joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004af0c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x14005d3b0]
mov rdi, r8
movdqu xmmword [rbp - 0x20], xmm0
mov rsi, rdx
mov word [rbp - 0x10], 0x75
mov rbx, rcx
xor r9d, r9d
mov al, byte [rbp - 0x20]
xor byte [rbp + r9 - 0x1f], al
inc r9
cmp r9, 0x10
jb 0x14004af42
mov byte [rbp - 0xf], 0
mov cl, 0x17
mov dword [rbp - 0x30], 0x65725c17
xor eax, eax
mov dword [rbp - 0x2c], 0x247b7279
mov dword [rbp - 0x28], 0x7b733925
mov word [rbp - 0x24], 0x7b
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xc
jae 0x14004af88
mov cl, byte [rbp - 0x30]
jmp 0x14004af76
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x23], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret

Function at 0x14004afc4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x14005d3a0]
mov rdi, rdx
xor edx, edx
mov dword [rbp - 0x10], 0x454c4946
mov rbx, rcx
mov word [rbp - 0xc], 0x61
movdqu xmmword [rbp - 0x20], xmm0
lea ecx, [rdx + 0x14]
mov al, byte [rbp - 0x20]
xor byte [rbp + rdx - 0x1f], al
inc rdx
cmp rdx, rcx
jb 0x14004affb
mov byte [rbp - 0xb], 0
xor eax, eax
mov dword [rbp - 0x30], 0x62705514
mov dword [rbp - 0x2c], 0x277d6475
mov dword [rbp - 0x28], 0x78703a26
mov word [rbp - 0x24], 0x78
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xc
jae 0x14004b03d
mov cl, byte [rbp - 0x30]
jmp 0x14004b02b
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x23], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x14004b074
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x14005d380]
mov rbx, rcx
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2c
xor edx, edx
mov al, byte [rbp - 0x20]
xor byte [rbp + rdx - 0x1f], al
inc rdx
cmp rdx, 0x10
jb 0x14004b099
mov byte [rbp - 0xf], 0
mov cl, 0x1d
mov dword [rbp - 0x30], 0x786e481d
xor eax, eax
mov dword [rbp - 0x2c], 0x332f2e6f
mov dword [rbp - 0x28], 0x717179
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xa
jae 0x14004b0d8
mov cl, byte [rbp - 0x30]
jmp 0x14004b0c6
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x25], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
call rax
mov rbx, qword [rsp + 0x60]
cdqe
add rsp, 0x50
pop rbp
ret
Function at 0x14004b108
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x14005d2e0]
xor eax, eax
mov rbx, rcx
mov byte [rbp - 8], al
movdqu xmmword [rbp - 0x20], xmm0
xor ecx, ecx
mov dword [rbp - 0x10], 0x39312a39
mov edi, r9d
mov dword [rbp - 0xc], 0x193d343a
mov rsi, r8
mov r14, rdx
mov al, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1f], al
inc rcx
cmp rcx, 0x17
jb 0x14004b151
mov byte [rbp - 8], 0
mov cl, 0x7e
mov dword [rbp - 0x30], 0xc1b357e
xor eax, eax
mov dword [rbp - 0x2c], 0x4d121b10
mov dword [rbp - 0x28], 0x121a504c
mov word [rbp - 0x24], 0x12
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xc
jae 0x14004b196
mov cl, byte [rbp - 0x30]
jmp 0x14004b184
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x23], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x14004b1dc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x14005d290]
mov rdi, r9
movdqu xmmword [rbp - 0x10], xmm0
mov esi, r8d
mov r14d, edx
mov rbx, rcx
xor r10d, r10d
mov al, byte [rbp - 0x10]
xor byte [rbp + r10 - 0xf], al
inc r10
cmp r10, 0xe
jb 0x14004b213
mov byte [rbp - 1], 0
mov cl, 2
mov dword [rbp - 0x20], 0x70674902
xor eax, eax
mov dword [rbp - 0x1c], 0x316e676c
mov dword [rbp - 0x18], 0x6e662c30
mov word [rbp - 0x14], 0x6e
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x14004b259
mov cl, byte [rbp - 0x20]
jmp 0x14004b247
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov r9d, dword [rbp + 0x30]
mov r8, rdi
mov edx, esi
mov ecx, r14d
call rax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x14004b2a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x14005d340]
mov edi, r9d
movdqu xmmword [rbp - 0x20], xmm0
mov rsi, r8
mov dword [rbp - 0x10], 0xb2f27
mov r14, rdx
mov rbx, rcx
xor r9d, r9d
mov al, byte [rbp - 0x20]
xor byte [rbp + r9 - 0x1f], al
inc r9
cmp r9, 0x12
jb 0x14004b2de
mov byte [rbp - 0xd], 0
mov cl, 0x10
mov dword [rbp - 0x30], 0x62755b10
xor eax, eax
mov dword [rbp - 0x2c], 0x237c757e
mov dword [rbp - 0x28], 0x7c743e22
mov word [rbp - 0x24], 0x7c
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xc
jae 0x14004b324
mov cl, byte [rbp - 0x30]
jmp 0x14004b312
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x23], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x14004b368
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
mov dword [rbp - 0x10], 0x7d6c4e09
mov byte [rbp - 2], al
mov rdi, rdx
mov rbx, rcx
mov dword [rbp - 0xc], 0x7d7a705a
mov r8b, 9
mov dword [rbp - 8], 0x6740646c
mov word [rbp - 4], 0x666f
xor byte [rbp + rax - 0xf], r8b
inc rax
cmp rax, 0xd
jae 0x14004b3b7
mov r8b, byte [rbp - 0x10]
jmp 0x14004b3a3
mov byte [rbp - 2], 0
mov cl, 0x6b
mov dword [rbp - 0x20], 0x190e206b
xor eax, eax
mov dword [rbp - 0x1c], 0x58070e05
mov dword [rbp - 0x18], 0x70f4559
mov word [rbp - 0x14], 7
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x14004b3ec
mov cl, byte [rbp - 0x20]
jmp 0x14004b3da
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x14004b420
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x14005d350]
mov rbx, rcx
movdqu xmmword [rbp - 0x20], xmm0
mov rdi, rdx
mov dword [rbp - 0x10], 0xb0a1f0a
mov word [rbp - 0xc], 0xd
xor ecx, ecx
mov al, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1f], al
inc rcx
cmp rcx, 0x14
jb 0x14004b454
mov byte [rbp - 0xb], 0
mov cl, 0x2b
mov dword [rbp - 0x30], 0x594e602b
xor eax, eax
mov dword [rbp - 0x2c], 0x18474e45
mov dword [rbp - 0x28], 0x474f0519
mov word [rbp - 0x24], 0x47
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xc
jae 0x14004b499
mov cl, byte [rbp - 0x30]
jmp 0x14004b487
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x23], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x14004b4d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [str.eoHbhovOrvh]
mov rdi, r9
movdqu xmmword [rbp - 0x10], xmm0
mov rsi, r8
mov r14, rdx
mov rbx, rcx
xor r10d, r10d
mov al, byte [rbp - 0x10]
xor byte [rbp + r10 - 0xf], al
inc r10
cmp r10, 0xe
jb 0x14004b507
mov byte [rbp - 1], 0
mov cl, 0x35
mov dword [rbp - 0x20], 0x47507e35
xor eax, eax
mov dword [rbp - 0x1c], 0x659505b
mov dword [rbp - 0x18], 0x59511b07
mov word [rbp - 0x14], 0x59
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x14004b54d
mov cl, byte [rbp - 0x20]
jmp 0x14004b53b
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x14004b594
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
mov dword [rbp - 0x10], 0x3123077
mov byte [rbp - 2], al
mov rdi, rdx
mov rbx, rcx
mov dword [rbp - 0xc], 0x4051221
mov r8b, 0x77
mov dword [rbp - 8], 0x3219181e
mov word [rbp - 4], 0x360f
xor byte [rbp + rax - 0xf], r8b
inc rax
cmp rax, 0xd
jae 0x14004b5e3
mov r8b, byte [rbp - 0x10]
jmp 0x14004b5cf
mov byte [rbp - 2], 0
mov cl, 7
mov dword [rbp - 0x20], 0x75624c07
xor eax, eax
mov dword [rbp - 0x1c], 0x346b6269
mov dword [rbp - 0x18], 0x6b632935
mov word [rbp - 0x14], 0x6b
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x14004b618
mov cl, byte [rbp - 0x20]
jmp 0x14004b606
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x14004b64c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
mov dword [rbp - 0x10], 0x41507235
mov rsi, rdx
mov byte [rbp - 2], al
mov rdi, r8
mov dword [rbp - 0xc], 0x515b5c62
mov rbx, rcx
mov dword [rbp - 8], 0x5067425a
mov r9b, 0x35
mov word [rbp - 4], 0x4156
mov dl, 0x5a
xor byte [rbp + rax - 0xf], r9b
inc rax
cmp rax, 0xd
jae 0x14004b6a5
mov r9b, byte [rbp - 0x10]
jmp 0x14004b691
xor eax, eax
mov byte [rbp - 2], 0
mov byte [rbp - 0x15], al
mov byte [rbp - 0x20], dl
mov dword [rbp - 0x1f], 0x283f290f
mov dword [rbp - 0x1b], 0x3e746869
mov word [rbp - 0x17], 0x3636
xor byte [rbp + rax - 0x1f], dl
inc rax
cmp rax, 0xa
jae 0x14004b6d7
mov dl, byte [rbp - 0x20]
jmp 0x14004b6c5
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x15], 0
call fcn.14004c3d4
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x14004b710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp - 0x20], 0x66654e09
mov rbx, rcx
mov dword [rbp - 0x1c], 0x4565686b
mov r8b, 9
mov dword [rbp - 0x18], 0x626a66
xor eax, eax
xor byte [rbp + rax - 0x1f], r8b
inc rax
cmp rax, 0xa
jae 0x14004b756
mov r8b, byte [rbp - 0x20]
jmp 0x14004b742
mov byte [rbp - 0x15], 0
mov cl, 0x3f
mov dword [rbp - 0x10], 0x4d5a743f
xor eax, eax
mov dword [rbp - 0xc], 0xc535a51
mov dword [rbp - 8], 0x535b110d
mov word [rbp - 4], 0x53
xor byte [rbp + rax - 0xf], cl
inc rax
cmp rax, 0xc
jae 0x14004b78b
mov cl, byte [rbp - 0x10]
jmp 0x14004b779
lea rdx, [rbp - 0xf]
mov byte [rbp - 3], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x14004b7c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x14005d390]
mov rdi, rdx
movdqu xmmword [rbp - 0x20], xmm0
mov rbx, rcx
mov dword [rbp - 0x10], 0x11272120
mov word [rbp - 0xc], 0x2c
xor edx, edx
mov al, byte [rbp - 0x20]
xor byte [rbp + rdx - 0x1f], al
inc rdx
cmp rdx, 0x14
jb 0x14004b7f4
mov byte [rbp - 0xb], 0
mov cl, 0x50
mov dword [rbp - 0x30], 0x22351b50
xor eax, eax
mov dword [rbp - 0x2c], 0x633c353e
mov dword [rbp - 0x28], 0x3c347e62
mov word [rbp - 0x24], 0x3c
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xc
jae 0x14004b839
mov cl, byte [rbp - 0x30]
jmp 0x14004b827
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x23], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x14004b870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp - 0x10], 0x56557e39
mov rbx, rcx
mov dword [rbp - 0xc], 0x6c55585b
mov r8b, 0x39
mov dword [rbp - 8], 0x5a565557
mov word [rbp - 4], 0x52
xor eax, eax
xor byte [rbp + rax - 0xf], r8b
inc rax
cmp rax, 0xc
jae 0x14004b8bc
mov r8b, byte [rbp - 0x10]
jmp 0x14004b8a8
mov byte [rbp - 3], 0
mov cl, 0x5c
mov dword [rbp - 0x20], 0x2e39175c
xor eax, eax
mov dword [rbp - 0x1c], 0x6f303932
mov dword [rbp - 0x18], 0x3038726e
mov word [rbp - 0x14], 0x30
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x14004b8f1
mov cl, byte [rbp - 0x20]
jmp 0x14004b8df
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x14004b928
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x14005d370]
mov rbx, rcx
movdqu xmmword [rbp - 0x20], xmm0
mov edi, r9d
mov dword [rbp - 0x10], 0x383e3535
mov esi, r8d
mov dword [rbp - 0xc], 0x3534322f
mov r14, rdx
mov word [rbp - 8], 0x1a
xor ecx, ecx
mov al, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1f], al
inc rcx
cmp rcx, 0x18
jb 0x14004b972
xor eax, eax
mov byte [rbp - 7], 0
mov byte [rbp - 0x24], al
mov cl, 0x1c
mov dword [rbp - 0x30], 0x72756b1c
mov dword [rbp - 0x2c], 0x68797275
mov dword [rbp - 0x28], 0x70707832
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xb
jae 0x14004b9b4
mov cl, byte [rbp - 0x30]
jmp 0x14004b9a2
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x24], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov r8d, edi
mov edx, esi
mov rcx, r14
call rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x14004b9f8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x14005d3d0]
xor eax, eax
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0xc], al
xor r8d, r8d
mov rdi, rdx
mov dword [rbp - 0x10], 0x7d747c76
mov rbx, rcx
mov al, byte [rbp - 0x20]
xor byte [rbp + r8 - 0x1f], al
inc r8
cmp r8, 0x13
jb 0x14004ba2c
xor eax, eax
mov byte [rbp - 0xc], 0
mov byte [rbp - 0x24], al
mov cl, 0x20
mov dword [rbp - 0x30], 0x4e495720
mov dword [rbp - 0x2c], 0x54454e49
mov dword [rbp - 0x28], 0x4c4c440e
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xb
jae 0x14004ba6f
mov cl, byte [rbp - 0x30]
jmp 0x14004ba5d
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x24], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x14004baa4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
xor eax, eax
mov dword [rbp - 0x10], 0x913347d
mov byte [rbp - 2], al
mov rdi, r9
mov esi, r8d
mov dword [rbp - 0xc], 0x18130f18
mov r14, rdx
mov dword [rbp - 8], 0x180d3209
mov rbx, rcx
mov word [rbp - 4], 0x3c13
mov r10b, 0x7d
xor byte [rbp + rax - 0xf], r10b
inc rax
cmp rax, 0xd
jae 0x14004bb02
mov r10b, byte [rbp - 0x10]
jmp 0x14004baee
xor eax, eax
mov byte [rbp - 2], 0
mov byte [rbp - 0x14], al
mov cl, 0x22
mov dword [rbp - 0x20], 0x4c4b5522
mov dword [rbp - 0x1c], 0x56474c4b
mov dword [rbp - 0x18], 0x4e4e460c
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xb
jae 0x14004bb34
mov cl, byte [rbp - 0x20]
jmp 0x14004bb22
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x14], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov ecx, dword [rbp + 0x38]
mov r8, rdi
mov r9, qword [rbp + 0x30]
mov edx, esi
mov dword [rsp + 0x20], ecx
mov rcx, r14
call rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x14004bb84
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
movdqa xmm0, xmmword [0x14005d2f0]
mov r14, rdx
xor edx, edx
mov word [rbp - 0x10], 0x22
mov r10d, edx
mov rdi, r9
mov rsi, r8
mov rbx, rcx
movdqu xmmword [rbp - 0x20], xmm0
mov al, byte [rbp - 0x20]
xor byte [rbp + r10 - 0x1f], al
inc r10
cmp r10, 0x10
jb 0x14004bbc3
xor eax, eax
mov byte [rbp - 0xf], dl
mov byte [rbp - 0x24], al
mov cl, 0x69
mov dword [rbp - 0x30], 0x7001e69
mov dword [rbp - 0x2c], 0x1d0c0700
mov dword [rbp - 0x28], 0x5050d47
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xb
jae 0x14004bc05
mov cl, byte [rbp - 0x30]
jmp 0x14004bbf3
mov byte [rbp - 0x24], dl
mov rcx, rbx
lea rdx, [rbp - 0x2f]
call fcn.14004c3d4
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov rcx, qword [rbp + 0x40]
mov r8, rdi
mov r9d, dword [rbp + 0x30]
mov rdx, rsi
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x38]
mov dword [rsp + 0x20], ecx
mov rcx, r14
call rax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14004bc5c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x14005d360]
mov edi, r9d
movdqu xmmword [rbp - 0x20], xmm0
mov rsi, r8
mov word [rbp - 0x10], 0x24
mov r14, rdx
mov rbx, rcx
xor r10d, r10d
mov al, byte [rbp - 0x20]
xor byte [rbp + r10 - 0x1f], al
inc r10
cmp r10, 0x10
jb 0x14004bc99
xor eax, eax
mov byte [rbp - 0xf], 0
mov byte [rbp - 0x24], al
mov cl, 0x42
mov dword [rbp - 0x30], 0x2c2b3542
mov dword [rbp - 0x2c], 0x36272c2b
mov dword [rbp - 0x28], 0x2e2e266c
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xb
jae 0x14004bcdc
mov cl, byte [rbp - 0x30]
jmp 0x14004bcca
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x24], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov r9, qword [rbp + 0x30]
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x14004be8c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [str.4dF_WQGG_a]
mov rdi, r8
movdqu xmmword [rbp - 0x10], xmm0
mov rsi, rdx
mov rbx, rcx
xor r9d, r9d
mov al, byte [rbp - 0x10]
xor byte [rbp + r9 - 0xf], al
inc r9
cmp r9, 0xe
jb 0x14004bebc
mov byte [rbp - 1], 0
mov cl, 0x7a
mov dword [rbp - 0x20], 0x81f317a
xor eax, eax
mov dword [rbp - 0x1c], 0x49161f14
mov dword [rbp - 0x18], 0x161e5448
mov word [rbp - 0x14], 0x16
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x14004bf02
mov cl, byte [rbp - 0x20]
jmp 0x14004bef0
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x14004c0f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
movdqa xmm0, xmmword [str.X_n__t__]
mov rdi, r9
movdqu xmmword [rbp - 0x20], xmm0
mov rsi, r8
mov word [rbp - 0x10], 0x19
mov r14, rdx
mov rbx, rcx
xor r10d, r10d
mov al, byte [rbp - 0x20]
xor byte [rbp + r10 - 0x1f], al
inc r10
cmp r10, 0x10
jb 0x14004c12d
mov byte [rbp - 0xf], 0
mov cl, 0xe
mov dword [rbp - 0x30], 0x786a4f0e
xor eax, eax
mov dword [rbp - 0x2c], 0x3d677e6f
mov dword [rbp - 0x28], 0x626a203c
mov word [rbp - 0x24], 0x62
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xc
jae 0x14004c173
mov cl, byte [rbp - 0x30]
jmp 0x14004c161
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x23], 0
mov rcx, rbx
call fcn.14004c3d4
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.14004c334
mov rcx, qword [rbp + 0x40]
mov r8, rdi
mov r9, qword [rbp + 0x30]
mov rdx, rsi
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x38]
mov qword [rsp + 0x20], rcx
mov rcx, r14
call rax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14004c334
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x14005d280]
mov rbx, r8
movdqu xmmword [rbp - 0x10], xmm0
mov rdi, rdx
xor ecx, ecx
mov al, byte [rbp - 0x10]
xor byte [rbp + rcx - 0xf], al
inc rcx
cmp rcx, 0xe
jb 0x14004c35b
mov byte [rbp - 1], 0
mov cl, 0x4c
mov dword [rbp - 0x20], 0x3e29074c
xor eax, eax
mov dword [rbp - 0x1c], 0x7f202922
mov dword [rbp - 0x18], 0x2028627e
mov word [rbp - 0x14], 0x20
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x14004c3a0
mov cl, byte [rbp - 0x20]
jmp 0x14004c38e
lea rcx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp - 0xf]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rbx
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret