joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010c20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x420030
mov dword [rbp - 0x1c], 0x5b0041
mov dword [rbp - 0x18], 0x42003f
mov dword [rbp - 0x14], 0x67007e
lea ecx, [rbx + 8]
mov dword [rbp - 0x10], 0x300061
mov dword [rbp - 0xc], 0x490028
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 5]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140010c76
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140010c98
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x73004e
mov dword [rbp - 0x1c], 0x710071
mov dword [rbp - 0x18], 0x67007d
mov dword [rbp - 0x14], 0x66007c
lea ecx, [rbx + 0xa]
mov dword [rbp - 0x10], 0x3c0061
mov dword [rbp - 0xc], 0x7f006a
mov dword [rbp - 8], 0x12007e
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140010cf1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140010d14
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, rdx
mov r13, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cdq
and edx, 3
add eax, edx
sar eax, 2
movsxd r14, eax
lea rcx, [r14 + 1]
call fcn.140002460
mov rcx, r12
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test r14, r14
jle 0x140010e03
movsxd rdx, eax
xor r15d, r15d
xor ecx, ecx
mov qword [rsp + 0x28], rdx
xor eax, eax
mov dword [rsp + 0x88], eax
xor esi, esi
mov r8d, 4
cmp rcx, rdx
movsxd rdx, eax
cmovle rsi, rcx
add rdx, r13
lea rcx, [rsp + 0x80]
call fcn.1400024b0
mov cl, byte [rsp + 0x80]
call fcn.14000756c
mov cl, byte [rsp + 0x81]
mov ebx, eax
shl ebx, 4
call fcn.14000756c
mov cl, byte [rsp + 0x82]
call fcn.14000756c
mov cl, byte [rsp + 0x83]
shl ebx, 4
add ebx, eax
shl ebx, 4
call fcn.14000756c
mov rdx, qword [rsp + 0x28]
lea rcx, [rsi + 1]
add eax, ebx
xor al, byte [rsi + r12]
mov byte [r15 + rbp], al
inc r15
mov eax, dword [rsp + 0x88]
add eax, 4
mov dword [rsp + 0x88], eax
cmp r15, r14
jl 0x140010d74
mov rbx, qword [rsp + 0x70]
mov rax, rbp
mov byte [r14 + rbp], 0
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140010e70
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x7e0]
sub rsp, 0x8e0
mov rbx, rdx
mov r12, rcx
lea rdx, [rsp + 0x60]
mov r8d, 0x208
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [0x14001c2e8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.profiles
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14001c5e4]
lea rcx, [rbp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140011075
lea eax, [rdi + 2]
jmp 0x140011098
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14001c2e8]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x3ac]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x820]
call fcn.140010c98
mov rdx, rax
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x170]
call fcn.1400125c8
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140011075
mov rcx, qword [rsp + 0x38]
inc rcx
call fcn.140002460
mov rdx, qword [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov rsi, rax
test rdx, rdx
jle 0x140010fe5
mov rcx, qword [rsp + 0x30]
inc r9d
mov dl, byte [r8 + rcx]
mov byte [r8 + rax], dl
inc r8
mov rdx, qword [rsp + 0x38]
movsxd rcx, r9d
cmp rcx, rdx
jl 0x140010fc5
mov byte [rdx + rax], 0
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
mov rcx, rsi
inc rdx
call fcn.140010e20
mov ecx, 0x2ed4
mov r15, rax
call fcn.140002460
lea rcx, [rsp + 0x40]
mov r14, rax
call fcn.1400174d0
mov r8d, dword [rsp + 0x58]
lea rcx, [rsp + 0x40]
mov r9, r14
mov dword [rsp + 0x20], 0x3e7
mov rdx, r15
call fcn.1400174dc
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call fcn.140002438
test ebx, ebx
jne 0x140011065
mov r8d, dword [rsp + 0x44]
lea r9, [rbp + 0x820]
mov rdx, r14
mov qword [rsp + 0x20], r12
mov rcx, r15
call fcn.1400114c8
and dword [rsp + 0x44], ebx
mov rcx, r14
call fcn.140002438
mov rcx, rsi
call fcn.140002438
lea rdx, [rbp + 0x380]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140010f30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400110b4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x188]
sub rsp, 0x270
mov r15, rcx
lea rdx, [rsp + 0x60]
lea rcx, str.APPDATA
mov r8d, 0x208
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x198]
call fcn.140010b88
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.1400125c8
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x14001112e
mov eax, 1
jmp 0x1400111fd
mov rcx, qword [rsp + 0x38]
inc rcx
call fcn.140002460
mov r10, qword [rsp + 0x38]
xor r9d, r9d
mov rdi, rax
test r10, r10
jle 0x14001116a
mov r8, qword [rsp + 0x30]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
inc r9d
mov byte [rdx], cl
inc rdx
movsxd rax, r9d
cmp rax, r10
jl 0x140011156
mov byte [r10 + rdi], 0
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
mov rcx, rdi
inc rdx
call fcn.140010e20
mov ecx, 0x2ed4
mov r14, rax
call fcn.140002460
lea rcx, [rsp + 0x40]
mov rsi, rax
call fcn.1400174d0
mov r8d, dword [rsp + 0x58]
lea rcx, [rsp + 0x40]
mov r9, rsi
mov dword [rsp + 0x20], 0x3e7
mov rdx, r14
call fcn.1400174dc
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call fcn.140002438
test ebx, ebx
jne 0x1400111eb
mov r8d, dword [rsp + 0x44]
lea r9, [rbp + 0x198]
mov rdx, rsi
mov qword [rsp + 0x20], r15
mov rcx, r14
call fcn.1400112c8
and dword [rsp + 0x44], ebx
mov rcx, rsi
call fcn.140002438
mov rcx, rdi
call fcn.140002438
xor eax, eax
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14001121c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x40
mov edi, 0x12
mov dword [rax - 0x28], 0x710030
mov rbx, rcx
mov dword [rax - 0x24], 0x73007a
mov ecx, edi
mov dword [rax - 0x20], 0x300066
mov dword [rax - 0x1c], 0x690028
mov word [rax - 0x18], di
call fcn.140002534
lea r9, [rsp + 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 9]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140011266
mov rdx, rax
mov rcx, rbx
call fcn.140001930
mov rcx, rbx
call fcn.1400116e8
mov rcx, rbx
call fcn.14001189c
mov rcx, rbx
call fcn.1400119c4
mov edx, 0x2c
mov rcx, rbx
call fcn.140001a5c
lea rdx, [0x14001b474]
mov rcx, rbx
call fcn.140001930
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x1400112c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
and qword [rsp + 0x40], 0
xor r15b, r15b
xor esi, esi
xorps xmm0, xmm0
mov r12d, r8d
mov r13, rdx
mov r14, rcx
movdqu xmmword [rsp + 0x30], xmm0
test r8d, r8d
je 0x1400114a6
lea rcx, [rsi + rsi*2]
lea rdi, [rcx*4]
add rdi, r13
movzx ecx, word [rdi]
test ecx, ecx
je 0x14001146e
sub ecx, 1
je 0x1400113fb
cmp ecx, 1
jne 0x140011495
mov rdx, rdi
mov rcx, r14
call fcn.140011690
mov rbx, rax
test r15b, r15b
je 0x140011495
lea rdx, str.name
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
mov rcx, qword [rsp + 0x30]
test eax, eax
mov dword [rsp + 0x20], 0x61617362
cmove rcx, rbx
mov dword [rsp + 0x24], 0x76607d65
mov qword [rsp + 0x30], rcx
mov ecx, 9
mov byte [rsp + 0x28], 0x12
call fcn.140002534
lea r9, [rsp + 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 9
mov cl, byte [r9 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub r8, 1
jne 0x1400113a7
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
mov rcx, qword [rsp + 0x38]
lea rdx, str.protocol
test eax, eax
cmove rcx, rbx
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140011495
mov qword [rsp + 0x40], rbx
jmp 0x140011495
mov rdx, rdi
mov rcx, r14
call fcn.140011690
lea rdx, str.current_error
mov rcx, rax
mov rbx, rax
xor r15b, r15b
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
xor ecx, ecx
test eax, eax
jne 0x140011464
cmp qword [rsp + 0x30], rcx
je 0x140011464
cmp qword [rsp + 0x40], rcx
je 0x140011464
cmp qword [rsp + 0x38], rcx
jne 0x140011447
lea ecx, [rax + 1]
call fcn.140002460
mov byte [rax], r15b
mov qword [rsp + 0x38], rax
mov rcx, qword [rbp + 0xb0]
lea rdx, [rsp + 0x30]
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.140017798
and qword [rsp + 0x38], 0
mov rcx, rbx
call fcn.140002438
jmp 0x140011495
mov rdx, rdi
mov rcx, r14
call fcn.140011690
mov rdx, rax
lea rcx, [rsp + 0x50]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, rbx
call fcn.140002438
mov r15b, 1
movzx eax, word [rdi + 2]
inc esi
add esi, eax
cmp esi, r12d
jb 0x140011312
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400114c8
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x14001168d
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
xor r15b, r15b
mov r12d, r8d
xor esi, esi
mov r13, rdx
mov r14, rcx
lea rcx, [rsi + rsi*2]
lea rdi, [rcx*4]
add rdi, r13
movzx ecx, word [rdi]
test ecx, ecx
je 0x140011635
sub ecx, 1
je 0x1400115e5
cmp ecx, 1
jne 0x14001165c
mov rdx, rdi
mov rcx, r14
call fcn.140011690
mov rbx, rax
test r15b, r15b
je 0x14001165c
lea rdx, [0x14001c5a0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
mov rcx, qword [rsp + 0x30]
test eax, eax
mov dword [rsp + 0x20], 0x61617362
cmove rcx, rbx
mov dword [rsp + 0x24], 0x76607d65
mov qword [rsp + 0x30], rcx
mov ecx, 9
mov byte [rsp + 0x28], 0x12
call fcn.140002534
lea r9, [rsp + 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 9
mov cl, byte [r9 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub r8, 1
jne 0x140011598
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
mov rcx, qword [rsp + 0x38]
lea rdx, str.port
test eax, eax
cmove rcx, rbx
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x14001165c
mov qword [rsp + 0x40], rbx
jmp 0x14001165c
mov rdx, rdi
mov rcx, r14
call fcn.140011690
mov rcx, rax
mov rbx, rax
xor r15b, r15b
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 2
jl 0x14001162b
cmp byte [rbx], 0x61
jne 0x14001162b
mov cl, byte [rbx + 1]
sub cl, 0x30
cmp cl, 9
ja 0x14001162b
mov rcx, qword [rbp + 0xb0]
lea rdx, [rsp + 0x30]
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.140017798
mov rcx, rbx
call fcn.140002438
jmp 0x14001165c
mov rdx, rdi
mov rcx, r14
call fcn.140011690
mov rdx, rax
lea rcx, [rsp + 0x50]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, rbx
call fcn.140002438
mov r15b, 1
movzx eax, word [rdi + 2]
inc esi
add esi, eax
cmp esi, r12d
jb 0x140011503
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400116e8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rdi, rcx
lea rcx, [rbp - 0x18]
call fcn.140017710
mov esi, 0x12
mov dword [rbp + 0x28], 0x610042
mov dword [rbp + 0x2c], 0x12007b
lea ebx, [rsi - 0xa]
mov ecx, ebx
call fcn.140002534
lea r8, [rbp + 0x28]
mov rdx, rax
sub r8, rax
lea r9d, [rsi - 0xe]
movzx ecx, word [r8 + rdx]
xor cx, si
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r9, 1
jne 0x140011734
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.140010e70
test eax, eax
jne 0x14001187b
lea ecx, [rax + 0x10]
mov dword [rbp - 0x40], 0x420030
mov dword [rbp - 0x3c], 0x5b0041
mov dword [rbp - 0x38], 0x280030
mov dword [rbp - 0x34], 0x120049
call fcn.140002534
lea r8, [rbp - 0x40]
mov rdx, rax
sub r8, rax
movzx ecx, word [r8 + rdx]
xor cx, si
mov word [rdx], cx
lea rdx, [rdx + 2]
sub rbx, 1
jne 0x14001178b
mov rdx, rax
mov rcx, rdi
call fcn.140001930
lea esi, [rbx + 0x18]
jmp 0x140011847
lea rdx, str._url_:_
call fcn.140001930
mov rdx, qword [rbp - 0x30]
mov rcx, rdi
call fcn.1400019bc
lea rdx, str.___port_:_
mov rcx, rdi
call fcn.140001930
mov rdx, qword [rbp - 0x20]
mov rcx, rdi
call fcn.1400019bc
mov rcx, qword [rbp - 0x20]
call fcn.140002438
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
call fcn.140010d14
mov rcx, qword [rbp - 0x28]
mov rbx, rax
call fcn.140002438
mov rcx, qword [rbp - 0x30]
call fcn.140002438
lea rcx, [rbp + 0x28]
call fcn.14000cd4c
mov rdx, rax
mov rcx, rdi
call fcn.140001930
mov rdx, rbx
mov rcx, rdi
call fcn.1400019bc
mov rcx, rbx
call fcn.140002438
lea rdx, [0x14001c0a8]
mov rcx, rdi
call fcn.140001930
mov r8, rsi
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x18]
call fcn.140017748
mov rcx, rdi
test eax, eax
je 0x1400117b3
mov edx, 0x2c
call fcn.140001a5c
lea rdx, [0x14001be7c]
mov rcx, rdi
call fcn.140001930
lea rcx, [rbp - 0x18]
call fcn.140017704
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14001189c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.140017710
mov edi, 0x12
mov dword [rbp - 0x40], 0x610042
mov dword [rbp - 0x3c], 0x39007b
mov word [rbp - 0x38], di
lea ecx, [rdi - 8]
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 0xd]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400118e7
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.140010e70
test eax, eax
jne 0x1400119a6
lea rcx, [rbp + 0x18]
call fcn.140010c20
mov rdx, rax
mov rcx, rbx
call fcn.140001930
mov edi, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x140011976
lea rdx, str._url_:_
call fcn.140001930
mov rdx, qword [rbp - 0x30]
mov rcx, rbx
call fcn.1400019bc
lea rdx, str.___port_:_
mov rcx, rbx
call fcn.140001930
mov rdx, qword [rbp - 0x20]
mov rcx, rbx
call fcn.1400019bc
mov rcx, qword [rbp - 0x20]
call fcn.140002438
lea rdx, [0x14001c0a8]
mov rcx, rbx
call fcn.140001930
mov r8, rdi
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x18]
call fcn.140017748
mov rcx, rbx
test eax, eax
je 0x14001192b
mov edx, 0x2c
call fcn.140001a5c
lea rdx, [0x14001be7c]
mov rcx, rbx
call fcn.140001930
lea rcx, [rbp - 0x18]
call fcn.140017704
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400119c4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
lea rcx, [rbp - 0x20]
call fcn.140017710
lea rcx, [rbp - 0x20]
call fcn.1400110b4
test eax, eax
jne 0x140011b18
lea edi, [rax + 0x12]
mov dword [rbp - 0x50], 0x420030
lea ecx, [rax + 0x16]
mov word [rbp - 0x3c], di
mov dword [rbp - 0x4c], 0x76007b
mov dword [rbp - 0x48], 0x7b0075
mov dword [rbp - 0x44], 0x30007c
mov dword [rbp - 0x40], 0x490028
call fcn.140002534
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 7]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140011a33
mov rdx, rax
mov rcx, rbx
call fcn.140001930
and qword [rbp - 0x28], 0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov edi, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x140011ae4
lea rdx, str._url_:_
call fcn.140001930
mov rdx, qword [rbp - 0x38]
mov rcx, rbx
call fcn.1400019bc
mov rcx, qword [rbp - 0x38]
call fcn.140002438
lea rdx, str.___port_:_
mov rcx, rbx
call fcn.140001930
mov rdx, qword [rbp - 0x28]
mov rcx, rbx
call fcn.1400019bc
mov rcx, qword [rbp - 0x28]
call fcn.140002438
lea rcx, [rbp + 0x18]
call fcn.14000cd4c
mov rdx, rax
mov rcx, rbx
call fcn.140001930
mov rdx, qword [rbp - 0x30]
mov rcx, rbx
call fcn.1400019bc
mov rcx, qword [rbp - 0x30]
call fcn.140002438
lea rdx, [0x14001c0a8]
mov rcx, rbx
call fcn.140001930
mov r8, rdi
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x20]
call fcn.140017748
mov rcx, rbx
test eax, eax
je 0x140011a67
mov edx, 0x2c
call fcn.140001a5c
lea rdx, [0x14001be7c]
mov rcx, rbx
call fcn.140001930
lea rcx, [rbp - 0x20]
call fcn.140017704
lea r11, [rsp + 0x70]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140011b38
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x12
mov dword [rbp - 0x50], 0x7d0041
mov dword [rbp - 0x4c], 0x660074
mov dword [rbp - 0x48], 0x730065
mov dword [rbp - 0x44], 0x770060
lea ecx, [rbx + 0x36]
mov dword [rbp - 0x40], 0x41004e
mov dword [rbp - 0x3c], 0x7f007b
mov dword [rbp - 0x38], 0x7c007d
mov dword [rbp - 0x34], 0x730046
mov dword [rbp - 0x30], 0x7a0066
mov dword [rbp - 0x2c], 0x7f0073
mov dword [rbp - 0x28], 0x42004e
mov dword [rbp - 0x24], 0x460067
mov dword [rbp - 0x20], 0x4b0046
mov dword [rbp - 0x1c], 0x41004e
mov dword [rbp - 0x18], 0x610077
mov dword [rbp - 0x14], 0x7b0061
mov dword [rbp - 0x10], 0x7c007d
mov dword [rbp - 0xc], 0x120061
call fcn.140002534
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0x12]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140011bec
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140011c1c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x5f0030
mov dword [rbp - 0x1c], 0x70007d
mov dword [rbp - 0x18], 0x4a0073
mov dword [rbp - 0x14], 0x770066
lea ecx, [rbx + 0xa]
mov dword [rbp - 0x10], 0x7f0060
mov dword [rbp - 0xc], 0x280030
mov dword [rbp - 8], 0x120049
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140011c75
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140011c98
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x7d0041
mov dword [rbp - 0x3c], 0x660074
mov dword [rbp - 0x38], 0x730065
mov dword [rbp - 0x34], 0x770060
lea ecx, [rbx + 0x24]
mov dword [rbp - 0x30], 0x5f004e
mov dword [rbp - 0x2c], 0x70007d
mov dword [rbp - 0x28], 0x660073
mov dword [rbp - 0x24], 0x790077
mov dword [rbp - 0x20], 0x5f004e
mov dword [rbp - 0x1c], 0x70007d
mov dword [rbp - 0x18], 0x4a0073
mov dword [rbp - 0x14], 0x770066
mov dword [rbp - 0x10], 0x7f0060
mov word [rbp - 0xc], bx
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 9]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140011d24
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x1400122f4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov dword [rax - 0x18], 0x610030
mov edi, 0x12
mov dword [rax - 0x14], 0x7a0061
mov dword [rax - 0x10], 0x280030
mov dword [rax - 0xc], 0x120069
lea ecx, [rdi - 2]
call fcn.140002534
lea r9, [rsp + 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 0xa]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14001233b
mov rdx, rax
mov rcx, rbx
call fcn.140001930
mov rcx, rbx
call fcn.14001246c
mov rcx, rbx
call fcn.140012394
mov edx, 0x2c
mov rcx, rbx
call fcn.140001a5c
lea rdx, [0x14001b474]
mov rcx, rbx
call fcn.140001930
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x14001246c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
lea rcx, [rbp - 0x20]
call fcn.140017710
lea rcx, [rbp - 0x20]
call fcn.14001203c
test eax, eax
jne 0x1400125a8
lea ecx, [rax + 0x14]
mov dword [rbp - 0x50], 0x420030
mov dword [rbp - 0x4c], 0x660067
lea edi, [rax + 0x12]
mov dword [rbp - 0x48], 0x6b0066
mov dword [rbp - 0x44], 0x280030
mov dword [rbp - 0x40], 0x120049
call fcn.140002534
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 8]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400124d7
mov rdx, rax
mov rcx, rbx
call fcn.140001930
mov edi, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x140012574
lea rdx, str._url_:_
call fcn.140001930
mov rdx, qword [rbp - 0x38]
mov rcx, rbx
call fcn.140001984
mov rcx, qword [rbp - 0x38]
call fcn.140002438
lea rdx, str.___protocol_:_
mov rcx, rbx
call fcn.140001930
mov rdx, qword [rbp - 0x30]
mov rcx, rbx
call fcn.140001984
mov rcx, qword [rbp - 0x30]
call fcn.140002438
lea rdx, str.___port_:_
mov rcx, rbx
call fcn.140001930
mov r8d, dword [rbp - 0x28]
lea rdx, [0x14001be20]
mov rcx, rbx
call fcn.140001a10
lea rdx, [0x14001c0a8]
mov rcx, rbx
call fcn.140001930
mov r8, rdi
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x20]
call fcn.140017748
mov rcx, rbx
test eax, eax
je 0x1400124fe
mov edx, 0x2c
call fcn.140001a5c
lea rdx, [0x14001be7c]
mov rcx, rbx
call fcn.140001930
lea rcx, [rbp - 0x20]
call fcn.140017704
lea r11, [rsp + 0x70]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret