joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002efa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14010c598]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, qword [rsp + 0xc0]
xor eax, eax
mov rdi, qword [rsp + 0xc8]
mov rsi, r9
mov rbp, r8
mov r12d, edx
mov r15, rcx
cmp rax, 0x40
jae 0x14002f0e5
mov byte [rsp + rax + 0x20], 0
inc rax
cmp rax, 0x40
jb 0x14002efe8
mov qword [rsp + 0xb0], rbx
xor ebx, ebx
test rbp, rbp
je 0x14002f0b2
nop dword [rax]
test rdi, rdi
je 0x14002f031
test bl, bl
jne 0x14002f031
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x10]
call qword [case.0x140046c11.0]
test eax, eax
jne 0x14002f0b4
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x18]
call qword [case.0x140046c11.0]
mov rax, qword [r14]
mov r8d, r12d
mov rdx, r15
mov rcx, r14
mov rax, qword [rax + 0x20]
call qword [case.0x140046c11.0]
mov rax, qword [r14]
lea rdx, [rsp + 0x20]
mov rcx, r14
mov rax, qword [rax + 0x28]
call qword [case.0x140046c11.0]
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x30]
call qword [case.0x140046c11.0]
cmp eax, 0x40
ja 0x14002f0de
xor r8d, r8d
xor ecx, ecx
test eax, eax
je 0x14002f09c
nop word [rax + rax]
xor r8d, dword [rsp + rcx + 0x20]
add ecx, 4
cmp ecx, eax
jb 0x14002f090
test rsi, rsi
je 0x14002f0a6
cmp r8d, dword [rsi]
jne 0x14002f0de
inc rbx
cmp rbx, rbp
jb 0x14002f010
xor eax, eax
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400c7aa0
mov rbp, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov eax, 1
jmp 0x14002f0b4
call fcn.1400c7f04
int3
Function at 0x14002f0f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ecx, ecx
call fcn.1400a76a0
mov ecx, 0x500
call fcn.1400a76c0
mov r14, rax
test rax, rax
je 0x14002f284
xor ecx, ecx
mov rdx, rax
nop word [rax + rax]
mov byte [rdx], cl
lea rdx, [rdx + 1]
inc ecx
cmp ecx, 0x100
jb 0x14002f130
mov r8d, 0xffffffff
lea r9, [rax + 1]
mov r10d, 0x40
lea r15, [0x140114800]
nop word [rax + rax]
movzx ecx, byte [r9 - 1]
lea r9, [r9 + 4]
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 4]
mov edx, dword [r15 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 3]
mov r8d, dword [r15 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 2]
mov edx, dword [r15 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r8d, dword [r15 + rax*4]
xor r8d, edx
sub r10, 1
jne 0x14002f160
not r8d
cmp r8d, 0x29058c73
jne 0x14002f284
mov edx, 0x1f123bb5
lea r9, [r14 + 0x100]
mov r8d, 0x159a55e5
mov r10d, 0x400
movzx eax, r8w
lea r9, [r9 + 1]
imul ecx, eax, 0x9069
movzx eax, dx
shr r8d, 0x10
shr edx, 0x10
add r8d, ecx
imul ecx, eax, 0x4650
add edx, ecx
mov byte [r9 - 1], dl
sub r10, 1
jne 0x14002f1f2
xor ebp, ebp
xor edi, edi
mov esi, ebp
add rsi, r14
nop dword [rax + rax]
mov ebx, 0xffffffff
test edi, edi
je 0x14002f25f
mov r8, rsi
mov r9d, edi
nop
movzx ecx, byte [r8]
lea r8, [r8 + 1]
mov eax, ebx
xor rcx, rax
shr eax, 8
movzx edx, cl
mov ebx, dword [r15 + rdx*4]
xor ebx, eax
sub r9, 1
jne 0x14002f240
mov edx, edi
mov rcx, rsi
call fcn.1400c6e10
not ebx
cmp ebx, eax
jne 0x14002f284
inc edi
cmp edi, 0x20
jb 0x14002f230
inc ebp
cmp ebp, 0x4e0
jb 0x14002f221
mov bl, 1
jmp 0x14002f286
xor bl, bl
mov rcx, r14
call fcn.1400a76a0
mov rbp, qword [rsp + 0x48]
movzx eax, bl
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140032240
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11d, edx
mov r10, rcx
test edx, edx
je 0x1400322a3
mov qword [rsp + 0x10], rbx
mov rbx, rcx
mov qword [rsp], rdi
mov edi, r11d
nop dword [rax]
mov r9d, dword [r8]
lea rbx, [rbx + 1]
movzx eax, r9w
imul edx, eax, 0x9069
shr r9d, 0x10
add edx, r9d
mov dword [r8], edx
mov edx, dword [r8 + 4]
movzx eax, dx
imul eax, eax, 0x4650
shr edx, 0x10
add eax, edx
mov dword [r8 + 4], eax
mov byte [rbx - 1], al
sub rdi, 1
jne 0x140032260
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
mov eax, 0xffffffff
test r11d, r11d
je 0x1400322e0
mov r9, r11
lea r11, [0x140114800]
nop word [rax + rax]
movzx edx, byte [r10]
lea r10, [r10 + 1]
mov ecx, eax
xor rdx, rcx
shr ecx, 8
movzx r8d, dl
mov eax, dword [r11 + r8*4]
xor eax, ecx
sub r9, 1
jne 0x1400322c0
not eax
add rsp, 8
ret

Function at 0x140033280
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x14003341a
mov eax, edx
nop word [rax + rax]
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
sub rax, 1
jne 0x140033290
mov eax, ecx
ret
Function at 0x140070280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov r15, rdx
mov r12, rcx
xor r13d, r13d
mov qword [rcx], r13
mov qword [rcx + 8], r13
mov edi, dword [rdx + 8]
lea r14, [r13 - 1]
test edi, edi
je 0x1400702f6
mov eax, 8
mul rdi
cmovo rax, r14
mov rcx, rax
call fcn.1400c79c4
mov qword [r12], rax
mov dword [r12 + 8], edi
mov dword [r12 + 0xc], edi
lea r8, [rdi*8]
mov rdx, qword [r15]
mov rcx, rax
call fcn.1400c8abe
nop
lea rsi, [r12 + 0x10]
mov qword [rsp + 0x78], rsi
mov qword [rsi], r13
mov qword [rsi + 8], r13
mov ebx, dword [r15 + 0x18]
mov ebp, ebx
test ebx, ebx
je 0x1400703a7
mov eax, 8
mul rbx
cmovo rax, r14
mov rcx, rax
call fcn.1400c79c4
mov qword [rsi], rax
mov dword [rsi + 0xc], ebx
test ebx, ebx
je 0x1400703a7
mov r14, r13
mov ecx, 0x28
call fcn.1400c7980
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14007038d
mov rax, qword [r15 + 0x10]
mov rdi, qword [r14 + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.140003c90
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rbx + 0x14], eax
mov eax, dword [rdi + 0x18]
mov dword [rbx + 0x18], eax
mov eax, dword [rdi + 0x1c]
mov dword [rbx + 0x1c], eax
movzx eax, word [rdi + 0x20]
mov word [rbx + 0x20], ax
movzx eax, word [rdi + 0x22]
mov word [rbx + 0x22], ax
jmp 0x140070390
mov rbx, r13
mov ecx, dword [rsi + 8]
mov rax, qword [rsi]
mov qword [rax + rcx*8], rbx
inc dword [rsi + 8]
add r14, 8
sub rbp, 1
jne 0x140070336
mov rax, qword [r15 + 0x20]
mov qword [r12 + 0x20], rax
lea rsi, [r12 + 0x28]
mov qword [rsp + 0x78], rsi
movzx eax, byte [r15 + 0x28]
mov byte [rsi], al
movzx eax, byte [r15 + 0x29]
mov byte [rsi + 1], al
mov eax, dword [r15 + 0x2c]
mov dword [rsi + 4], eax
mov eax, dword [r15 + 0x30]
mov dword [rsi + 8], eax
mov eax, dword [r15 + 0x34]
mov dword [rsi + 0xc], eax
mov eax, dword [r15 + 0x38]
mov dword [rsi + 0x10], eax
mov eax, dword [r15 + 0x3c]
mov dword [rsi + 0x14], eax
movzx eax, word [r15 + 0x40]
mov word [rsi + 0x18], ax
movzx eax, byte [r15 + 0x42]
mov byte [rsi + 0x1a], al
movzx eax, byte [r15 + 0x43]
mov byte [rsi + 0x1b], al
lea rdi, [rsi + 0x20]
mov qword [rsp + 0x80], rdi
lea rdx, [r15 + 0x48]
mov rcx, rdi
call fcn.140003c90
nop
lea rdx, [r15 + 0x58]
lea rcx, [rdi + 0x10]
call fcn.140003c90
nop
lea rdi, [rsi + 0x40]
mov qword [rsp + 0x80], rdi
lea rdx, [r15 + 0x68]
mov rcx, rdi
call fcn.140003c90
nop
lea rdx, [r15 + 0x78]
lea rcx, [rdi + 0x10]
call fcn.140003c90
nop
mov eax, dword [r15 + 0x88]
mov dword [rsi + 0x60], eax
mov eax, dword [r15 + 0x8c]
mov dword [rsi + 0x64], eax
mov rax, r12
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a68f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x14010c598]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, r8
movzx edx, dl
mov rbx, rcx
mov r8d, 0x40
lea rcx, [rsp + 0x80]
call fcn.1400c8ae8
movdqu xmm0, xmmword [rbx]
lea rcx, [rsp + 0x80]
mov r9d, 4
lea rax, [rsp + 0x90]
sub rbx, rcx
pxor xmm0, xmmword [rsp + 0x80]
movdqu xmmword [rsp + 0x80], xmm0
nop word [rax + rax]
movzx ecx, byte [rbx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x1400a6960
lea rcx, [rsp + 0x20]
call fcn.1400be590
mov r8d, 0x40
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.1400be5c0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400bde50
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400c7aa0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rdi
ret

Function at 0x1400a69c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x110
mov rax, qword [0x14010c598]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, rdx
lea rdx, [rsp + 0xc0]
call fcn.1400bde50
movdqu xmm0, xmmword [rsp + 0xc0]
movabs rax, 0x3636363636363636
mov edx, 4
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
movdqu xmm1, xmmword [rsp + 0x80]
pxor xmm1, xmm0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov eax, 0x10
movdqu xmmword [rsp + 0x80], xmm1
nop
movzx ecx, byte [rsp + rax + 0xc0]
xor byte [rsp + rax + 0x80], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400a6a60
lea rcx, [rsp + 0x20]
call fcn.1400be590
mov r8d, 0x40
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.1400be5c0
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x20]
call fcn.1400bde50
lea r8, [rsp + 0xec]
mov dl, 0x5c
lea rcx, [rsp + 0xc0]
call fcn.1400a68f0
movups xmm0, xmmword [rsp + 0xd8]
movups xmm1, xmmword [rsp + 0xe8]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400c7aa0
add rsp, 0x110
pop rbx
ret
Function at 0x1400c8530
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov rax, qword gs:[0x30]
xor r15d, r15d
mov r14d, r15d
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x30]
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi + 0x8c], r15d
je 0x1400c8624
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x1400c8624
lea rax, [rsi + rcx]
mov edx, r15d
mov ecx, dword [rax + 0x20]
mov r9d, dword [rax + 0x24]
add rcx, rsi
mov r10d, dword [rax + 0x1c]
add r9, rsi
mov r8d, dword [rax + 0x18]
add r10, rsi
dec r8d
mov eax, dword [rcx]
add rax, rsi
cmp byte [rax], 0x47
jne 0x1400c8609
cmp byte [rax + 1], 0x65
jne 0x1400c8609
cmp byte [rax + 2], 0x74
jne 0x1400c8609
cmp byte [rax + 3], 0x50
jne 0x1400c8609
cmp byte [rax + 4], 0x72
jne 0x1400c8609
cmp byte [rax + 5], 0x6f
jne 0x1400c8609
cmp byte [rax + 6], 0x63
jne 0x1400c8609
cmp byte [rax + 7], 0x41
jne 0x1400c8609
cmp byte [rax + 8], 0x64
jne 0x1400c8609
cmp byte [rax + 9], 0x64
jne 0x1400c8609
cmp byte [rax + 0xa], 0x72
jne 0x1400c8609
cmp byte [rax + 0xb], 0x65
jne 0x1400c8609
cmp byte [rax + 0xc], 0x73
jne 0x1400c8609
cmp byte [rax + 0xd], 0x73
je 0x1400c8616
inc edx
add rcx, 4
cmp edx, r8d
ja 0x1400c8624
jmp 0x1400c85b1
mov eax, edx
movzx ecx, word [r9 + rax*2]
mov r14d, dword [r10 + rcx*4]
add r14, rsi
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x78], 0x64616f4c
mov rcx, rsi
mov dword [rsp + 0x7c], 0x7262694c
mov dword [rbp - 0x80], 0x41797261
mov byte [rbp - 0x7c], r15b
call r14
mov rdi, rax
mov dword [rsp + 0x40], 0x696e6977
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], 0x2e74656e
mov dword [rsp + 0x48], 0x6c6c64
mov dword [rbp - 0x68], 0x65746e49
mov dword [rbp - 0x64], 0x74656e72
mov dword [rbp - 0x60], 0x6e65704f
mov word [rbp - 0x5c], 0x41
mov dword [rbp - 0x38], 0x65746e49
mov dword [rbp - 0x34], 0x74656e72
mov dword [rbp - 0x30], 0x6e6e6f43
rol byte [r11 + 0x6f], 1
outsb dx, byte [rsi]
outsb dx, byte [rsi]
mov dword [rbp - 0x2c], 0x41746365
mov byte [rbp - 0x28], r15b
mov dword [rbp - 0x20], 0x70747448
mov dword [rbp - 0x1c], 0x6e65704f
mov dword [rbp - 0x18], 0x75716552
call 0x1b57dec0c
mov dword [rbp - 0x14], 0x41747365
mov byte [rbp - 0x10], r15b
mov dword [rbp - 8], 0x70747448
mov dword [rbp - 4], 0x646e6553
mov dword [rbp], 0x75716552
mov dword [rbp + 4], 0x41747365
mov byte [rbp + 8], r15b
mov dword [rbp - 0x58], 0x70747448
mov dword [rbp - 0x54], 0x72657551
mov dword [rbp - 0x50], 0x666e4979
mov word [rbp - 0x4c], 0x416f
Function at 0x1400c85a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov rax, qword gs:[0x30]
xor r15d, r15d
mov r14d, r15d
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x30]
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi + 0x8c], r15d
je 0x1400c8624
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x1400c8624
lea rax, [rsi + rcx]
mov edx, r15d
mov ecx, dword [rax + 0x20]
mov r9d, dword [rax + 0x24]
add rcx, rsi
mov r10d, dword [rax + 0x1c]
add r9, rsi
mov r8d, dword [rax + 0x18]
add r10, rsi
dec r8d
mov eax, dword [rcx]
add rax, rsi
cmp byte [rax], 0x47
jne 0x1400c8609
cmp byte [rax + 1], 0x65
jne 0x1400c8609
cmp byte [rax + 2], 0x74
jne 0x1400c8609
cmp byte [rax + 3], 0x50
jne 0x1400c8609
cmp byte [rax + 4], 0x72
jne 0x1400c8609
cmp byte [rax + 5], 0x6f
jne 0x1400c8609
cmp byte [rax + 6], 0x63
jne 0x1400c8609
cmp byte [rax + 7], 0x41
jne 0x1400c8609
cmp byte [rax + 8], 0x64
jne 0x1400c8609
cmp byte [rax + 9], 0x64
jne 0x1400c8609
cmp byte [rax + 0xa], 0x72
jne 0x1400c8609
cmp byte [rax + 0xb], 0x65
jne 0x1400c8609
cmp byte [rax + 0xc], 0x73
jne 0x1400c8609
cmp byte [rax + 0xd], 0x73
je 0x1400c8616
inc edx
add rcx, 4
cmp edx, r8d
ja 0x1400c8624
jmp 0x1400c85b1
mov eax, edx
movzx ecx, word [r9 + rax*2]
mov r14d, dword [r10 + rcx*4]
add r14, rsi
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x78], 0x64616f4c
mov rcx, rsi
mov dword [rsp + 0x7c], 0x7262694c
mov dword [rbp - 0x80], 0x41797261
mov byte [rbp - 0x7c], r15b
call r14
mov rdi, rax
mov dword [rsp + 0x40], 0x696e6977
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], 0x2e74656e
mov dword [rsp + 0x48], 0x6c6c64
mov dword [rbp - 0x68], 0x65746e49
mov dword [rbp - 0x64], 0x74656e72
mov dword [rbp - 0x60], 0x6e65704f
mov word [rbp - 0x5c], 0x41
mov dword [rbp - 0x38], 0x65746e49
mov dword [rbp - 0x34], 0x74656e72
mov dword [rbp - 0x30], 0x6e6e6f43
rol byte [r11 + 0x6f], 1
outsb dx, byte [rsi]
outsb dx, byte [rsi]
mov dword [rbp - 0x2c], 0x41746365
mov byte [rbp - 0x28], r15b
mov dword [rbp - 0x20], 0x70747448
mov dword [rbp - 0x1c], 0x6e65704f
mov dword [rbp - 0x18], 0x75716552
call 0x1b57dec0c
mov dword [rbp - 0x14], 0x41747365
mov byte [rbp - 0x10], r15b
mov dword [rbp - 8], 0x70747448
mov dword [rbp - 4], 0x646e6553
mov dword [rbp], 0x75716552
mov dword [rbp + 4], 0x41747365
mov byte [rbp + 8], r15b
mov dword [rbp - 0x58], 0x70747448
mov dword [rbp - 0x54], 0x72657551
mov dword [rbp - 0x50], 0x666e4979
mov word [rbp - 0x4c], 0x416f
Function at 0x1400c8650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov rax, qword gs:[0x30]
xor r15d, r15d
mov r14d, r15d
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x30]
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi + 0x8c], r15d
je 0x1400c8624
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x1400c8624
lea rax, [rsi + rcx]
mov edx, r15d
mov ecx, dword [rax + 0x20]
mov r9d, dword [rax + 0x24]
add rcx, rsi
mov r10d, dword [rax + 0x1c]
add r9, rsi
mov r8d, dword [rax + 0x18]
add r10, rsi
dec r8d
mov eax, dword [rcx]
add rax, rsi
cmp byte [rax], 0x47
jne 0x1400c8609
cmp byte [rax + 1], 0x65
jne 0x1400c8609
cmp byte [rax + 2], 0x74
jne 0x1400c8609
cmp byte [rax + 3], 0x50
jne 0x1400c8609
cmp byte [rax + 4], 0x72
jne 0x1400c8609
cmp byte [rax + 5], 0x6f
jne 0x1400c8609
cmp byte [rax + 6], 0x63
jne 0x1400c8609
cmp byte [rax + 7], 0x41
jne 0x1400c8609
cmp byte [rax + 8], 0x64
jne 0x1400c8609
cmp byte [rax + 9], 0x64
jne 0x1400c8609
cmp byte [rax + 0xa], 0x72
jne 0x1400c8609
cmp byte [rax + 0xb], 0x65
jne 0x1400c8609
cmp byte [rax + 0xc], 0x73
jne 0x1400c8609
cmp byte [rax + 0xd], 0x73
je 0x1400c8616
inc edx
add rcx, 4
cmp edx, r8d
ja 0x1400c8624
jmp 0x1400c85b1
mov eax, edx
movzx ecx, word [r9 + rax*2]
mov r14d, dword [r10 + rcx*4]
add r14, rsi
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x78], 0x64616f4c
mov rcx, rsi
mov dword [rsp + 0x7c], 0x7262694c
mov dword [rbp - 0x80], 0x41797261
mov byte [rbp - 0x7c], r15b
call r14
mov rdi, rax
mov dword [rsp + 0x40], 0x696e6977
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], 0x2e74656e
mov dword [rsp + 0x48], 0x6c6c64
mov dword [rbp - 0x68], 0x65746e49
mov dword [rbp - 0x64], 0x74656e72
mov dword [rbp - 0x60], 0x6e65704f
mov word [rbp - 0x5c], 0x41
mov dword [rbp - 0x38], 0x65746e49
mov dword [rbp - 0x34], 0x74656e72
mov dword [rbp - 0x30], 0x6e6e6f43
rol byte [r11 + 0x6f], 1
outsb dx, byte [rsi]
outsb dx, byte [rsi]
mov dword [rbp - 0x2c], 0x41746365
mov byte [rbp - 0x28], r15b
mov dword [rbp - 0x20], 0x70747448
mov dword [rbp - 0x1c], 0x6e65704f
mov dword [rbp - 0x18], 0x75716552
call 0x1b57dec0c
mov dword [rbp - 0x14], 0x41747365
mov byte [rbp - 0x10], r15b
mov dword [rbp - 8], 0x70747448
mov dword [rbp - 4], 0x646e6553
mov dword [rbp], 0x75716552
mov dword [rbp + 4], 0x41747365
mov byte [rbp + 8], r15b
mov dword [rbp - 0x58], 0x70747448
mov dword [rbp - 0x54], 0x72657551
mov dword [rbp - 0x50], 0x666e4979
mov word [rbp - 0x4c], 0x416f
Function at 0x4140a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41422b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005834e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414105
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414114
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414133
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414143
cmp rbx, 0x1000
jae 0x41410b
jmp 0x4141ad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414155
xor edx, edx
jmp 0x4141a4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005834e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414139
jmp 0x414128
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005834e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004a2343]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004a264a]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004a41e7]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x414260
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414486
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005834e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4142d3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4142e2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414305
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x414315
cmp rbx, 0x1000
jae 0x4142d9
nop
jmp 0x414398
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41432d
xor esi, esi
jmp 0x41438a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005834e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41430b
jmp 0x4142f6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005834e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414420
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x004a2663]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004a264a]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0049fd37]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4143c0
call sym.runtime.printlock
lea rax, [0x004a2663]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004a264a]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004a3b07]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS