joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140049bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x30], 0x72657551
mov dword [rbp - 0x1a], 0x79636e
mov dword [rbp - 0x1f], 0x75716572
mov dword [rbp - 0x26], 0x6e616d72
mov word [rbp - 0x2b], 0x6550
mov word [rbp - 0x22], 0x6563
mov byte [rbp - 0x2c], 0x79
mov word [rbp - 0x28], 0x6f66
mov byte [rbp - 0x1b], 0x65
mov byte [rbp - 0x20], 0x46
mov byte [rbp - 0x29], 0x72
call fcn.140049e40
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140049c47
lea rcx, [0x1400aea30]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x50
pop rbp
ret
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x50
pop rbp
ret

Function at 0x140049c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx esi, r8b
mov word [rsp + 0x26], 0x6f43
mov edi, edx
mov dword [rsp + 0x21], 0x65537265
mov rbx, rcx
mov dword [rsp + 0x28], 0x7469646e
mov dword [rsp + 0x2e], 0x73614d6e
mov word [rsp + 0x32], 0x6b
mov byte [rsp + 0x25], 0x74
mov word [rsp + 0x2c], 0x6f69
mov byte [rsp + 0x20], 0x56
call fcn.140049e40
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140049cdc
movzx r8d, sil
mov edx, edi
mov rcx, rbx
call rax
jmp 0x140049cdf
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140049d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, r8
mov dword [rsp + 0x23], 0x56796669
mov rbx, rcx
mov word [rsp + 0x2e], 0x666e
mov word [rsp + 0x31], 0x41
mov dword [rsp + 0x28], 0x6f697372
mov word [rsp + 0x20], 0x6556
mov word [rsp + 0x2c], 0x496e
mov byte [rsp + 0x27], 0x65
mov byte [rsp + 0x22], 0x72
mov byte [rsp + 0x30], 0x6f
call fcn.140049e40
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140049d7f
mov r8, rdi
mov edx, 0x33
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001c9b0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140049da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edi, edx
mov dword [rsp + 0x2e], 0x79726f74
mov rbx, rcx
mov dword [rsp + 0x27], 0x69446d65
mov dword [rsp + 0x20], 0x53746547
mov word [rsp + 0x32], 0x41
mov word [rsp + 0x25], 0x7473
mov word [rsp + 0x2b], 0x6572
mov byte [rsp + 0x2d], 0x63
mov byte [rsp + 0x24], 0x79
call fcn.140049e40
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140049e14
mov edx, edi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001c9b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140049e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x6c6c642e
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x20], 0x6e72654b
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret

Function at 0x140049f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rdx
call fcn.140049fb0
test rax, rax
je 0x140049f8e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x74726174
mov rcx, rax
mov dword [rsp + 0x20], 0x53415357
mov word [rsp + 0x29], 0x70
mov byte [rsp + 0x28], 0x75
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140049f8e
mov ecx, 0x202
mov rdx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x40
pop rbx
ret
mov eax, 0x276b
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x40
pop rbx
ret

Function at 0x140049fb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x22], 0x5f32
mov word [rsp + 0x25], 0x2e32
mov word [rsp + 0x20], 0x7357
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x24], 0x33
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x27], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14004a009
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret
Function at 0x14004cfc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x728], 0
mov rdi, r9
mov rsi, r8
movsxd r11, edx
mov rbx, rcx
je 0x14004d021
mov dl, 1
call fcn.14004a130
mov r10, qword [rcx + 0x680]
mov edx, r11d
mov qword [rsp + 0x20], r10
call qword [rcx + 0x728]
xor edx, edx
mov rcx, rbx
mov r8d, eax
call fcn.14004a130
mov eax, r8d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov edx, r11d
test r11d, r11d
je 0x14004d033
sub edx, 1
je 0x14004d033
cmp edx, 1
jne 0x14004d06e
mov r9, qword [rbx + 0x678]
lea rcx, [r11 + r11*2]
mov edx, 2
lea rax, [0x140099ee8]
add rcx, rax
lea r8d, [rdx - 1]
call fcn.140025908
mov r9, qword [rbx + 0x678]
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call fcn.140025908
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14004d870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.14004d900
test rax, rax
je 0x14004d8da
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2a], 0x6f727245
mov rcx, rax
mov dword [rsp + 0x20], 0x47415357
mov dword [rsp + 0x26], 0x7473614c
mov word [rsp + 0x2e], 0x72
mov word [rsp + 0x24], 0x7465
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004d8da
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret

Function at 0x14004d900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x22], 0x5f32
mov word [rsp + 0x25], 0x2e32
mov word [rsp + 0x20], 0x7357
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x24], 0x33
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x27], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14004d959
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret

Function at 0x14004ef80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x6c6c642e
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x20], 0x6e72654b
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret
Function at 0x14004efe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
call fcn.14004f770
test rax, rax
je 0x14004f04e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x27], 0x74656b63
mov rcx, rax
mov dword [rsp + 0x21], 0x65736f6c
mov word [rsp + 0x25], 0x6f73
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x20], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004f04e
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x40
pop rbx
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x40
pop rbx
ret

Function at 0x14004f070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.14004f770
test rax, rax
je 0x14004f0da
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2a], 0x6f727245
mov rcx, rax
mov dword [rsp + 0x20], 0x47415357
mov dword [rsp + 0x26], 0x7473614c
mov word [rsp + 0x2e], 0x72
mov word [rsp + 0x24], 0x7465
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004f0da
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret

Function at 0x14004f100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x90]
mov rsi, r9
mov edi, r8d
mov rbx, rcx
call fcn.14004f770
test rax, rax
je 0x14004f17c
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x73746567
mov rcx, rax
mov dword [rsp + 0x34], 0x6f6b636f
mov word [rsp + 0x38], 0x7470
mov byte [rsp + 0x3a], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004f17c
mov r9, rsi
mov qword [rsp + 0x20], rbp
mov r8d, edi
mov edx, 0xffff
mov rcx, rbx
call rax
jmp 0x14004f181
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001c9b0
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x14004f1b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, ecx
call fcn.14004f770
test rax, rax
je 0x14004f220
lea rdx, [rsp + 0x20]
mov word [rsp + 0x28], 0x7473
mov rcx, rax
mov word [rsp + 0x2e], 0x72
mov dword [rsp + 0x21], 0x65534153
mov word [rsp + 0x2b], 0x7272
mov word [rsp + 0x26], 0x614c
mov byte [rsp + 0x20], 0x57
mov byte [rsp + 0x2d], 0x6f
mov byte [rsp + 0x25], 0x74
mov byte [rsp + 0x2a], 0x45
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004f220
mov ecx, ebx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x40
pop rbx
ret
Function at 0x14004f3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call fcn.14004f770
test rax, rax
je 0x14004f458
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x26], 0x6d616e6b
mov rcx, rax
mov dword [rsp + 0x20], 0x73746567
mov word [rsp + 0x24], 0x636f
mov word [rsp + 0x2a], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004f458
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x14004f45d
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x14004f6d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call fcn.14004f770
test rax, rax
je 0x14004f741
lea rdx, [rsp + 0x20]
mov word [rsp + 0x27], 0x616e
mov rcx, rax
mov word [rsp + 0x20], 0x6567
mov dword [rsp + 0x23], 0x72656570
mov byte [rsp + 0x22], 0x74
mov word [rsp + 0x2a], 0x65
mov byte [rsp + 0x29], 0x6d
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004f741
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x14004f746
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x14004f770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x22], 0x5f32
mov word [rsp + 0x25], 0x2e32
mov word [rsp + 0x20], 0x7357
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x24], 0x33
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x27], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14004f7c9
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret

Function at 0x14004fe10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x6c6c642e
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x20], 0x6e72654b
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret
Function at 0x14004fe70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.1400500c0
test rax, rax
je 0x14004feda
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2a], 0x6f727245
mov rcx, rax
mov dword [rsp + 0x20], 0x47415357
mov dword [rsp + 0x26], 0x7473614c
mov word [rsp + 0x2e], 0x72
mov word [rsp + 0x24], 0x7465
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004feda
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret

Function at 0x14004ff00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.1400500c0
test rax, rax
je 0x14004ff6f
lea rdx, [rsp + 0x20]
mov word [rsp + 0x28], 0x7473
mov rcx, rax
mov word [rsp + 0x2e], 0x72
mov dword [rsp + 0x21], 0x65534153
mov word [rsp + 0x2b], 0x7272
mov word [rsp + 0x26], 0x614c
mov byte [rsp + 0x20], 0x57
mov byte [rsp + 0x2d], 0x6f
mov byte [rsp + 0x25], 0x74
mov byte [rsp + 0x2a], 0x45
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004ff6f
mov ecx, 0x2726
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret

Function at 0x14004ff90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov rbx, rcx
call fcn.1400500c0
test rax, rax
je 0x14004fff9
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x53575f5f
mov rcx, rax
mov word [rsp + 0x27], 0x7349
mov word [rsp + 0x24], 0x4641
mov dword [rsp + 0x29], 0x746553
mov byte [rsp + 0x26], 0x44
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004fff9
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x14004fffb
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400500c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x22], 0x5f32
mov word [rsp + 0x25], 0x2e32
mov word [rsp + 0x20], 0x7357
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x24], 0x33
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x27], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140050119
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret

Function at 0x140051230
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 4], 2
mov rax, rdx
je 0x14005123c
xor eax, eax
ret
mov rdx, qword [rcx + 0x20]
mov r9, r8
add rdx, 4
mov r8, rax
mov ecx, 2
jmp fcn.140068230
Function at 0x140052250
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140052286
call fcn.140052490
test al, al
jne 0x140052286
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400522e0
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x1400522a0
xor eax, eax
add rsp, 0x20
pop rbx
ret
sub rsp, 0x28
lea r9, [rcx + rdx]
mov r8, rcx
mov edx, 0x1505
cmp rcx, r9
jae 0x1400522d1
movzx ecx, byte [r8]
call fcn.14005bed0
imul rdx, rdx, 0x21
movsx rcx, al
inc r8
xor rdx, rcx
cmp r8, r9
jb 0x1400522b5
movzx eax, dl
add rsp, 0x28
ret
Function at 0x14005b000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov word [rsp + 0x23], 0x6576
mov dword [rsp + 0x2c], 0x6365536c
mov word [rsp + 0x30], 0x6974
mov word [rsp + 0x33], 0x6e
mov word [rsp + 0x20], 0x654c
mov byte [rsp + 0x32], 0x6f
mov dword [rsp + 0x25], 0x74697243
mov word [rsp + 0x29], 0x6369
mov byte [rsp + 0x22], 0x61
mov byte [rsp + 0x2b], 0x61
call fcn.14005b260
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005b077
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x40
pop rbx
ret

Function at 0x14005b090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov dword [rbp - 0x1a], 0x456e6f69
mov dword [rbp - 0x24], 0x63697469
mov word [rbp - 0x2b], 0x6c61
mov dword [rbp - 0x30], 0x74696e49
mov word [rbp - 0x1f], 0x536c
mov word [rbp - 0x1c], 0x7463
mov word [rbp - 0x16], 0x78
mov dword [rbp - 0x29], 0x43657a69
mov byte [rbp - 0x1d], 0x65
mov byte [rbp - 0x25], 0x72
mov byte [rbp - 0x20], 0x61
mov byte [rbp - 0x2c], 0x69
call fcn.14005b260
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005b114
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 1]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001c9b0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x14005b140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov word [rsp + 0x2a], 0x6369
mov dword [rsp + 0x20], 0x656c6544
mov dword [rsp + 0x32], 0x6e6f69
mov word [rsp + 0x27], 0x6972
mov dword [rsp + 0x2d], 0x6365536c
mov word [rsp + 0x24], 0x6574
mov byte [rsp + 0x31], 0x74
mov byte [rsp + 0x26], 0x43
mov byte [rsp + 0x2c], 0x61
mov byte [rsp + 0x29], 0x74
call fcn.14005b260
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005b1b6
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x40
pop rbx
ret

Function at 0x14005b1d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov dword [rsp + 0x22], 0x43726574
mov dword [rsp + 0x2c], 0x6365536c
mov dword [rsp + 0x30], 0x6e6f6974
mov dword [rsp + 0x28], 0x61636974
mov word [rsp + 0x26], 0x6972
mov word [rsp + 0x20], 0x6e45
mov byte [rsp + 0x34], 0
call fcn.14005b260
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005b238
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x40
pop rbx
ret
Function at 0x14005b260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x6c6c642e
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x20], 0x6e72654b
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret

Function at 0x14005b2c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.14005b350
test rax, rax
je 0x14005b32a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2a], 0x6f727245
mov rcx, rax
mov dword [rsp + 0x20], 0x47415357
mov dword [rsp + 0x26], 0x7473614c
mov word [rsp + 0x2e], 0x72
mov word [rsp + 0x24], 0x7465
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005b32a
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret

Function at 0x14005b350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x22], 0x5f32
mov word [rsp + 0x25], 0x2e32
mov word [rsp + 0x20], 0x7357
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x24], 0x33
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x27], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14005b3a9
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret

Function at 0x14005edd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x22], 0x5f32
mov word [rsp + 0x25], 0x2e32
mov word [rsp + 0x20], 0x7357
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x24], 0x33
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x27], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14005ee29
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001c9b0
add rsp, 0x48
ret