joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021ac0
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
mov rbx, rcx
mov dword [rcx + 8], esi
mov qword [rcx], rsi
cmp dword [rcx + 0xc], esi
jne 0x140021b39
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140021b36
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140021b36
lea r8, [rbx + 8]
lea rdx, [rbx + 4]
mov rcx, rbx
call rax
mov word [rbx + 0xa], si
mov esi, 1
mov dword [rbx + 0xc], esi
cmp dword [rbx + 0xc], 0
jne 0x140021b7e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rbx + 0xc], eax
cmp dword [rbx + 0xc], 0
mov eax, dword [rsp + 0x54]
mov dword [rbx], eax
mov eax, dword [rsp + 0x58]
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x5c]
mov dword [rbx + 8], eax
je 0x140021c33
mov ecx, dword [rbx]
sub ecx, 4
je 0x140021c16
dec ecx
je 0x140021bec
dec ecx
je 0x140021bb0
cmp ecx, 4
jne 0x140021c33
cmp dword [rbx + 4], 0
jne 0x140021c33
mov dword [rbx + 0x10], 0x10
jmp 0x140021c33
mov eax, dword [rbx + 4]
test eax, eax
je 0x140021be3
cmp eax, 1
je 0x140021bda
jbe 0x140021c33
cmp eax, 3
jbe 0x140021bd1
cmp eax, 4
jne 0x140021c33
mov dword [rbx + 0x10], 0xf
jmp 0x140021c33
mov dword [rbx + 0x10], 0xe
jmp 0x140021c33
mov dword [rbx + 0x10], 0xd
jmp 0x140021c33
mov dword [rbx + 0x10], 0xa
jmp 0x140021c33
mov ecx, dword [rbx + 4]
test ecx, ecx
je 0x140021c0d
dec ecx
je 0x140021c04
dec ecx
jne 0x140021c33
mov dword [rbx + 0x10], 7
jmp 0x140021c33
mov dword [rbx + 0x10], 6
jmp 0x140021c33
mov dword [rbx + 0x10], 5
jmp 0x140021c33
mov eax, dword [rbx + 4]
cmp eax, 0xa
je 0x140021c2c
cmp eax, 0x5a
jne 0x140021c33
mov dword [rbx + 0x10], 4
jmp 0x140021c33
mov dword [rbx + 0x10], 3
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140033cf0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140026170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
lea rsi, [0x140000000]
mov ecx, ebx
nop dword [rax]
movsx rax, byte [rcx + rsi + 0x67c40]
add rcx, 6
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x83b4a], al
movsx rax, byte [rcx + rsi + 0x67c3b]
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x83b4b], al
movsx rax, byte [rcx + rsi + 0x67c3c]
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x83b4c], al
movsx rax, byte [rcx + rsi + 0x67c3d]
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x83b4d], al
movsx rax, byte [rcx + rsi + 0x67c3e]
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x83b4e], al
movsx rax, byte [rcx + rsi + 0x67c3f]
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x83b4f], al
cmp rcx, 0x30
jl 0x140026190
mov rax, qword [0x140083b50]
lea r9, [0x140089d00]
mov r8, rbx
mov qword [0x140089d00], rax
mov rax, qword [0x140083b58]
sub rdx, r9
mov qword [0x140089d08], rax
mov rax, qword [0x140083b60]
mov qword [0x140089d10], rax
mov rax, qword [0x140083b68]
mov qword [0x140089d18], rax
mov rax, qword [0x140083b70]
mov qword [0x140089d20], rax
mov rax, qword [0x140083b78]
mov qword [0x140089d28], rax
nop dword [rax]
lea rcx, [r8 + r9]
add r8, 6
movzx eax, byte [rdx + rcx]
xor byte [rcx], al
movzx eax, byte [rdx + rcx + 1]
xor byte [rcx + 1], al
movzx eax, byte [rdx + rcx + 2]
xor byte [rcx + 2], al
movzx eax, byte [rdx + rcx + 3]
xor byte [rcx + 3], al
movzx eax, byte [rdx + rcx + 4]
xor byte [rcx + 4], al
movzx eax, byte [rcx + rdx + 5]
xor byte [rcx + 5], al
cmp r8, 0x30
jl 0x140026280
mov rcx, rdi
call fcn.140026370
nop word [rax + rax]
movsx rax, byte [rbx + rsi + 0x67c70]
add rbx, 4
movzx eax, byte [rax + rdi - 1]
mov byte [rbx + rsi + 0x83b4c], al
movsx rax, byte [rbx + rsi + 0x67c6d]
movzx eax, byte [rax + rdi - 1]
mov byte [rbx + rsi + 0x83b4d], al
movsx rax, byte [rbx + rsi + 0x67c6e]
movzx eax, byte [rax + rdi - 1]
mov byte [rbx + rsi + 0x83b4e], al
movsx rax, byte [rbx + rsi + 0x67c6f]
movzx eax, byte [rax + rdi - 1]
mov byte [rbx + rsi + 0x83b4f], al
cmp rbx, 0x20
jl 0x1400262d0
mov rax, qword [0x140083b50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov qword [rdi], rax
mov rax, qword [0x140083b58]
mov qword [rdi + 8], rax
mov rax, qword [0x140083b60]
mov qword [rdi + 0x10], rax
mov rax, qword [0x140083b68]
mov qword [rdi + 0x18], rax
add rsp, 0x20
pop rdi
ret
Function at 0x140026370
Capabilities:
Encrypt data using des

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r11d, r11d
lea r10, [rcx + 2]
lea r9, [0x140089d01]
lea ebx, [r11 + 8]
lea rdi, [0x140067d10]
nop word [rax + rax]
movzx eax, byte [r9]
movzx ecx, byte [r9 + 1]
movzx edx, byte [r9 - 1]
add al, al
add dl, dl
add r10, 4
add dl, byte [r9 + 4]
add cl, al
add r9, 6
add cl, cl
movsx r8, dl
add cl, byte [r9 - 4]
add r8, r11
add r11, 4
add cl, cl
shl r8, 4
add cl, byte [r9 - 3]
movsx rax, cl
add r8, rax
movzx eax, byte [r8 + rdi]
and al, 1
mov byte [r10 - 6], al
movzx eax, byte [r8 + rdi]
sar al, 1
and al, 1
mov byte [r10 - 5], al
movzx eax, byte [r8 + rdi]
sar al, 2
and al, 1
mov byte [r10 - 4], al
movzx eax, byte [r8 + rdi]
sar al, 3
and al, 1
dec rbx
mov byte [r10 - 3], al
jne 0x1400263a0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x14002a9e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0x120], rax
movsxd rax, dword [rcx + 0x3c]
mov rdi, rcx
mov r11, rdx
mov ecx, dword [rax + rcx + 0x88]
mov eax, dword [rax + rdi + 0x8c]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], rcx
add rcx, rdi
mov eax, dword [rcx + 0x24]
mov ebp, dword [rcx + 0x1c]
mov r10d, dword [rcx + 0x20]
mov ebx, dword [rcx + 0x18]
mov esi, dword [rcx + 0x10]
add rax, rdi
add rbp, rdi
add r10, rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rcx
test edx, 0xffff0000
je 0x14002aa9c
xor r9d, r9d
test ebx, ebx
jle 0x14002aa9c
nop word [rax + rax]
mov eax, dword [r10]
mov r8, r11
add rax, rdi
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14002aa83
inc rax
test ecx, ecx
jne 0x14002aa70
test edx, edx
je 0x14002ab7f
inc r9d
add r10, 4
cmp r9d, ebx
jl 0x14002aa60
mov rcx, qword [rsp + 0x38]
cmp r11d, esi
jb 0x14002ab99
mov eax, dword [rcx + 0x14]
lea ecx, [rax + rsi - 1]
cmp r11d, ecx
ja 0x14002ab99
sub r11d, esi
mov ebx, dword [rbp + r11*4]
mov ecx, dword [rsp + 0x30]
add rbx, rdi
lea rax, [rcx + rdi]
cmp rbx, rax
jb 0x14002ab94
mov eax, dword [rsp + 0x20]
add rax, rcx
add rax, rdi
cmp rbx, rax
ja 0x14002ab94
xor edx, edx
lea rcx, [rsp + 0x41]
mov byte [rsp + 0x40], 0
lea r8d, [rdx + 0x63]
call fcn.140037b90
xor edx, edx
lea rcx, [rsp + 0xb1]
lea r8d, [rdx + 0x63]
mov byte [rsp + 0xb0], 0
call fcn.140037b90
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x40]
mov edx, 0x2e
call fcn.140037af0
test rax, rax
je 0x14002ab94
lea rdx, [rax + 1]
lea rcx, [rsp + 0xb0]
mov byte [rax], 0
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str..dll
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14002ab94
lea rdx, [rsp + 0xb0]
mov rcx, rax
call fcn.14002a9e0
jmp 0x14002ab9b
mov rcx, qword [rsp + 0x28]
movsxd rax, r9d
movzx ecx, word [rcx + rax*2]
mov ebx, dword [rbp + rcx*4]
jmp 0x14002aabd
mov rax, rbx
jmp 0x14002ab9b
xor eax, eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140033cf0
mov rbx, qword [rsp + 0x160]
add rsp, 0x130
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002ba80
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp dword [0x1400898f0], 0
jne 0x14002ba9c
call fcn.14002b2a0
mov dword [0x1400898f0], 1
mov rax, qword [0x140089308]
test rax, rax
jne 0x14002bac1
lea rcx, str.ws2_32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140089308], rax
test rax, rax
je 0x14002bb01
lea rdx, str.connect
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140089308]
lea rdx, str.send
mov qword [0x1400850d0], rax
mov qword [0x1400850d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400850e0], rax
mov qword [0x1400850e8], rax
mov rax, qword [0x140089310]
test rax, rax
jne 0x14002bb26
lea rcx, str.odbc32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140089310], rax
test rax, rax
je 0x14002bb44
lea rdx, str.SQLDrivers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140089540], rax
mov qword [0x140089548], rax
mov rax, qword [0x140089318]
test rax, rax
jne 0x14002bb69
lea rcx, str.dbnetlib.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140089318], rax
test rax, rax
je 0x14002bba9
lea rdx, str.ConnectionObjectSize
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140089318]
lea rdx, str.ConnectionOpen
mov qword [0x1400850f0], rax
mov qword [0x140089550], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400850f8], rax
mov qword [0x140089558], rax
call fcn.14002bc00
mov rax, qword [0x140089328]
test rax, rax
jne 0x14002bbd3
lea rcx, [0x14006a270]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140089328], rax
test rax, rax
je 0x14002bbf1
lea rdx, [0x14006a940]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140085128], rax
mov qword [0x140085130], rax
add rsp, 0x28
ret
Function at 0x14002bca0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140089340]
test rax, rax
jne 0x14002bccd
lea rcx, str.wininet.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140089340], rax
test rax, rax
je 0x14002bdc5
cmp qword [0x140085148], 0
jne 0x14002bdc5
lea rdx, str.InternetReadFileExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140089340]
lea rdx, str.InternetReadFile
mov qword [0x140085148], rax
mov qword [0x140085150], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140089340]
lea rdx, str.InternetOpenUrlW
mov qword [0x140085158], rax
mov qword [0x140085160], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140089340]
lea rdx, str.HttpOpenRequestW
mov qword [0x140085168], rax
mov qword [0x140085170], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140089340]
lea rdx, str.InternetCloseHandle
mov qword [0x140085178], rax
mov qword [0x140085180], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140089340]
lea rdx, str.InternetQueryDataAvailable
mov qword [0x140085188], rax
mov qword [0x140085190], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140089340]
lea rdx, str.InternetOpenW
mov qword [0x140085198], rax
mov qword [0x1400851a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400851a8], rax
mov qword [0x1400851b0], rax
add rsp, 0x28
ret

Function at 0x14002bf40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r10, qword [rcx + rdx*8]
mov r13, r8
lea rbx, [r8*8]
mov rbp, rdx
mov edx, 8
mov r12, r9
mov rdi, rcx
mov dword [rsp + 0x40], 0
mov rsi, qword [r10 + rbx]
shl r13, 6
lea r9, [rsp + 0x40]
lea r8d, [rdx - 4]
lea rcx, [r10 + r13]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r11, qword [rdi + rbp*8]
lea r9, [rsp + 0x40]
mov qword [rbx + r11], r12
mov rcx, qword [rdi + rbp*8]
mov r8d, dword [rsp + 0x40]
add rcx, r13
mov edx, 8
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x14002c778
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x160
mov rax, qword [0x14007bec0]
mov qword [rsp + 0x150], rax
lea rdx, [0x14007b640]
lea rcx, [rsp + 0x20]
mov r8d, 0x12c
call fcn.14002c848
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, 0xe73d110a
lea rax, [rsp + 0x20]
mov ecx, 0x4b
xor rdx, rbx
xor r12, rbx
xor dword [rax], ebx
add rax, 4
dec rcx
jne 0x14002c7cf
lea rcx, [rsp + 0x20]
xor rdx, rbx
call rdx
test rax, rax
mov rsi, rax
je 0x14002c81c
xor r12, rbx
lea rdi, [rsp + 0x34]
mov ebp, 0xe
lea rbx, [0x14007b5c8]
mov rdx, rdi
mov rcx, rsi
call r12
add rdi, 0x14
mov qword [rbx], rax
add rbx, 8
dec rbp
jne 0x14002c800
lea eax, [rbp + 1]
mov rcx, qword [rsp + 0x150]
call fcn.140033cf0
add rsp, 0x160
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002d128
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rax, qword [0x14007bec0]
mov qword [rsp + 0x40], rax
mov r12d, dword [rdx + 0x1c]
xor edi, edi
xor esi, esi
sub r12d, 6
mov rbp, rdx
test r12d, r12d
movsxd rbx, r12d
jle 0x14002d16a
mov rdx, rcx
mov r8, rbx
lea rcx, [rsp + 0x20]
shl r8, 2
call fcn.140033fc0
xor r8d, r8d
xor edx, edx
test r12d, r12d
jle 0x14002d1b4
lea r9d, [r8 + 8]
cmp edi, dword [rbp + 0x1c]
jg 0x14002d1b4
jmp 0x14002d19a
cmp rdx, 4
jge 0x14002d1a3
mov eax, dword [rsp + r8*4 + 0x20]
lea rcx, [r9 + rdx]
inc r8
inc esi
inc rdx
mov dword [rbp + rcx*4], eax
cmp r8, rbx
jl 0x14002d17f
cmp rdx, 4
jne 0x14002d1af
inc edi
add r9, 4
xor esi, esi
xor edx, edx
cmp r8, rbx
jl 0x14002d178
cmp edi, dword [rbp + 0x1c]
movsxd r10, edi
movsxd r9, esi
jg 0x14002d2df
lea r11, [0x14007b250]
lea rsi, str.cw
movzx ecx, byte [rsp + rbx*4 + 0x1d]
mov al, byte [rsp + 0x20]
xor al, byte [rcx + rsi]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + rbx*4 + 0x1e]
mov al, byte [rax + rsi]
xor byte [rsp + 0x21], al
movzx eax, byte [rsp + rbx*4 + 0x1f]
mov al, byte [rax + rsi]
xor byte [rsp + 0x22], al
movzx eax, byte [rsp + rbx*4 + 0x1c]
mov al, byte [rax + rsi]
xor byte [rsp + 0x23], al
mov al, byte [r11]
add r11, 4
xor byte [rsp + 0x20], al
cmp r12d, 8
je 0x14002d22f
mov ecx, 1
jmp 0x14002d228
mov eax, dword [rsp + rcx*4 + 0x1c]
xor dword [rsp + rcx*4 + 0x20], eax
inc rcx
cmp rcx, rbx
jl 0x14002d21d
jmp 0x14002d28c
lea rcx, [rsp + 0x24]
mov edx, 3
mov eax, dword [rcx - 4]
xor dword [rcx], eax
add rcx, 4
dec rdx
jne 0x14002d239
movzx eax, byte [rsp + 0x2c]
lea ecx, [rdx + 5]
mov al, byte [rax + rsi]
xor byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x2d]
mov al, byte [rax + rsi]
xor byte [rsp + 0x31], al
movzx eax, byte [rsp + 0x2e]
mov al, byte [rax + rsi]
xor byte [rsp + 0x32], al
movzx eax, byte [rsp + 0x2f]
mov al, byte [rax + rsi]
xor byte [rsp + 0x33], al
jmp 0x14002d287
mov eax, dword [rsp + rcx*4 + 0x1c]
xor dword [rsp + rcx*4 + 0x20], eax
inc rcx
cmp rcx, rbx
jl 0x14002d27c
xor edx, edx
test r12d, r12d
jle 0x14002d2d6
lea r8, [r10*4 + 8]
cmp edi, dword [rbp + 0x1c]
jg 0x14002d2df
jmp 0x14002d2ba
cmp r9, 4
jge 0x14002d2c3
mov eax, dword [rsp + rdx*4 + 0x20]
lea rcx, [r9 + r8]
inc rdx
mov dword [rbp + rcx*4], eax
inc r9
cmp rdx, rbx
jl 0x14002d2a2
cmp r9, 4
jne 0x14002d2d1
inc edi
inc r10
add r8, 4
xor r9d, r9d
cmp rdx, rbx
jl 0x14002d29b
cmp edi, dword [rbp + 0x1c]
jle 0x14002d1d1
mov rcx, qword [rsp + 0x40]
call fcn.140033cf0
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002d308
Capabilities:
Encode data using xor

Disassembly:
mov r10d, 1
mov r8, rcx
cmp dword [rcx + 0x1c], r10d
jle 0x14002d416
lea r9, [rcx + 0x32]
lea r11, [0x140000000]
movzx edx, byte [r9 + 1]
movzx eax, byte [r9 - 1]
inc r10d
mov ecx, dword [r11 + rdx*4 + 0x7ae50]
xor ecx, dword [r11 + rax*4 + 0x7a650]
movzx eax, byte [r9]
add r9, 0x10
xor ecx, dword [r11 + rax*4 + 0x7aa50]
movzx eax, byte [r9 - 0x12]
xor ecx, dword [r11 + rax*4 + 0x7a250]
mov dword [r9 - 0x12], ecx
movzx ecx, byte [r9 - 0xb]
movzx eax, byte [r9 - 0xc]
mov edx, dword [r11 + rcx*4 + 0x7ae50]
xor edx, dword [r11 + rax*4 + 0x7aa50]
movzx eax, byte [r9 - 0xd]
xor edx, dword [r11 + rax*4 + 0x7a650]
movzx eax, byte [r9 - 0xe]
xor edx, dword [r11 + rax*4 + 0x7a250]
mov dword [r9 - 0xe], edx
movzx ecx, byte [r9 - 7]
movzx eax, byte [r9 - 8]
mov edx, dword [r11 + rcx*4 + 0x7ae50]
xor edx, dword [r11 + rax*4 + 0x7aa50]
movzx eax, byte [r9 - 9]
xor edx, dword [r11 + rax*4 + 0x7a650]
movzx eax, byte [r9 - 0xa]
xor edx, dword [r11 + rax*4 + 0x7a250]
mov dword [r9 - 0xa], edx
movzx eax, byte [r9 - 4]
movzx ecx, byte [r9 - 3]
mov edx, dword [r11 + rcx*4 + 0x7ae50]
xor edx, dword [r11 + rax*4 + 0x7aa50]
movzx eax, byte [r9 - 5]
xor edx, dword [r11 + rax*4 + 0x7a650]
movzx eax, byte [r9 - 6]
xor edx, dword [r11 + rax*4 + 0x7a250]
mov dword [r9 - 6], edx
cmp r10d, dword [r8 + 0x1c]
jl 0x14002d326
ret
Function at 0x14002de68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x14007bec0]
mov qword [rsp + 0x38], rax
mov edi, 8
lea rdx, [0x14007b5e0]
lea rcx, [rsp + 0x20]
mov r8d, edi
call fcn.14002c848
mov rbx, qword [rsp + 0x20]
lea rdx, [0x14007b5d8]
lea rcx, [rsp + 0x20]
mov r8d, edi
call fcn.14002c848
mov rdi, qword [rsp + 0x20]
lea r8, [rsp + 0x28]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x475f4352
mov dword [rsp + 0x2c], 0x646e6172
mov dword [rsp + 0x30], 0x6e65704f
mov dword [rsp + 0x34], 0x676f44
call rbx
test rax, rax
mov rbx, rax
je 0x14002def2
mov edx, 0xffffffff
mov rcx, rax
call rdi
mov rax, rbx
mov rcx, qword [rsp + 0x38]
call fcn.140033cf0
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x14002df08
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov eax, dword [0x14007b570]
xor edi, edi
mov rbx, rcx
and eax, 3
cmp eax, edi
je 0x14002df9d
dec eax
je 0x14002df79
dec eax
je 0x14002df55
dec eax
jne 0x14002dfbf
mov eax, dword [0x14007b580]
lea rdx, [rcx + 2]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
call fcn.14002e018
add dword [0x14007b580], 0x3f2
jmp 0x14002dfbf
mov eax, dword [0x14007b57c]
lea rdx, [rcx + 2]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
call fcn.14002e018
add dword [0x14007b57c], 0x3f2
jmp 0x14002dfbf
mov eax, dword [0x14007b578]
lea rdx, [rcx + 2]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
call fcn.14002e018
add dword [0x14007b578], 0x3f2
jmp 0x14002dfbf
mov eax, dword [0x14007b574]
lea rdx, [rcx + 2]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
call fcn.14002e018
add dword [0x14007b574], 0x3f2
movzx eax, word [rbx + 2]
add dword [0x14007b570], 0x3eb
lea rdx, [rbx + 0x12]
xor word [rbx], ax
mov eax, edi
inc edi
and eax, 3
shl eax, 2
mov ecx, dword [rax + rbx + 2]
xor dword [rdx], ecx
add rdx, 4
cmp edi, 0xa
jb 0x14002dfd4
mov al, byte [rbx + 0x10]
mov rcx, rbx
xor byte [rbx + 0x42], al
mov al, byte [rbx + 0x11]
xor byte [rbx + 0x43], al
call fcn.14002e0e8
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x14002e2b8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
test r8b, 0xf
mov r13d, r8d
mov rbp, rdx
mov r12, rcx
je 0x14002e2eb
mov eax, 1
jmp 0x14002e413
test r8d, r8d
je 0x14002e411
add rcx, 0x14
lea rdx, [r12 + 0x10]
mov eax, dword [rbp]
mov r14d, dword [rbp + 4]
mov r15d, dword [rbp + 8]
add r14d, dword [r12 + 8]
mov dword [rsp + 0x24], eax
mov eax, dword [rbp + 0xc]
add rbp, 0x10
add r13d, 0xfffffff0
add eax, dword [r12 + 0xc]
mov qword [rsp + 0x98], rbp
mov ebp, dword [rsp + 0x24]
mov dword [rsp + 0xa0], r13d
mov r12d, eax
mov r13, rcx
mov qword [rsp + 0x28], 0x14
mov rsi, rdx
lea ecx, [r14 + r14 + 1]
mov edx, 5
imul ecx, r14d
call fcn.14002e438
lea ecx, [r12 + r12 + 1]
mov edx, 5
mov edi, eax
imul ecx, r12d
call fcn.14002e438
mov ecx, edi
mov edx, eax
xor ecx, ebp
mov ebx, eax
call fcn.14002e438
xor ebx, r15d
mov edx, edi
add eax, dword [rsi]
mov ecx, ebx
mov ebp, r14d
mov dword [rsp + 0x24], eax
call fcn.14002e438
add rsi, 8
mov r14d, eax
mov eax, dword [rsp + 0x24]
mov r15d, r12d
add r14d, dword [r13]
add r13, 8
dec qword [rsp + 0x28]
mov r12d, eax
jne 0x14002e347
mov rsi, qword [rsp + 0xa8]
mov r12, qword [rsp + 0x90]
mov r13d, dword [rsp + 0xa0]
mov ecx, dword [r12 + 0xb0]
add r15d, dword [r12 + 0xb4]
lea edx, [rbp + rcx]
mov rbp, qword [rsp + 0x98]
lea rcx, [r12 + 0x14]
mov dword [rsi], edx
mov dword [rsi + 4], r14d
mov dword [rsi + 8], r15d
mov dword [rsi + 0xc], eax
add rsi, 0x10
test r13d, r13d
mov qword [rsp + 0xa8], rsi
lea rdx, [r12 + 0x10]
jne 0x14002e2fd
xor eax, eax
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14002e528
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov rax, rcx
mov esi, r8d
mov ecx, 4
mov rbp, rdx
xor dword [rax], 0x41dfac36
add rax, 4
dec rcx
jne 0x14002e542
mov eax, dword [rdi + 0x10]
mov r8d, eax
lea ecx, [rax + rsi*8]
shr r8d, 3
mov eax, esi
shl eax, 3
and r8d, 0x3f
mov dword [rdi + 0x10], ecx
cmp ecx, eax
jae 0x14002e571
inc dword [rdi + 0x14]
mov eax, esi
mov ebx, 0x40
shr eax, 0x1d
sub ebx, r8d
add dword [rdi + 0x14], eax
cmp esi, ebx
jb 0x14002e5bc
lea rcx, [r8 + rdi + 0x18]
mov r8d, ebx
call 0x14002ef18
lea rdx, [rdi + 0x18]
mov rcx, rdi
call fcn.14002e698
jmp 0x14002e5b0
mov edx, ebx
mov rcx, rdi
add rdx, rbp
call fcn.14002e698
add ebx, 0x40
lea eax, [rbx + 0x3f]
cmp eax, esi
jb 0x14002e5a0
xor r8d, r8d
jmp 0x14002e5be
xor ebx, ebx
sub esi, ebx
lea rcx, [r8 + rdi + 0x18]
mov edx, ebx
add rdx, rbp
mov r8d, esi
add rsp, 0x28
pop rdi
pop rsi
pop rbp
pop rbx
jmp 0x14002ef18
test r8d, r8d
je 0x14002ef30
sub rdx, rcx
mov r8d, r8d
mov al, byte [rdx + rcx]
mov byte [rcx], al
inc rcx
dec r8
jne 0x14002ef23
ret
Function at 0x14002ef78
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.14002efc8
movzx r11d, word [rbx + 2]
xor word [rbx], r11w
xor edx, edx
lea r8, [rbx + 0x12]
mov eax, edx
inc edx
and eax, 3
shl eax, 2
mov ecx, dword [rax + rbx + 2]
xor dword [r8], ecx
add r8, 4
cmp edx, 0xa
jb 0x14002ef95
mov al, byte [rbx + 0x10]
xor byte [rbx + 0x42], al
mov al, byte [rbx + 0x11]
xor byte [rbx + 0x43], al
add rsp, 0x20
pop rbx
ret

Function at 0x14002f0a8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
test r8b, 0xf
mov r14d, r8d
mov r13, rdx
mov r15, rcx
je 0x14002f0db
mov eax, 1
jmp 0x14002f1f5
test r8d, r8d
je 0x14002f1f3
lea rdx, [rcx + 0xa8]
mov edi, dword [r13 + 8]
mov eax, dword [r13]
mov ecx, dword [r13 + 0xc]
mov r12d, dword [r13 + 4]
sub edi, dword [r15 + 0xb4]
add r13, 0x10
add r14d, 0xfffffff0
sub eax, dword [r15 + 0xb0]
mov qword [rsp + 0x88], r13
mov dword [rsp + 0x90], r14d
mov r15d, ecx
mov r13, rdx
mov r14d, 0x14
mov ebp, r15d
mov r15d, edi
mov edx, 5
lea ecx, [r15 + r15 + 1]
mov edi, r12d
mov ebx, eax
mov r12d, eax
imul ecx, r15d
call fcn.14002e438
lea ecx, [r12 + r12 + 1]
mov edx, 5
mov esi, eax
imul ecx, ebx
call fcn.14002e438
sub edi, dword [r13 + 4]
mov ecx, edi
mov edx, eax
mov ebx, eax
call fcn.14002f218
sub ebp, dword [r13]
mov edx, esi
mov edi, eax
mov ecx, ebp
xor edi, esi
call fcn.14002f218
dec r14
xor eax, ebx
sub r13, 8
test r14, r14
jg 0x14002f12d
mov r14d, dword [rsp + 0x90]
mov r13, qword [rsp + 0x88]
mov edx, r12d
mov r12, qword [rsp + 0x98]
mov dword [rsp + 0x20], r15d
mov r15, qword [rsp + 0x80]
sub edx, dword [r15 + 8]
mov ecx, dword [rsp + 0x20]
sub ecx, dword [r15 + 0xc]
mov dword [r12], eax
mov dword [r12 + 4], edx
mov dword [r12 + 8], edi
add r12, 0x10
test r14d, r14d
mov dword [r12 - 4], ecx
mov qword [rsp + 0x98], r12
lea rdx, [r15 + 0xa8]
jne 0x14002f0eb
xor eax, eax
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret