joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bf34
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70bc
mov dword [rbp - 0x20], 0x7090709e
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x70c8709e
mov dword [rbp - 0x18], 0x709e70cf
mov dword [rbp - 0x14], 0x70997086
mov dword [rbp - 0x10], 0x70c970d0
mov dword [rbp - 0xc], 0x709070c1
mov dword [rbp - 4], 0x8dc670bc
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bf94
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000bfb4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x70e3
mov dword [rbp - 0x50], 0x70ac70bf
mov ecx, 0x4a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x4c], 0x70867093
mov dword [rbp - 0x48], 0x70827091
mov dword [rbp - 0x44], 0x70b070c3
mov dword [rbp - 0x40], 0x7085708c
mov dword [rbp - 0x3c], 0x70947097
mov dword [rbp - 0x38], 0x70917082
mov dword [rbp - 0x34], 0x70bf7086
mov dword [rbp - 0x30], 0x709370ac
mov dword [rbp - 0x2c], 0x70917086
mov dword [rbp - 0x28], 0x70c37082
mov dword [rbp - 0x24], 0x709770b0
mov dword [rbp - 0x20], 0x70817082
mov dword [rbp - 0x1c], 0x7086708f
mov dword [rbp - 0x18], 0x70ab70bf
mov dword [rbp - 0x14], 0x7090708a
mov dword [rbp - 0x10], 0x708c7097
mov dword [rbp - 0xc], 0x709a7091
mov dword [rbp - 4], 0x8dc670e3
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x25
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c076
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14000c0a4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x70ce
mov dword [rbp - 0x30], 0x708b70ec
mov ecx, 0x22
mov dword [rbp - 0x10], ebx
mov dword [rbp - 0x2c], 0x70a970aa
mov dword [rbp - 0x28], 0x708d70ab
mov dword [rbp - 0x24], 0x70bc70a6
mov dword [rbp - 0x20], 0x70a370a1
mov dword [rbp - 0x1c], 0x70bb70a7
mov dword [rbp - 0x18], 0x70ec70a3
mov dword [rbp - 0x14], 0x709570f4
mov dword [rbp - 0xc], 0x8dc670ce
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x11
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c112
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000c134
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x38
mov dword [rbp - 0x40], 0x70847095
mov dword [rbp - 0x3c], 0x70aa70a0
mov ebx, 0x70c9
mov dword [rbp - 0x38], 0x70a670bb
mov dword [rbp - 0x34], 0x70a670ba
mov dword [rbp - 0x30], 0x70bd70af
mov dword [rbp - 0x2c], 0x70957095
mov dword [rbp - 0x28], 0x70ad708c
mov dword [rbp - 0x24], 0x70ac70ae
mov dword [rbp - 0x20], 0x709c7095
mov dword [rbp - 0x1c], 0x70ac70ba
mov dword [rbp - 0x18], 0x70e970bb
mov dword [rbp - 0x14], 0x70a8708d
mov dword [rbp - 0x10], 0x70a870bd
mov dword [rbp - 0xc], 0x70c97095
mov dword [rbp - 8], 0x8dc670c9
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1c
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c1c9
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000c1e8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70aa
mov dword [rbp - 0x20], 0x70867088
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x70de7088
mov dword [rbp - 0x18], 0x708870d9
mov dword [rbp - 0x14], 0x708f7090
mov dword [rbp - 0x10], 0x70df70c6
mov dword [rbp - 0xc], 0x708670d7
mov dword [rbp - 4], 0x8dc670aa
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c248
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000c268
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x28
mov dword [rbp - 0x30], 0x706b702b
mov dword [rbp - 0x2c], 0x7066707b
mov ebx, 0x7009
mov dword [rbp - 0x28], 0x707a707e
mov dword [rbp - 0x24], 0x707b706c
mov dword [rbp - 0x20], 0x70617056
mov dword [rbp - 0x1c], 0x707a7060
mov dword [rbp - 0x18], 0x7066707d
mov dword [rbp - 0x14], 0x7070707b
mov dword [rbp - 0x10], 0x7033702b
mov dword [rbp - 0xc], 0x70097072
mov dword [rbp - 8], 0x8dc67009
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c2e1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000c300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x708e
mov dword [rbp - 0x20], 0x70cd70ac
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x70fc70e6
mov dword [rbp - 0x18], 0x70e370e1
mov dword [rbp - 0x14], 0x70ac70eb
