joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401418e8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140548828]
mov word [rbp + 0x30], 0x3731
mov r14, qword [rax + 0x40]
xor eax, eax
mov byte [rbp + 0x32], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax + 0x30], cl
inc ecx
cmp ecx, 2
jb 0x140141912
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x32], 0
call fcn.1403d6dc0
mov r8d, eax
mov dword [rbp - 0x18], 0x33347930
xor eax, eax
mov byte [rbp - 0x14], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax - 0x18], cl
inc ecx
cmp ecx, 4
jb 0x14014193e
xor edx, edx
mov byte [rbp - 0x14], 0
lea rcx, [rbp - 0x18]
call fcn.1403d6cb0
mov rsi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x3a], al
xor ecx, ecx
mov word [rbp + 0x38], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x38], cl
inc ecx
cmp ecx, 2
jb 0x14014196c
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x3a], 0
call fcn.1403d6dc0
xor ecx, ecx
mov dword [rbp - 0x13], 0x33347930
mov byte [rbp - 0xf], cl
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx - 0x13], dl
inc edx
cmp edx, 4
jb 0x140141995
mov r8d, eax
mov byte [rbp - 0xf], 0
xor edx, edx
lea rcx, [rbp - 0x13]
call fcn.1403d6cb0
mov rdi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x42], al
xor ecx, ecx
mov word [rbp + 0x40], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x40], cl
inc ecx
cmp ecx, 2
jb 0x1401419c6
lea rcx, [rbp + 0x40]
mov byte [rbp + 0x42], 0
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x20], 0x417930
movsxd rcx, edx
xor byte [rbp + rcx - 0x20], dl
inc edx
cmp edx, 3
jb 0x1401419ea
mov r8d, eax
mov byte [rbp - 0x1d], 0
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.1403d6cb0
mov ebx, eax
mov word [rbp + 0x48], 0x3731
xor eax, eax
mov byte [rbp + 0x4a], al
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx + 0x48], dl
inc edx
cmp edx, 2
jb 0x140141a19
lea rcx, [rbp + 0x48]
mov byte [rbp + 0x4a], al
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x1c], 0x447930
movsxd rcx, edx
xor byte [rbp + rcx - 0x1c], dl
inc edx
cmp edx, 3
jb 0x140141a3c
mov r8d, eax
mov byte [rbp - 0x19], 0
xor edx, edx
lea rcx, [rbp - 0x1c]
call fcn.1403d6cb0
mov eax, eax
mov cl, bl
mov edx, edi
not rsi
shr rdx, cl
and rax, rdx
xor rax, rsi
xor rax, r14
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401434d4
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x14014352e
mov r11b, 0x23
lea rdi, [0x1404c0900]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x140143518
cmp rdx, 2
jb 0x140143518
cmp byte [r10], r11b
jne 0x140143518
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x1401434f6
jmp 0x14014356f
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x14014356f
mov r11b, 0x23
lea rdi, [0x1404c0900]
cmp dl, r11b
jne 0x140143553
cmp byte [r10], r11b
jne 0x140143553
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x140143541
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x1401436ac
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1401436cd
and qword [r8], 0
lea rdx, [0x1404ca184]
call fcn.140143580
mov rbx, rax
test rax, rax
je 0x140143785
mov rcx, rax
call fcn.1403d75f0
mov esi, eax
cmp eax, 0xffffffff
je 0x14014377d
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.1403d7e60
test eax, eax
jne 0x14014377d
mov rcx, rbx
call fcn.1403d75f0
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14014377d
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1403d7e60
test eax, eax
jne 0x14014377d
cmp rdi, 0xffffffffffffffff
je 0x14014377d
mov rcx, rdi
call fcn.140147358
mov rsi, rax
test rax, rax
je 0x14014377d
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1403d8aa0
mov rcx, rbx
cmp rax, rdi
je 0x14014376b
call fcn.1403d7be0
mov rcx, rsi
call fcn.1401473a4
jmp 0x140143785
call fcn.1403d7be0
test r14, r14
je 0x140143778
mov qword [r14], rdi
mov rax, rsi
jmp 0x140143787
mov rcx, rbx
call fcn.1403d7be0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x140146928
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
mov r11d, 4
mov rax, qword [rcx + 0x108]
mov r9, rcx
mov r10d, r11d
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x38]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x1404c0900]
xor ebx, dword [rax + rcx*4]
sub r10, 1
jne 0x140146957
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x4054], ebx
jne 0x140146991
movsxd r8, edx
mov ecx, ebx
mov edx, r11d
call fcn.140158638
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14014699c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm2, dword [rcx + 0x120]
lea r9, [rsp]
movss xmm3, dword [rcx + 0x124]
mov r10d, 0x10
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0x108]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0x100]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
not r8d
movss xmm1, dword [rdx + 0xc]
subss xmm1, xmm3
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
movzx ecx, byte [r9]
lea rax, [0x1404c0900]
movzx edx, r8b
inc r9
xor rdx, rcx
shr r8d, 8
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x140146a0a
not r8d
mov eax, r8d
add rsp, 0x18
ret

Function at 0x140157318
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5fd0], 0
lea rdi, [rcx + 0x5fd8]
mov rbx, rcx
mov rsi, r8
mov rcx, rdi
mov rbp, rdx
je 0x140157394
xor edx, edx
call fcn.140159364
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
call fcn.140143eec
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x5fd0]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x140548822]
movsxd r8, eax
mov rax, qword [rbx + 0x5fe0]
test rax, rax
cmovne rcx, rax
call fcn.1403d85e0
jmp 0x140157399
call fcn.140143eec
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140157a00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140548838]
mov rbx, rcx
and dword [rax + 0x5f2c], 0
test rcx, rcx
je 0x140157a67
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.140157a74
lea rdx, [0x1404ca188]
mov rcx, rbx
mov rdi, rax
call fcn.140143580
mov rbx, rax
test rax, rax
je 0x140157a67
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call fcn.1403d85e0
mov rcx, rbx
call fcn.1403d7be0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140167dac
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x140548838]
test rax, rax
je 0x140167dc7
mov rbx, qword [rax + 0x90]
jmp 0x140167dc9
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.user32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.kernel32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140167df4
and dword [rbx + 0x2c], eax
add rsp, 0x20
pop rbx
ret
Function at 0x1401824e8
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov word [rsp + 0x38], 0x3731
mov byte [rsp + 0x3a], al
xor edx, edx
mov rbx, rcx
movsxd rax, edx
xor byte [rsp + rax + 0x38], dl
inc edx
cmp edx, 2
jb 0x140182500
lea rcx, [rsp + 0x38]
mov byte [rsp + 0x3a], 0
call fcn.1403d6dc0
mov cl, byte [0x1404c9788]
mov byte [rsp + 0x30], cl
xor ecx, ecx
mov byte [rsp + 0x31], cl
xor edx, edx
movsxd rcx, edx
xor byte [rsp + rcx + 0x30], dl
inc edx
cmp edx, 1
jb 0x14018252f
mov r8d, eax
mov byte [rsp + 0x31], 0
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1403d6cb0
cmp dword [rbx + 0x64], eax
setae al
add rsp, 0x20
pop rbx
ret

Function at 0x140182560
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x20
xor eax, eax
mov word [rbp + 0x30], 0x3731
mov rdi, rcx
mov byte [rbp + 0x32], al
xor edx, edx
lea ebx, [rax + 1]
movsxd rax, edx
xor byte [rbp + rax + 0x30], dl
add edx, ebx
cmp edx, 2
jb 0x14018257e
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x32], 0
call fcn.1403d6dc0
mov r8d, eax
mov al, byte [0x1404c977c]
mov byte [rbp + 0x20], al
xor eax, eax
mov byte [rbp + 0x21], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax + 0x20], cl
add ecx, ebx
cmp ecx, ebx
jb 0x1401825ac
xor edx, edx
mov byte [rbp + 0x21], 0
lea rcx, [rbp + 0x20]
call fcn.1403d6cb0
cmp dword [rdi + 0x64], eax
jbe 0x140182629
xor eax, eax
mov word [rbp + 0x38], 0x3731
mov byte [rbp + 0x3a], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax + 0x38], cl
add ecx, ebx
cmp ecx, 2
jb 0x1401825da
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x3a], 0
call fcn.1403d6dc0
mov r8d, eax
mov al, byte [0x1404c9784]
mov byte [rbp + 0x28], al
xor eax, eax
mov byte [rbp + 0x29], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax + 0x28], cl
add ecx, ebx
cmp ecx, ebx
jb 0x140182608
xor edx, edx
mov byte [rbp + 0x29], 0
lea rcx, [rbp + 0x28]
call fcn.1403d6cb0
cmp dword [rdi + 0x64], eax
jbe 0x14018262b
xor bl, bl
mov al, bl
add rsp, 0x20
pop rdi
pop rbx
pop rbp
ret
Function at 0x140182638
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x20
xor eax, eax
mov word [rbp + 0x28], 0x3731
xor ebx, ebx
mov byte [rbp + 0x2a], al
mov edx, ebx
mov rdi, rcx
movsxd rax, edx
xor byte [rbp + rax + 0x28], dl
inc edx
cmp edx, 2
jb 0x140182655
lea rcx, [rbp + 0x28]
mov byte [rbp + 0x2a], bl
call fcn.1403d6dc0
mov r8d, eax
mov ecx, ebx
mov al, byte [0x1404c9788]
mov byte [rbp + 0x20], al
xor eax, eax
mov byte [rbp + 0x21], al
movsxd rax, ecx
xor byte [rbp + rax + 0x20], cl
inc ecx
cmp ecx, 1
jb 0x140182682
xor edx, edx
mov byte [rbp + 0x21], bl
lea rcx, [rbp + 0x20]
call fcn.1403d6cb0
cmp dword [rdi + 0x64], eax
jae 0x14018275d
xor eax, eax
mov word [rbp + 0x30], 0x3731
mov byte [rbp + 0x32], al
mov ecx, ebx
movsxd rax, ecx
xor byte [rbp + rax + 0x30], cl
inc ecx
cmp ecx, 2
jb 0x1401826b4
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x32], bl
call fcn.1403d6dc0
mov r8d, eax
mov ecx, ebx
mov al, byte [0x1404c977c]
mov byte [rbp + 0x20], al
xor eax, eax
mov byte [rbp + 0x21], al
movsxd rax, ecx
xor byte [rbp + rax + 0x20], cl
inc ecx
cmp ecx, 1
jb 0x1401826e1
xor edx, edx
mov byte [rbp + 0x21], bl
lea rcx, [rbp + 0x20]
call fcn.1403d6cb0
cmp dword [rdi + 0x64], eax
jbe 0x14018275f
xor eax, eax
mov word [rbp + 0x38], 0x3731
mov byte [rbp + 0x3a], al
mov ecx, ebx
movsxd rax, ecx
xor byte [rbp + rax + 0x38], cl
inc ecx
cmp ecx, 2
jb 0x14018270f
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x3a], bl
call fcn.1403d6dc0
mov r8d, eax
mov ecx, ebx
mov al, byte [0x1404c9784]
mov byte [rbp + 0x28], al
xor eax, eax
mov byte [rbp + 0x29], al
movsxd rax, ecx
xor byte [rbp + rax + 0x28], cl
inc ecx
cmp ecx, 1
jb 0x14018273c
xor edx, edx
mov byte [rbp + 0x29], bl
lea rcx, [rbp + 0x28]
call fcn.1403d6cb0
cmp dword [rdi + 0x64], eax
ja 0x14018275f
mov bl, 1
mov al, bl
add rsp, 0x20
pop rdi
pop rbx
pop rbp
ret
Function at 0x140182b78
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
xor eax, eax
mov dword [rbp + 7], 0x45005c
xor ebx, ebx
mov dword [rbp + 0xb], 0x750067
mov ecx, ebx
mov dword [rbp + 0xf], 0x66006d
mov dword [rbp + 0x13], 0x5b0063
mov dword [rbp + 0x17], 0x7a0043
mov dword [rbp + 0x1b], 0x68006f
mov dword [rbp + 0x1f], 0x490048
mov word [rbp + 0x23], ax
movsxd rax, ecx
xor word [rbp + rax*2 + 7], cx
inc ecx
cmp ecx, 0xe
jb 0x140182bc5
lea rax, [rbp + 7]
mov word [rbp + 0x23], bx
mov qword [rbp - 1], rax
lea rcx, [rbp + 7]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x140182be8
add rax, rax
mov dword [rsp + 0x28], 0x20
cmp rax, 0xfffe
mov dword [rbp + 0x27], 0x30
mov ecx, 0xfffc
mov qword [rbp + 0x2f], rbx
cmove rax, rcx
mov dword [rbp + 0x3f], 0x40
mov word [rbp - 9], ax
lea r9, [rbp + 7]
add ax, 2
mov dword [rsp + 0x20], 7
mov word [rbp - 7], ax
lea r8, [rbp + 0x27]
movaps xmm0, xmmword [rbp - 9]
lea rax, [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rcx, [0x140548a10]
xorps xmm0, xmm0
mov qword [rbp + 0x37], rax
mov edx, 0x100003
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntdll.dll_NtOpenFile]
call qword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov rcx, qword [0x140548a10]
lea r8, [rbp + 0x67]
mov dword [rbp + 0x67], eax
mov r9d, 4
mov qword [rsp + 0x38], rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x30], rax
mov edx, 0xbddc50
lea rax, [rbp + 0x77]
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x77], rbx
call qword [sym.imp.kernel32.dll_DeviceIoControl]
mov eax, dword [rbp + 0x67]
mov rbx, qword [rsp + 0xc8]
lea ecx, [rax + rax]
cmp rcx, qword [rbp + 0x77]
sete al
add rsp, 0xa0
pop rbp
ret
Function at 0x140183134
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
xor eax, eax
mov dword [rsp + 0x2b], 0x306c6877
mov byte [rsp + 0x35], al
xor ecx, ecx
mov dword [rsp + 0x2f], 0x63287036
mov word [rsp + 0x33], 0x6564
movsxd rax, ecx
xor byte [rsp + rax + 0x2b], cl
inc ecx
cmp ecx, 0xa
jb 0x140183165
lea rcx, [rsp + 0x2b]
mov byte [rsp + 0x35], 0
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140183334
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0xff
call fcn.1403ccc50
xor ecx, ecx
mov dword [rbp + 0x50], 0x6c56754e
mov dword [rbp + 0x54], 0x68606f
movsxd rax, ecx
xor byte [rbp + rax + 0x50], cl
inc ecx
cmp ecx, 7
jb 0x1401831b1
lea rcx, [rsp + 0x40]
mov byte [rbp + 0x57], 0
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x1401831cb
lea r8, [rbp + 0x50]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x1401831d9
mov dword [rbp + 0x50], 0x626c604d
xor ecx, ecx
mov dword [rbp + 0x54], 0x746063
movsxd rax, ecx
xor byte [rbp + rax + 0x50], cl
inc ecx
cmp ecx, 7
jb 0x1401831f7
lea rcx, [rsp + 0x40]
mov byte [rbp + 0x57], 0
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x140183211
lea r8, [rbp + 0x50]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x14018321f
mov dword [rsp + 0x20], 0x42766447
xor ecx, ecx
mov dword [rsp + 0x24], 0x686a646a
mov word [rsp + 0x28], 0x6f
movsxd rax, ecx
xor byte [rsp + rax + 0x20], cl
inc ecx
cmp ecx, 9
jb 0x140183246
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x29], 0
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x140183261
lea r8, [rsp + 0x20]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x140183270
mov dword [rsp + 0x20], 0x6f617945
xor ecx, ecx
mov dword [rsp + 0x24], 0x716f7671
mov word [rsp + 0x28], 0x6d
movsxd rax, ecx
xor byte [rsp + rax + 0x20], cl
inc ecx
cmp ecx, 9
jb 0x140183297
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x29], 0
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x1401832b2
lea r8, [rsp + 0x20]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x1401832c1
xor eax, eax
mov dword [rsp + 0x20], 0x66696e54
mov byte [rsp + 0x2a], al
xor ecx, ecx
mov dword [rsp + 0x24], 0x6270406a
mov word [rsp + 0x28], 0x7d66
movsxd rax, ecx
xor byte [rsp + rax + 0x20], cl
inc ecx
cmp ecx, 0xa
jb 0x1401832ee
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x2a], 0
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x140183309
lea r8, [rsp + 0x20]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x140183318
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rbp
ret
Function at 0x140183348
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
xor eax, eax
mov dword [rsp + 0x2d], 0x306c6877
mov byte [rsp + 0x37], al
xor ecx, ecx
mov dword [rsp + 0x31], 0x63287036
mov word [rsp + 0x35], 0x6564
movsxd rax, ecx
xor byte [rsp + rax + 0x2d], cl
inc ecx
cmp ecx, 0xa
jb 0x140183379
lea rcx, [rsp + 0x2d]
mov byte [rsp + 0x37], 0
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140183550
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0xff
call fcn.1403ccc50
xor ecx, ecx
mov dword [rbp + 0x50], 0x6c56754e
mov dword [rbp + 0x54], 0x68606f
movsxd rax, ecx
xor byte [rbp + rax + 0x50], cl
inc ecx
cmp ecx, 7
jb 0x1401833c5
lea rcx, [rsp + 0x40]
mov byte [rbp + 0x57], 0
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x1401833df
lea r8, [rbp + 0x50]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x1401833ed
mov dword [rbp + 0x50], 0x626c604d
xor ecx, ecx
mov dword [rbp + 0x54], 0x746063
movsxd rax, ecx
xor byte [rbp + rax + 0x50], cl
inc ecx
cmp ecx, 7
jb 0x14018340b
lea rcx, [rsp + 0x40]
mov byte [rbp + 0x57], 0
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x140183425
lea r8, [rbp + 0x50]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x140183433
xor eax, eax
mov dword [rsp + 0x20], 0x62677343
mov byte [rsp + 0x2a], al
xor ecx, ecx
mov dword [rsp + 0x24], 0x6b406070
mov word [rsp + 0x28], 0x7961
movsxd rax, ecx
xor byte [rsp + rax + 0x20], cl
inc ecx
cmp ecx, 0xa
jb 0x140183460
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x2a], 0
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x14018347b
lea r8, [rsp + 0x20]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x14018348a
xor eax, eax
mov dword [rsp + 0x20], 0x6668634f
mov byte [rsp + 0x2c], al
xor ecx, ecx
mov dword [rsp + 0x24], 0x62547167
mov dword [rsp + 0x28], 0x65787c7c
movsxd rax, ecx
xor byte [rsp + rax + 0x20], cl
inc ecx
cmp ecx, 0xc
jb 0x1401834b8
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x2c], 0
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x1401834d3
lea r8, [rsp + 0x20]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x1401834e2
mov dword [rsp + 0x20], 0x66696e54
xor ecx, ecx
mov dword [rsp + 0x24], 0x69674d6a
mov dword [rsp + 0x28], 0x6f656c
movsxd rax, ecx
xor byte [rsp + rax + 0x20], cl
inc ecx
cmp ecx, 0xb
jb 0x14018350a
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x2b], 0
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x140183525
lea r8, [rsp + 0x20]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x140183534
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rbp
ret
Function at 0x14018386c
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
cmp qword [0x140548a28], 0
jne 0x140183889
call fcn.140183630
xor edx, edx
lea rcx, [rbp - 0x19]
lea r8d, [rdx + 0x68]
call fcn.1403ccc50
xor eax, eax
mov word [rbp + 0x67], 0x3731
mov byte [rbp + 0x69], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax + 0x67], cl
inc ecx
cmp ecx, 2
jb 0x1401838a5
lea rcx, [rbp + 0x67]
mov byte [rbp + 0x69], 0
call fcn.1403d6dc0
mov r8d, eax
lea rcx, [0x1404cb718]
xor edx, edx
call fcn.1403d6cb0
and qword [rbp - 9], 0
lea r8, [rbp + 0x6f]
and dword [rbp - 1], 0
lea rdx, [rbp + 0x77]
and qword [rbp + 7], 0
xor r9d, r9d
and qword [rbp + 0x6f], 0
xor ecx, ecx
mov dword [rbp - 0x15], eax
lea rax, [rbp - 0x19]
mov qword [rbp + 0x77], rax
mov rax, qword [0x140548a28]
mov dword [rbp - 0x11], 0x8b8
mov byte [rbp + 0xf], 0
call qword [case.0x140173169.0]
cmp eax, 0xdeadbee
sete al
add rsp, 0xa0
pop rbp
ret

Function at 0x140183928
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
xor edx, edx
mov rbx, rcx
lea rcx, [rbp - 0x19]
lea r8d, [rdx + 0x68]
call fcn.1403ccc50
xor eax, eax
mov word [rbp + 0x67], 0x3731
mov byte [rbp + 0x69], al
xor edx, edx
movsxd rax, edx
xor byte [rbp + rax + 0x67], dl
inc edx
cmp edx, 2
jb 0x140183959
lea rcx, [rbp + 0x67]
mov byte [rbp + 0x69], 0
call fcn.1403d6dc0
mov r8d, eax
lea rcx, [0x1404cb718]
xor edx, edx
call fcn.1403d6cb0
and qword [rbp - 9], 0
lea r8, [rbp + 0x6f]
and dword [rbp - 1], 0
lea rdx, [rbp + 0x77]
and qword [rbp + 0x6f], 0
xor r9d, r9d
mov dword [rbp - 0x15], eax
xor ecx, ecx
lea rax, [rbp - 0x19]
mov dword [rbp - 0x11], 0xb
mov qword [rbp + 0x77], rax
mov rax, qword [0x140548a28]
mov qword [rbp + 7], rbx
mov byte [rbp + 0xf], 0
call qword [case.0x140173169.0]
mov rbx, qword [rsp + 0xc8]
add rsp, 0xa0
pop rbp
ret

Function at 0x1401839d8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rbx, rcx
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0xff
call fcn.1403ccc50
lea rcx, [rbp - 0x60]
sub rcx, rbx
mov al, byte [rbx]
mov byte [rcx + rbx], al
inc rbx
test al, al
jne 0x140183a08
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x68]
call fcn.1403ccc50
xor eax, eax
mov word [rbp + 0xb0], 0x3731
mov byte [rbp + 0xb2], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax + 0xb0], cl
inc ecx
cmp ecx, 2
jb 0x140183a37
lea rcx, [rbp + 0xb0]
mov byte [rbp + 0xb2], 0
call fcn.1403d6dc0
mov r8d, eax
lea rcx, [0x1404cb718]
xor edx, edx
call fcn.1403d6cb0
and dword [rsp + 0x48], 0
lea r8, [rbp + 0xb8]
and qword [rsp + 0x50], 0
lea rdx, [rbp + 0xc0]
and qword [rbp + 0xb8], 0
xor r9d, r9d
mov dword [rsp + 0x34], eax
xor ecx, ecx
lea rax, [rbp - 0x60]
mov dword [rsp + 0x38], 0x10
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rbp + 0xc0], rax
mov rax, qword [0x140548a28]
mov byte [rsp + 0x58], 0
call qword [case.0x140173169.0]
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x1a0
pop rbp
ret