [rbp - 0x18], 0x7e0062
mov dword [rbp - 0x14], 0x60007d
lea ecx, [rbx + 8]
mov dword [rbp - 0x10], 0x300077
mov dword [rbp - 0xc], 0x490028
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 5]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ac3e
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000ac60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x12
mov dword [rbp - 0x50], 0x5d004e
mov dword [rbp - 0x4c], 0x770062
mov dword [rbp - 0x48], 0x730060
mov dword [rbp - 0x44], 0x410032
lea ecx, [rbx + 0x3e]
mov dword [rbp - 0x40], 0x74007d
mov dword [rbp - 0x3c], 0x650066
mov dword [rbp - 0x38], 0x600073
mov dword [rbp - 0x34], 0x4e0077
mov dword [rbp - 0x30], 0x62005d
mov dword [rbp - 0x2c], 0x600077
mov dword [rbp - 0x28], 0x320073
mov dword [rbp - 0x24], 0x4a0055
mov dword [rbp - 0x20], 0x410032
mov dword [rbp - 0x1c], 0x730066
mov dword [rbp - 0x18], 0x7e0070
mov dword [rbp - 0x14], 0x4e0077
mov dword [rbp - 0x10], 0x7b005a
mov dword [rbp - 0xc], 0x660061
mov dword [rbp - 8], 0x60007d
mov dword [rbp - 4], 0x12006b
call fcn.140002534
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0x16]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ad22
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret