joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014ae4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, qword [rbp + 0x68]
mov rsi, rcx
lea rcx, [rbp - 0x38]
mov dword [rbp - 0x2f], 0x6c6c64
mov r12, r9
mov word [rbp - 0x32], 0x3233
mov r15d, r8d
mov byte [rbp - 0x30], 0x2e
mov r14d, edx
mov dword [rbp - 0x37], 0x70617374
xor ebx, ebx
mov byte [rbp - 0x38], 0x57
mov byte [rbp - 0x33], 0x69
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140014bb0
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x17], 0x41736e6f
mov rcx, rax
mov dword [rbp - 0x1d], 0x73655365
mov dword [rbp - 0x25], 0x6d756e45
mov word [rbp - 0x28], 0x5457
mov word [rbp - 0x20], 0x6172
mov word [rbp - 0x19], 0x6973
mov byte [rbp - 0x13], bl
mov byte [rbp - 0x26], 0x53
mov byte [rbp - 0x1e], 0x74
mov byte [rbp - 0x21], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014ba7
mov r9, r12
mov qword [rsp + 0x20], r13
mov r8d, r15d
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140014bd8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15d, r8d
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.1400145ec
mov rdi, rax
test rax, rax
je 0x140014c5a
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x17], 0x416563
mov rcx, rax
mov dword [rbp - 0x1f], 0x536e6570
mov word [rbp - 0x1a], 0x7672
mov byte [rbp - 0x1b], 0x65
mov byte [rbp - 0x20], 0x4f
mov byte [rbp - 0x18], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014c51
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014c84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
xor ebx, ebx
call fcn.140006500
mov rdi, rax
test rax, rax
je 0x140014cfe
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1a], 0x7845656c
mov rcx, rax
mov dword [rbp - 0x16], 0x73747369
mov word [rbp - 0x12], 0x41
mov dword [rbp - 0x20], 0x68746150
mov word [rbp - 0x1c], 0x6946
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014cf5
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140014dec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rdx
mov rsi, rcx
mov edi, 0xe
call fcn.14001464c
mov rbx, rax
test rax, rax
je 0x140014e67
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x41676e
mov rcx, rax
mov dword [rbp - 0x1a], 0x69727453
mov dword [rbp - 0x20], 0x64697555
mov word [rbp - 0x1c], 0x6f54
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014e5e
mov rdx, r14
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret

Function at 0x140014f1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 8], rax
mov esi, edx
mov dword [rbp - 0x16], 0x6d756c6f
mov rdi, rcx
mov word [rbp - 0x1d], 0x4664
or rbx, 0xffffffffffffffff
mov word [rbp - 0x20], 0x6946
mov dword [rbp - 0x1b], 0x74737269
mov word [rbp - 0x12], 0x5765
mov byte [rbp - 0x1e], 0x6e
mov byte [rbp - 0x10], 0
mov byte [rbp - 0x17], 0x56
call fcn.14000655c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014f8f
mov edx, esi
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140058060
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014fb4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14d, r8d
mov word [rbp - 0x1f], 0x6570
mov esi, edx
mov word [rbp - 0x16], 0x73
mov edi, ecx
mov word [rbp - 0x19], 0x6563
or rbx, 0xffffffffffffffff
mov word [rbp - 0x1c], 0x7250
mov byte [rbp - 0x1d], 0x6e
mov byte [rbp - 0x1a], 0x6f
mov byte [rbp - 0x17], 0x73
mov byte [rbp - 0x20], 0x4f
call fcn.14000655c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140015026
mov r8d, r14d
mov edx, esi
mov ecx, edi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140015048
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov word [rsp + 0x28], 0x65
mov dword [rsp + 0x21], 0x6c61636f
mov word [rsp + 0x25], 0x7246
mov byte [rsp + 0x20], 0x4c
mov byte [rsp + 0x27], 0x65
call fcn.14000655c
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400150a0
mov rcx, rbx
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140058060
add rsp, 0x40
pop rbx
ret

Function at 0x14001516c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xa8
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x87]
mov r12, r9
mov r13, qword [rbp + 0x6f]
mov r15, r8
mov qword [rbp - 0x29], rax
mov r14, rdx
mov rax, qword [rbp + 0x8f]
mov rsi, rcx
mov qword [rbp - 0x31], rax
xor ebx, ebx
mov rax, qword [rbp + 0x97]
mov qword [rbp - 0x39], rax
mov rax, qword [rbp + 0x9f]
mov qword [rbp - 0x41], rax
call fcn.1400145ec
mov rdi, rax
test rax, rax
je 0x140015276
lea rdx, [rbp - 0x21]
mov dword [rbp - 0x20], 0x74616572
mov rcx, rax
mov dword [rbp - 0x15], 0x55734173
mov dword [rbp - 0x1a], 0x65636f72
mov dword [rbp - 0x10], 0x417265
mov byte [rbp - 0x21], 0x43
mov word [rbp - 0x1c], 0x5065
mov byte [rbp - 0x16], 0x73
mov byte [rbp - 0x11], 0x73
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14001526d
mov rax, qword [rbp - 0x41]
mov r9, r12
mov qword [rsp + 0x50], rax
mov r8, r15
mov rax, qword [rbp - 0x39]
mov rdx, r14
mov qword [rsp + 0x48], rax
mov rcx, rsi
mov rax, qword [rbp - 0x31]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x29]
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0x7f]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x77]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.140058060
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400152a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x70]
mov r12, r9
mov r13, qword [rbp + 0x68]
mov r15, r8
mov qword [rbp - 0x28], rax
mov r14d, edx
mov rax, qword [rbp + 0x78]
mov rsi, rcx
mov qword [rbp - 0x30], rax
mov edi, 1
mov rax, qword [rbp + 0x80]
mov qword [rbp - 0x38], rax
call fcn.1400145ec
mov rbx, rax
test rax, rax
je 0x14001536c
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x6e456765
mov rcx, rax
mov word [rbp - 0x14], 0x41
mov dword [rbp - 0x19], 0x4579654b
mov byte [rbp - 0x20], 0x52
mov word [rbp - 0x1b], 0x6d75
mov byte [rbp - 0x15], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140015363
mov rcx, qword [rbp - 0x38]
mov r9, r12
mov qword [rsp + 0x38], rcx
mov r8, r15
mov rcx, qword [rbp - 0x30]
mov edx, r14d
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov qword [rsp + 0x20], r13
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140015394
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12d, r9d
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.14001849c
mov rdi, rax
test rax, rax
je 0x140015415
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1b], 0x6f426567
mov rcx, rax
mov dword [rbp - 0x20], 0x7373654d
mov byte [rbp - 0x1c], 0x61
mov word [rbp - 0x17], 0x4178
mov byte [rbp - 0x15], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001540c
mov r9d, r12d
mov r8, r15
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140015438
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, r9
mov r15d, r8d
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
call fcn.14008c2cc
mov rdi, rax
test rax, rax
je 0x1400154ca
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x69467465
mov rcx, rax
mov dword [rbp - 0x1a], 0x72655665
mov dword [rbp - 0x10], 0x416f66
mov dword [rbp - 0x15], 0x496e6f69
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x11], 0x6e
mov byte [rbp - 0x1b], 0x6c
mov byte [rbp - 0x16], 0x73
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400154c1
mov r9, r12
mov r8d, r15d
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140058060
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400154f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov dword [rbp - 0x17], 0x746e75
mov dword [rbp - 0x1e], 0x63695474
mov word [rbp - 0x19], 0x6f43
mov word [rbp - 0x20], 0x6547
mov byte [rbp - 0x1a], 0x6b
call fcn.14000655c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140015546
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400162c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov al, byte [rcx]
mov r8, rcx
or edx, 0xffffffff
jmp 0x1400162f6
movzx eax, al
mov r9d, 7
xor edx, eax
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov edx, ecx
xor edx, eax
sub r9d, 1
jns 0x1400162d5
inc r8
mov al, byte [r8]
test al, al
jne 0x1400162ca
not edx
mov eax, edx
ret
Function at 0x1400167a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rdx
mov word [rbp - 0x2a], 0x372e
mov dword [rbp - 0x28], 0x363630
mov dword [rbp - 0x2f], 0x2e302e36
mov byte [rbp - 0x2b], 0x35
mov byte [rbp - 0x30], 0x36
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x48]
call fcn.140050e54
nop
mov rcx, qword [rdi]
cmp dword [rcx - 0x10], 0
jne 0x14001686b
mov rcx, qword [rbp - 0x48]
add rcx, 0xffffffffffffffe8
call fcn.140051fa4
add rax, 0x18
mov qword [rsi], rax
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140016845
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140016976
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140016976
and dword [rbp - 0x50], 0
and dword [rbp - 0x4c], 0
and qword [rbp - 0x40], 0
lea rdx, [rbp - 0x50]
call fcn.14008cfa8
mov ebx, eax
test eax, eax
je 0x140016922
mov ecx, ebx
call fcn.140058178
mov r14, rax
mov r9, rax
mov r8d, ebx
mov edx, dword [rbp - 0x50]
mov rcx, qword [rdi]
call fcn.140015438
test eax, eax
je 0x14001691a
lea r9, [rbp - 0x4c]
lea r8, [rbp - 0x40]
lea rdx, [0x1400a6a68]
mov rcx, r14
call fcn.14000d994
test eax, eax
je 0x14001691a
cmp dword [rbp - 0x4c], 0
je 0x14001691a
mov rdx, qword [rbp - 0x40]
cmp dword [rdx], 0xfeef04bd
jne 0x14001691a
mov dword [rbp - 0x19], 0x64252e64
mov dword [rbp - 0x1d], 0x252e6425
mov word [rbp - 0x1f], 0x2e64
mov byte [rbp - 0x15], 0
mov byte [rbp - 0x20], 0x25
movzx eax, word [rdx + 0xc]
movzx ecx, word [rdx + 0xe]
movzx r9d, word [rdx + 8]
movzx r8d, word [rdx + 0xa]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x48]
call fcn.140052380
mov rcx, r14
call fcn.1400580c4
mov rcx, qword [rbp - 0x48]
add rcx, 0xffffffffffffffe8
call fcn.140051fa4
add rax, 0x18
mov qword [rsi], rax
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140016958
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x140016976
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, rsi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140017c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov qword [rbp - 0x38], rdx
and dword [rbp - 0x40], 0
lea rdx, [rbp - 0x18]
call fcn.14000c33c
and qword [rbx], 0
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov dword [rbp - 0x40], 1
mov ecx, 0x30
call fcn.140058088
mov rcx, rax
mov qword [rbx + 0x10], 0x20
mov qword [rbx + 0x18], 0x2f
mov al, byte [rbx]
mov byte [rcx], al
mov qword [rbx], rcx
and qword [rbx + 0x10], 0
xor esi, esi
mov word [rbp - 0x2d], 0x3433
mov word [rbp - 0x30], 0x3130
mov word [rbp - 0x22], 0x6665
mov word [rbp - 0x2b], 0x3635
mov word [rbp - 0x25], 0x6362
mov word [rbp - 0x28], 0x3938
mov byte [rbp - 0x23], 0x64
mov byte [rbp - 0x2e], 0x32
mov byte [rbp - 0x20], 0
mov byte [rbp - 0x29], 0x37
mov byte [rbp - 0x26], 0x61
movzx edi, byte [rbp + rsi - 0x18]
mov eax, edi
shr rax, 4
mov r9b, byte [rbp + rax - 0x30]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x140017d79
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140017d6e
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140017d88
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.14004b68c
and edi, 0xf
mov r9b, byte [rbp + rdi - 0x30]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x140017dba
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140017daf
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140017dc9
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.14004b68c
inc rsi
cmp rsi, 0x10
jl 0x140017d07
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140058060
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001849c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
mov word [rbp - 0x1a], 0x642e
mov word [rbp - 0x1d], 0x3372
mov word [rbp - 0x20], 0x7355
mov word [rbp - 0x17], 0x6c
mov byte [rbp - 0x1e], 0x65
mov byte [rbp - 0x1b], 0x32
mov byte [rbp - 0x18], 0x6c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
add rsp, 0x40
pop rbp
ret

Function at 0x140018610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
call fcn.1400145ec
mov rdi, rax
test rax, rax
je 0x1400186b4
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x24], 0x72637365
mov rcx, rax
mov dword [rbp - 0x2b], 0x69727563
mov dword [rbp - 0x30], 0x53746553
mov dword [rbp - 0x1a], 0x6c6361
mov word [rbp - 0x1f], 0x7470
mov word [rbp - 0x1c], 0x4472
mov word [rbp - 0x26], 0x4479
mov byte [rbp - 0x2c], 0x65
mov byte [rbp - 0x20], 0x69
mov byte [rbp - 0x27], 0x74
mov byte [rbp - 0x1d], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400186ab
mov r9d, r12d
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140018798
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x70]
mov r12d, r9d
mov r13, qword [rbp + 0x68]
mov r15, r8
mov qword [rbp - 0x38], rax
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
call fcn.1400145ec
mov rdi, rax
test rax, rax
je 0x14001884c
lea rdx, [rbp - 0x30]
mov word [rbp - 0x21], 0x6c69
mov rcx, rax
mov dword [rbp - 0x1e], 0x736567
mov dword [rbp - 0x2f], 0x73756a64
mov dword [rbp - 0x26], 0x6972506e
mov dword [rbp - 0x2a], 0x656b6f54
mov byte [rbp - 0x22], 0x76
mov byte [rbp - 0x1f], 0x65
mov byte [rbp - 0x2b], 0x74
mov byte [rbp - 0x30], 0x41
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140018843
mov rcx, qword [rbp - 0x38]
mov r9d, r12d
mov qword [rsp + 0x28], rcx
mov r8, r15
mov rcx, rsi
mov qword [rsp + 0x20], r13
mov edx, r14d
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140058060
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140018874
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, r9
mov r15, r8
mov r14d, edx
mov rsi, rcx
mov edi, 1
call fcn.1400145ec
mov rbx, rax
test rax, rax
je 0x140018912
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1d], 0x6547
mov rcx, rax
mov dword [rbp - 0x1a], 0x5379654b
mov word [rbp - 0x20], 0x6552
mov word [rbp - 0x16], 0x6365
mov word [rbp - 0x10], 0x79
mov word [rbp - 0x13], 0x6972
mov byte [rbp - 0x14], 0x75
mov byte [rbp - 0x1b], 0x74
mov byte [rbp - 0x1e], 0x67
mov byte [rbp - 0x11], 0x74
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140018909
mov r9, r12
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140058060
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140018938
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, qword [rbp + 0x60]
xor ebx, ebx
mov byte [rbp - 0x17], bl
mov r15, r9
mov r14d, r8d
mov dword [rbp - 0x1e], 0x46657469
mov rsi, rdx
mov word [rbp - 0x19], 0x656c
mov rdi, rcx
mov word [rbp - 0x20], 0x7257
mov byte [rbp - 0x1a], 0x69
call fcn.14000655c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400189b0
mov r9, r15
mov qword [rsp + 0x20], r12
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400189d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, qword [rbp + 0x60]
xor ebx, ebx
mov byte [rbp - 0xe], bl
mov r15, r9
mov r14, r8
mov word [rbp - 0x17], 0x7365
mov rsi, rdx
mov dword [rbp - 0x12], 0x79726f6d
mov rdi, rcx
mov dword [rbp - 0x20], 0x74697257
mov dword [rbp - 0x1c], 0x6f725065
mov word [rbp - 0x14], 0x654d
mov byte [rbp - 0x15], 0x73
mov byte [rbp - 0x18], 0x63
call fcn.14000655c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140018a5e
mov r9, r15
mov qword [rsp + 0x20], r12
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140058060
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret