joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r15, r9
mov r14, r8
mov ebp, edx
mov rsi, rcx
mov ebx, 1
call fcn.1400d3240
mov rdi, rax
test rax, rax
je 0x1400164f1
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x41], 0x6e456765
mov rcx, rax
mov word [rsp + 0x4c], 0x41
mov dword [rsp + 0x47], 0x4579654b
mov byte [rsp + 0x40], 0x52
mov word [rsp + 0x45], 0x6d75
mov byte [rsp + 0x4b], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400164e9
xor ecx, ecx
mov r9, r15
mov qword [rsp + 0x38], rcx
mov r8, r14
mov qword [rsp + 0x30], rcx
mov edx, ebp
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400c4d80
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400165c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
call fcn.1400d3170
mov rdi, rax
test rax, rax
je 0x140016645
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x23], 0x6e694668
mov rcx, rax
mov word [rsp + 0x21], 0x7461
mov word [rsp + 0x2f], 0x4165
mov byte [rsp + 0x31], 0
mov dword [rsp + 0x28], 0x656c6946
mov word [rsp + 0x2c], 0x614e
mov byte [rsp + 0x20], 0x50
mov byte [rsp + 0x2e], 0x6d
mov byte [rsp + 0x27], 0x64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001663d
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400c4d80
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140016670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x1a], 0x746e6572
mov dword [rbp - 0x1f], 0x75437465
mov dword [rbp - 0x12], 0x737365
mov dword [rbp - 0x16], 0x636f7250
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x1b], 0x72
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400166fb
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x50
pop rbp
ret
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x50
pop rbp
ret
Function at 0x140016720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov word [rbp - 0x1a], 0x7261
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x17], 0x65707954
mov rdi, rdx
mov word [rbp - 0x13], 0x41
mov word [rbp - 0x1d], 0x6942
mov word [rbp - 0x20], 0x6547
mov byte [rbp - 0x1b], 0x6e
mov byte [rbp - 0x1e], 0x74
mov byte [rbp - 0x18], 0x79
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400167b5
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x1400167e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r15, r9
mov r14d, r8d
mov ebp, edx
mov rsi, rcx
xor ebx, ebx
call fcn.1400162b0
mov rdi, rax
test rax, rax
je 0x140016874
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x21], 0x69467465
mov rcx, rax
mov dword [rsp + 0x26], 0x72655665
mov dword [rsp + 0x30], 0x416f66
mov dword [rsp + 0x2b], 0x496e6f69
mov byte [rsp + 0x20], 0x47
mov byte [rsp + 0x2f], 0x6e
mov byte [rsp + 0x25], 0x6c
mov byte [rsp + 0x2a], 0x73
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001686c
mov r9, r15
mov r8d, r14d
mov edx, ebp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400c4d80
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400168a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
mov word [rbp - 0x2f], 0x6570
mov ebx, r8d
mov word [rbp - 0x26], 0x73
mov word [rbp - 0x29], 0x6563
mov word [rbp - 0x2c], 0x7250
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x2a], 0x6f
mov byte [rbp - 0x27], 0x73
mov byte [rbp - 0x30], 0x4f
mov word [rbp - 0x1f], 0x7265
mov dword [rbp - 0x17], 0x6c6c64
mov dword [rbp - 0x1c], 0x32336c65
mov byte [rbp - 0x1d], 0x6e
mov byte [rbp - 0x20], 0x4b
mov byte [rbp - 0x18], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140016930
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call rax
jmp 0x140016937
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140016960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r12, qword [rsp + 0xb0]
mov r15d, r9d
mov r14, r8
mov ebp, edx
mov rsi, rcx
xor ebx, ebx
call fcn.1400d3240
mov rdi, rax
test rax, rax
je 0x140016a05
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x6e656b6f
mov rcx, rax
mov dword [rsp + 0x3f], 0x6e6f6974
mov word [rsp + 0x3a], 0x6f66
mov dword [rsp + 0x30], 0x54746547
mov byte [rsp + 0x43], bl
mov word [rsp + 0x3d], 0x616d
mov word [rsp + 0x38], 0x6e49
mov byte [rsp + 0x3c], 0x72
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400169fd
mov r9d, r15d
mov qword [rsp + 0x20], r12
mov r8, r14
mov edx, ebp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400c4d80
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140016a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, r9
mov rbp, r8
mov rsi, rcx
mov ebx, 1
call fcn.1400d3240
mov rdi, rax
test rax, rax
je 0x140016acf
lea rdx, [rsp + 0x20]
mov word [rsp + 0x23], 0x6547
mov rcx, rax
mov dword [rsp + 0x26], 0x5379654b
mov word [rsp + 0x20], 0x6552
mov word [rsp + 0x2a], 0x6365
mov word [rsp + 0x30], 0x79
mov word [rsp + 0x2d], 0x6972
mov byte [rsp + 0x2c], 0x75
mov byte [rsp + 0x25], 0x74
mov byte [rsp + 0x22], 0x67
mov byte [rsp + 0x2f], 0x74
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140016ac7
mov r9, r14
lea edx, [rbx + 3]
mov r8, rbp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400c4d80
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140016af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r15d, r9d
mov r14d, r8d
mov rsi, rdx
mov rdi, rcx
call fcn.1400d3240
mov rbx, rax
test rax, rax
je 0x140016ba2
lea rdx, [rbp - 0x38]
mov word [rbp - 0x21], 0x614e
mov rcx, rax
mov word [rbp - 0x1e], 0x4165
mov dword [rbp - 0x2c], 0x63634174
mov word [rbp - 0x26], 0x5773
mov byte [rbp - 0x1c], 0
mov dword [rbp - 0x38], 0x6c697542
mov dword [rbp - 0x32], 0x696c7078
mov byte [rbp - 0x1f], 0x6d
mov word [rbp - 0x23], 0x6874
mov byte [rbp - 0x24], 0x69
mov word [rbp - 0x28], 0x7365
mov word [rbp - 0x2e], 0x6963
mov word [rbp - 0x34], 0x4564
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140016b9a
mov r9d, r15d
mov dword [rsp + 0x20], 0
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400c4d80
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140016c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ebx, ebx
call fcn.1400d3240
mov rdi, rax
test rax, rax
je 0x140016d03
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x614d4353
mov rcx, rax
mov dword [rsp + 0x28], 0x6567616e
mov word [rsp + 0x2c], 0x4172
mov dword [rsp + 0x20], 0x6e65704f
mov byte [rsp + 0x2e], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140016cfb
xor edx, edx
lea r8d, [rbx + 1]
xor ecx, ecx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400c4d80
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140016d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, r8
mov rsi, rcx
xor ebx, ebx
call fcn.1400d3240
mov rdi, rax
test rax, rax
je 0x140016dc9
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x53746553
mov rcx, rax
mov word [rbp - 0x1c], 0x6972
mov word [rbp - 0x27], 0x4f65
mov dword [rbp - 0x21], 0x63655374
mov word [rbp - 0x19], 0x79
mov dword [rbp - 0x2c], 0x69767265
mov dword [rbp - 0x25], 0x63656a62
mov byte [rbp - 0x1a], 0x74
mov byte [rbp - 0x1d], 0x75
mov byte [rbp - 0x28], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140016dc1
mov r8, r14
lea edx, [rbx + 4]
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400c4d80
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret

Function at 0x140016e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, rcx
xor ebx, ebx
call fcn.1400d3170
mov rdi, rax
test rax, rax
je 0x140016e83
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x6f6d6552
mov rcx, rax
mov dword [rsp + 0x29], 0x6c694665
mov dword [rsp + 0x20], 0x68746150
mov dword [rsp + 0x2d], 0x65705365
mov word [rsp + 0x32], 0x41
mov byte [rsp + 0x28], 0x76
mov byte [rsp + 0x31], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140016e7b
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400c4d80
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140016eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov esi, dword [rbp + 0x40]
mov rbx, rcx
mov r14d, dword [rbp + 0x48]
lea rcx, [rbp - 0x20]
mov edi, edx
mov word [rbp - 0x2d], 0x7461
mov dword [rbp - 0x28], 0x41656c
mov word [rbp - 0x30], 0x7243
mov word [rbp - 0x2a], 0x6946
mov byte [rbp - 0x2e], 0x65
mov byte [rbp - 0x2b], 0x65
mov word [rbp - 0x1f], 0x7265
mov dword [rbp - 0x17], 0x6c6c64
mov dword [rbp - 0x1c], 0x32336c65
mov byte [rbp - 0x1d], 0x6e
mov byte [rbp - 0x20], 0x4b
mov byte [rbp - 0x18], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140016f5d
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], r14d
xor r8d, r8d
mov edx, edi
mov dword [rsp + 0x20], esi
mov rcx, rbx
call rax
jmp 0x140016f64
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140016f90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x1f], 0x75747269
mov rbx, rdx
mov byte [rbp - 0x20], 0x56
mov dword [rbp - 0x1b], 0x6c416c61
mov word [rbp - 0x16], 0x636f
mov byte [rbp - 0x17], 0x6c
mov byte [rbp - 0x14], 0
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001701d
mov r9d, 4
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140017040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov rsi, rcx
xor ebx, ebx
call fcn.1400d3240
mov rdi, rax
test rax, rax
je 0x1400170e0
lea rdx, [rsp + 0x30]
mov word [rsp + 0x3f], 0x6c69
mov rcx, rax
mov dword [rsp + 0x42], 0x736567
mov dword [rsp + 0x31], 0x73756a64
mov dword [rsp + 0x3a], 0x6972506e
mov dword [rsp + 0x36], 0x656b6f54
mov byte [rsp + 0x3e], 0x76
mov byte [rsp + 0x41], 0x65
mov byte [rsp + 0x35], 0x74
mov byte [rsp + 0x30], 0x41
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400170d8
mov qword [rsp + 0x28], rbx
lea r9d, [rbx + 0x10]
mov r8, rbp
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400c4d80
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140024bd8
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x140024bb5
call fcn.140027d84
mov dword [rax], 0x16
call fcn.140024afc
or eax, 0xffffffff
jmp 0x140024bd2
sub dword [rcx + 0x10], 1
jns 0x140024bc4
add rsp, 0x28
jmp fcn.14003d3ec
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140024b94

Function at 0x140038624
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140038450

Function at 0x1400479d0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400479f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140027d14
or eax, 0xffffffff
jmp 0x1400479f2
xor eax, eax
add rsp, 0x28
ret
Function at 0x14004c5a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rcx + 0x18], 0xf
mov qword [rcx], rax
mov rbx, rcx
mov qword [rcx + 0x10], rax
mov r8, 0xffffffffffffffff
mov byte [rcx], al
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x39], 0x29616c
mov word [rsp + 0x2c], 0x495f
mov word [rsp + 0x31], 0x2063
mov word [rsp + 0x29], 0x4953
mov word [rsp + 0x2e], 0x656e
mov dword [rsp + 0x34], 0x697a6f4d
mov byte [rsp + 0x2b], 0x53
mov byte [rsp + 0x30], 0x74
mov byte [rsp + 0x33], 0x28
mov byte [rsp + 0x28], 0x4e
mov byte [rsp + 0x38], 0x6c
inc r8
cmp byte [rax + r8], 0
jne 0x14004c621
lea rdx, [rsp + 0x28]
call fcn.1400190d0
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x50
pop rbx
ret
Function at 0x140057ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x51
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], 0x75
mov eax, 1
imul rax, rax, 0x17
mov byte [rsp + rax + 0x38], 0x63
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], 0x6d
mov eax, 1
imul rax, rax, 0x16
mov byte [rsp + rax + 0x38], 0x6e
mov eax, 1
imul rax, rax, 0x14
mov byte [rsp + rax + 0x38], 0x75
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], 0x72
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], 0x72
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], 0x6e
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], 0x61
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x38], 0x72
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x38], 0x63
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x38], 0x71
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], 0x79
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], 0x66
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0x19
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x1a
jae 0x140058040
jmp 0x140058045
call fcn.14001e2b8
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], 0x50
mov eax, 1
imul rax, rax, 0x18
mov byte [rsp + rax + 0x38], 0x79
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0x6f
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x38], 0x46
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], 0x72
call fcn.140058290
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400580c2
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x68
ret
Function at 0x1400580e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x38], 0x74
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x47
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x38], 0x41
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], 0x6d
mov eax, 1
imul rax, rax, 0x13
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x14
jae 0x140058162
jmp 0x140058167
call fcn.14001e2b8
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0x44
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x38], 0x6f
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], 0x53
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], 0x74
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], 0x74
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x38], 0x79
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], 0x72
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], 0x63
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x38], 0x72
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], 0x79
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], 0x73
call fcn.140058290
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140058266
mov edx, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x68
ret
Function at 0x140058290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x28], 0x6c
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x28], 0x65
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x28], 0x6c
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x28], 0x33
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x28], 0x65
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x28], 0x6c
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x28], 0x32
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x28], 0x4b
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x28], 0x2e
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x28], 0x64
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x28], 0x6e
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x28], 0x72
mov eax, 1
imul rax, rax, 0xc
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xd
jae 0x140058363
jmp 0x140058368
call fcn.14001e2b8
mov rax, qword [rsp + 0x20]
mov byte [rsp + rax + 0x28], 0
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x48
ret

Function at 0x1400583a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 0x276b
call fcn.140058610
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400584a9
mov eax, 1
imul rax, rax, 0xa
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xb
jae 0x1400583e9
jmp 0x1400583ee
call fcn.14001e2b8
mov rax, qword [rsp + 0x28]
mov byte [rsp + rax + 0x40], 0
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], 0x53
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], 0x43
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], 0x6e
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x41
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], 0x75
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], 0x70
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], 0x61
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x6c
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], 0x65
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400584a9
call qword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x68
ret