mov dword [rbp - 0x10], 0x70d570b4
mov dword [rbp - 8], 0x8dc6708e
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c359
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000c3ec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14000e940
lea rcx, [rbp + 0x18]
call fcn.14000c134
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14000f984
test eax, eax
jne 0x14000c523
lea rcx, [rbp + 0x18]
call fcn.14000c0a4
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e978
test eax, eax
jne 0x14000c507
mov edi, 0x70d2
mov ecx, 0x12
mov dword [rbp - 0x30], 0x70f070a9
mov dword [rbp - 0x2c], 0x70a070a7
mov dword [rbp - 0x28], 0x70f070be
mov dword [rbp - 0x24], 0x70f070e8
mov dword [rbp - 0x20], edi
mov dword [rbp - 0x1c], 0x8dc670d2
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 9
mov ecx, edi
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c4a0
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.140001a1c
mov rcx, qword [rbp - 0x40]
call fcn.1400025b4
lea rcx, [rbp + 0x18]
call fcn.14000be38
mov r8d, dword [rbp - 0x38]
mov rdx, rax
mov rcx, rbx
call fcn.140001a70
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e978
test eax, eax
je 0x14000c460
mov edx, 0x2c
mov rcx, rbx
call fcn.140001abc
lea rdx, [0x140011dc4]
mov rcx, rbx
call fcn.140001990
lea rcx, [rbp - 0x18]
call fcn.14000e934
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000c544
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14000e940
lea rcx, [rbp + 0x18]
call fcn.14000ba10
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14000f984
test eax, eax
jne 0x14000c67b
lea rcx, [rbp + 0x18]
call fcn.14000c300
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e978
test eax, eax
jne 0x14000c65f
mov edi, 0x7092
mov ecx, 0x12
mov dword [rbp - 0x30], 0x70b070e9
mov dword [rbp - 0x2c], 0x70e070e7
mov dword [rbp - 0x28], 0x70b070fe
mov dword [rbp - 0x24], 0x70b070a8
mov dword [rbp - 0x20], edi
mov dword [rbp - 0x1c], 0x8dc67092
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 9
mov ecx, edi
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c5f8
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.140001a1c
mov rcx, qword [rbp - 0x40]
call fcn.1400025b4
lea rcx, [rbp + 0x18]
call fcn.14000b8e0
mov r8d, dword [rbp - 0x38]
mov rdx, rax
mov rcx, rbx
call fcn.140001a70
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e978
test eax, eax
je 0x14000c5b8
mov edx, 0x2c
mov rcx, rbx
call fcn.140001abc
lea rdx, [0x140011dc4]
mov rcx, rbx
call fcn.140001990
lea rcx, [rbp - 0x18]
call fcn.14000e934
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000c69c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14000e940
lea rcx, [rbp + 0x18]
call fcn.14000b960
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14000fb34
test eax, eax
jne 0x14000c7d3
lea rcx, [rbp + 0x18]
call fcn.14000beb8
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e978
test eax, eax
jne 0x14000c7b7
mov edi, 0x70a6
mov ecx, 0x12
mov dword [rbp - 0x30], 0x708470dd
mov dword [rbp - 0x2c], 0x70d470d3
mov dword [rbp - 0x28], 0x708470ca
mov dword [rbp - 0x24], 0x7084709c
mov dword [rbp - 0x20], edi
mov dword [rbp - 0x1c], 0x8dc670a6
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 9
mov ecx, edi
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c750
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.140001a1c
mov rcx, qword [rbp - 0x40]
call fcn.1400025b4
lea rcx, [rbp + 0x18]
call fcn.14000c1e8
mov r8d, dword [rbp - 0x38]
mov rdx, rax
mov rcx, rbx
call fcn.140001a70
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e978
test eax, eax
je 0x14000c710
mov edx, 0x2c
mov rcx, rbx
call fcn.140001abc
lea rdx, [0x140011dc4]
mov rcx, rbx
call fcn.140001990
lea rcx, [rbp - 0x18]
call fcn.14000e934
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000c7f4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14000e940
lea rcx, [rbp - 0x18]
call fcn.14000fc6c
test eax, eax
jne 0x14000c91f
lea rcx, [rbp + 0x18]
call fcn.14000bcc0
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e978
test eax, eax
jne 0x14000c903
mov edi, 0x70b8
mov ecx, 0x12
mov dword [rbp - 0x30], 0x709a70c3
mov dword [rbp - 0x2c], 0x70ca70cd
mov dword [rbp - 0x28], 0x709a70d4
mov dword [rbp - 0x24], 0x709a7082
mov dword [rbp - 0x20], edi
mov dword [rbp - 0x1c], 0x8dc670b8
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 9
mov ecx, edi
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c89c
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.140001a1c
mov rcx, qword [rbp - 0x40]
call fcn.1400025b4
lea rcx, [rbp + 0x18]
call fcn.14000bf34
mov r8d, dword [rbp - 0x38]
mov rdx, rax
mov rcx, rbx
call fcn.140001a70
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e978
test eax, eax
je 0x14000c85c
mov edx, 0x2c
mov rcx, rbx
call fcn.140001abc
lea rdx, [0x140011dc4]
mov rcx, rbx
call fcn.140001990
lea rcx, [rbp - 0x18]
call fcn.14000e934
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000c940
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14000e940
lea rcx, [rbp + 0x18]
call fcn.14000bfb4
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14000fddc
test eax, eax
jne 0x14000ca77
lea rcx, [rbp + 0x18]
call fcn.14000bdc0
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e978
test eax, eax
jne 0x14000ca5b
mov edi, 0x70e4
mov ecx, 0x12
mov dword [rbp - 0x30], 0x70c6709f
mov dword [rbp - 0x2c], 0x70967091
mov dword [rbp - 0x28], 0x70c67088
mov dword [rbp - 0x24], 0x70c670de
mov dword [rbp - 0x20], edi
mov dword [rbp - 0x1c], 0x8dc670e4
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 9
mov ecx, edi
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000c9f4
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.140001a1c
mov rcx, qword [rbp - 0x40]
call fcn.1400025b4
lea rcx, [rbp + 0x18]
call fcn.14000bd40
mov r8d, dword [rbp - 0x38]
mov rdx, rax
mov rcx, rbx
call fcn.140001a70
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e978
test eax, eax
je 0x14000c9b4
mov edx, 0x2c
mov rcx, rbx
call fcn.140001abc
lea rdx, [0x140011dc4]
mov rcx, rbx
call fcn.140001990
lea rcx, [rbp - 0x18]
call fcn.14000e934
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000ca98
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x18]
call fcn.14000e940
lea rcx, [rbp + 0x18]
call fcn.14000bbbc
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14000fddc
test eax, eax
jne 0x14000cbcf
lea rcx, [rbp + 0x18]
call fcn.14000bac0
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e978
test eax, eax
jne 0x14000cbb3
mov edi, 0x70fe
mov ecx, 0x12
mov dword [rbp - 0x30], 0x70dc7085
mov dword [rbp - 0x2c], 0x708c708b
mov dword [rbp - 0x28], 0x70dc7092
mov dword [rbp - 0x24], 0x70dc70c4
mov dword [rbp - 0x20], edi
mov dword [rbp - 0x1c], 0x8dc670fe
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 9
mov ecx, edi
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000cb4c
mov rdx, rax
mov rcx, rbx
call fcn.140001990
mov rdx, qword [rbp - 0x40]
mov rcx, rbx
call fcn.140001a1c
mov rcx, qword [rbp - 0x40]
call fcn.1400025b4
lea rcx, [rbp + 0x18]
call fcn.14000bb3c
mov r8d, dword [rbp - 0x38]
mov rdx, rax
mov rcx, rbx
call fcn.140001a70
mov r8d, 0x10
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.14000e978
test eax, eax
je 0x14000cb0c
mov edx, 0x2c
mov rcx, rbx
call fcn.140001abc
lea rdx, [0x14001151c]
mov rcx, rbx
call fcn.140001990
lea rcx, [rbp - 0x18]
call fcn.14000e934
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14000cbf0
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x168]
sub rsp, 0x260
mov rsi, r9
mov dword [rsp + 0x40], 0xff
mov r14, r8
lea rax, [rsp + 0x48]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ccd3
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], rbx
lea r8, [rsp + 0x60]
and qword [rsp + 0x28], rbx
xor edx, edx
and qword [rsp + 0x20], rbx
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000ccc8
lea ebx, [rdi + 1]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call r14
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x60]
and qword [rsp + 0x28], 0
add edi, ebx
and qword [rsp + 0x20], 0
mov edx, edi
mov dword [rsp + 0x40], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14000cc7c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x260]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000ccf4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x50
lea rax, [r11 - 0x18]
xor ebx, ebx
mov qword [r11 - 0x28], rax
mov rdi, r9
lea rax, [r11 - 0x14]
mov qword [r11 - 0x30], rbx
mov rsi, r8
mov qword [r11 - 0x38], rax
lea r9d, [rbx + 2]
mov rbp, rdx
mov r14, rcx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000cd89
mov ecx, dword [rsp + 0x40]
lea edx, [rbx + 1]
call fcn.140002588
lea rcx, [rsp + 0x40]
mov qword [rdi], rax
mov qword [rsp + 0x30], rcx
lea r9d, [rbx + 2]
mov qword [rsp + 0x28], rax
mov r8, rsi
lea rax, [rsp + 0x44]
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000cd81
lea ebx, [rax + 1]
jmp 0x14000cd89
mov rcx, qword [rdi]
call fcn.1400025b4
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x14000cf64
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x70b2
mov dword [rbp - 0x30], 0x70d770d6
mov ecx, 0x1e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x2c], 0x70d370d4
mov dword [rbp - 0x28], 0x70de70c7
mov dword [rbp - 0x24], 0x70e270c6
mov dword [rbp - 0x20], 0x70dd70c0
mov dword [rbp - 0x1c], 0x70db70d4
mov dword [rbp - 0x18], 0x70d770de
mov dword [rbp - 0x10], 0x8dc670b2
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0xf
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000cfcb
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000cfec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x708170c5
mov dword [rbp - 0x2c], 0x7096708c
mov ebx, 0x70e5
mov dword [rbp - 0x28], 0x70897095
mov dword [rbp - 0x24], 0x709c7084
mov dword [rbp - 0x20], 0x70977095
mov dword [rbp - 0x1c], 0x7083708a
mov dword [rbp - 0x18], 0x7089708c
mov dword [rbp - 0x14], 0x70e57080
mov dword [rbp - 0x10], 0x8dc670e5
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d057
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000d078
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x7009
mov dword [rbp - 0x20], 0x70467045
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x7048704a
mov dword [rbp - 0x18], 0x70487045
mov dword [rbp - 0x14], 0x70597059
mov dword [rbp - 0x10], 0x7048704d
mov dword [rbp - 0xc], 0x7048705d
mov dword [rbp - 4], 0x8dc67009
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d0d8
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000d0f8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x70b3
mov dword [rbp - 0x30], 0x709170c8
mov ecx, 0x26
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x2c], 0x70c170c3
mov dword [rbp - 0x28], 0x70d570dc
mov dword [rbp - 0x24], 0x70df70da
mov dword [rbp - 0x20], 0x70ec70d6
mov dword [rbp - 0x1c], 0x70d270dd
mov dword [rbp - 0x18], 0x70d670de
mov dword [rbp - 0x14], 0x70897091
mov dword [rbp - 0x10], 0x70917093
mov dword [rbp - 8], 0x8dc670b3
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d16d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000d18c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x30
mov dword [rbp - 0x40], 0x709d7093
mov dword [rbp - 0x3c], 0x70937091
mov ebx, 0x70b1
mov dword [rbp - 0x38], 0x70d470d5
mov dword [rbp - 0x34], 0x70d070d7
mov dword [rbp - 0x30], 0x70dd70c4
mov dword [rbp - 0x2c], 0x70ee70c5
mov dword [rbp - 0x28], 0x70c370c1
mov dword [rbp - 0x24], 0x70d770de
mov dword [rbp - 0x20], 0x70dd70d8
mov dword [rbp - 0x1c], 0x709370d4
mov dword [rbp - 0x18], 0x7091708b
mov dword [rbp - 0x14], 0x70b17093
mov dword [rbp - 0x10], 0x8dc670b1
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d213
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000d234
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x70c3
mov dword [rbp - 0x20], 0x70e170b8
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x70ac70ab
mov dword [rbp - 0x18], 0x70b770b0
mov dword [rbp - 0x14], 0x70f970e1
mov dword [rbp - 0x10], 0x70e170e3
mov dword [rbp - 8], 0x8dc670c3
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d28d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret