joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rdx
mov r14, rcx
call fcn.14001e010
mov rcx, rax
xor edx, edx
test rax, rax
setne dl
test edx, edx
jne 0x140005015
mov ecx, 0x80004005
call fcn.14001d600
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x19], rbx
mov dword [rbp + 0x31], 0x656c676f
mov dword [rbp + 0x39], 0x656d6f
mov dword [rbp + 0x35], 0x72684320
mov word [rbp + 0x2f], 0x6f47
mov dword [rbp + 0x27], 0x6f726843
mov word [rbp + 0x2c], 0x65
mov byte [rbp + 0x2b], 0x6d
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 7]
call fcn.14001bdd0
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140126200
movzx edi, al
test al, al
jne 0x140005174
lea rdx, [rbp + 0x2f]
lea rcx, [rbp - 0x11]
call fcn.14001bdd0
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
mov r9, rsi
mov r8b, 1
xor edx, edx
mov rcx, rax
call fcn.140126200
movzx edi, al
test al, al
jne 0x140005174
lea rdx, [rbp + 0x2f]
lea rcx, [rbp - 9]
call fcn.14001bdd0
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
mov dl, 1
mov rcx, rax
call fcn.140126200
movzx edi, al
test al, al
jne 0x140005174
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 1]
call fcn.14001bdd0
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140126200
movzx edi, al
test al, al
jne 0x140005174
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 0xf]
call fcn.14001bdd0
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
mov r9, rsi
mov r8b, 1
xor edx, edx
mov rcx, rax
call fcn.140126200
movzx edi, al
test al, al
jne 0x140005174
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 0x1f]
call fcn.14001bdd0
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
mov dl, 1
mov rcx, rax
call fcn.140126200
movzx edi, al
test al, al
jne 0x140005174
mov rcx, rsi
call fcn.14013e820
movzx edi, al
mov byte [r14], 1
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000518c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
movzx eax, dil
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140052380
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400063b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
mov r14, rdx
xor ebx, ebx
mov dword [rbp - 0x2d], 0x33697061
mov dword [rbp - 0x27], 0x6c6c64
mov word [rbp - 0x2f], 0x7664
mov word [rbp - 0x29], 0x2e32
mov byte [rbp - 0x30], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140006469
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x10], 0x69536f54
mov dword [rbp - 0x1e], 0x7265766e
mov word [rbp - 0xb], 0x41
mov word [rbp - 0x20], 0x6f43
mov dword [rbp - 0x15], 0x6953676e
mov word [rbp - 0x17], 0x6972
mov word [rbp - 0x1a], 0x5374
mov byte [rbp - 0x18], 0x74
mov byte [rbp - 0x11], 0x64
mov byte [rbp - 0xc], 0x64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140006460
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140052380
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140006490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x98
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov rax, qword [rbp + 0x87]
mov r13, qword [rbp + 0x7f]
mov rsi, rcx
mov qword [rbp - 0x41], rax
mov rax, qword [rbp + 0x8f]
lea rcx, [rbp - 0x31]
mov r12, r9
mov r15d, r8d
mov r14, rdx
mov qword [rbp - 0x39], rax
mov ebx, 1
mov dword [rbp - 0x2e], 0x33697061
mov dword [rbp - 0x28], 0x6c6c64
mov word [rbp - 0x30], 0x7664
mov word [rbp - 0x2a], 0x2e32
mov byte [rbp - 0x31], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000658e
lea rdx, [rbp - 0x21]
mov rcx, rax
mov dword [rbp - 0x16], 0x41784579
mov dword [rbp - 0x1f], 0x65724367
mov word [rbp - 0x1b], 0x7461
mov word [rbp - 0x21], 0x6552
mov word [rbp - 0x18], 0x654b
mov byte [rbp - 0x12], 0
mov byte [rbp - 0x19], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140006585
mov rax, qword [rbp - 0x39]
mov r9, r12
mov r8d, r15d
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x41]
mov rdx, r14
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0x77]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x6f]
mov rcx, rsi
mov dword [rsp + 0x20], eax
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.140052380
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140006b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14d, dword [rsp + 0xb0]
mov r15, qword [rsp + 0xb8]
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x39], 0x646165
mov dword [rsp + 0x30], 0x61657243
mov dword [rsp + 0x35], 0x72685465
mov byte [rsp + 0x34], 0x74
call fcn.1401246a0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140006bb5
mov r9, rbp
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r14d
call rax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140052380
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140006c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x21], 0x6f4d7465
mov dword [rsp + 0x2d], 0x656d614e
mov word [rsp + 0x31], 0x41
mov dword [rsp + 0x27], 0x6946656c
mov word [rsp + 0x25], 0x7564
mov word [rsp + 0x2b], 0x656c
mov byte [rsp + 0x20], 0x47
call fcn.1401246a0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140006cc5
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140052380
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140007360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
xor ebx, ebx
mov r12, r9
mov r15, r8
mov r14, rdx
mov dword [rbp - 0x29], 0x6c6c642e
mov dword [rbp - 0x30], 0x73726576
mov word [rbp - 0x2b], 0x6e6f
mov byte [rbp - 0x25], bl
mov byte [rbp - 0x2c], 0x69
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140007416
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x19], 0x5679
mov word [rbp - 0x16], 0x756c
mov word [rbp - 0x1e], 0x5172
mov word [rbp - 0x1b], 0x7265
mov word [rbp - 0x13], 0x41
mov byte [rbp - 0x17], 0x61
mov word [rbp - 0x20], 0x6556
mov byte [rbp - 0x1c], 0x75
mov byte [rbp - 0x14], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000740d
mov r9, r12
mov r8, r15
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140052380
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140008390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x20], 0x42746547
mov dword [rsp + 0x28], 0x70795479
mov word [rsp + 0x2d], 0x41
mov dword [rsp + 0x24], 0x72616e69
mov byte [rsp + 0x2c], 0x65
call fcn.1401246a0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400083f3
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140052380
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140008410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x70]
mov r13, qword [rbp + 0x68]
mov rsi, rcx
lea rcx, [rbp - 0x40]
mov r12, r9
mov r15, r8
mov qword [rbp - 0x48], rax
mov r14, rdx
mov ebx, 1
mov dword [rbp - 0x3d], 0x33697061
mov dword [rbp - 0x37], 0x6c6c64
mov word [rbp - 0x3f], 0x7664
mov word [rbp - 0x39], 0x2e32
mov byte [rbp - 0x40], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400084e9
lea rdx, [rbp - 0x30]
mov rcx, rax
mov dword [rbp - 0x30], 0x51676552
mov word [rbp - 0x29], 0x5679
mov word [rbp - 0x23], 0x7845
mov word [rbp - 0x26], 0x756c
mov word [rbp - 0x21], 0x41
mov byte [rbp - 0x27], 0x61
mov word [rbp - 0x2c], 0x6575
mov byte [rbp - 0x2a], 0x72
mov byte [rbp - 0x24], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400084e0
mov rcx, qword [rbp - 0x48]
mov r9, r12
mov r8, r15
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov rdx, r14
mov qword [rsp + 0x20], r13
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140052380
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140008510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1050]
mov eax, 0x1150
call fcn.140058270
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x1188], rbx
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rbp + 0x1040], rax
movsxd rsi, r8d
mov rdi, rcx
mov qword [rsp + 0x58], rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], rbx
mov byte [rsp + 0x60], bl
cmp byte [rdx], bl
jne 0x140008577
mov r8d, ebx
jmp 0x140008589
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], bl
jne 0x140008580
lea rcx, [rsp + 0x60]
call fcn.1400175f0
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.1401340c0
nop
cmp qword [rsp + 0x78], 0x10
jb 0x1400085b6
mov rcx, qword [rsp + 0x60]
call fcn.140052004
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], rbx
mov byte [rsp + 0x60], 0
mov byte [rbp + 0x440], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rbp + 0x441]
call fcn.140054c50
mov edx, ebx
mov r10, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
sub r10, r9
je 0x140008625
lea rcx, [rbp + 0x440]
lea rax, [rbp + 0x440]
sub r9, rax
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
mov byte [rcx], al
inc edx
lea rcx, [rcx + 1]
movsxd rax, edx
cmp rax, r10
jb 0x140008610
mov byte [rbp + 0x840], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rbp + 0x841]
call fcn.140054c50
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x428], xmm0
mov byte [rbp + 0xc40], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rbp + 0xc41]
call fcn.140054c50
mov dword [rbp + 0x407], 0x41324443
mov word [rbp + 0x40b], 0x4537
mov dword [rbp + 0x417], 0x46434243
mov dword [rbp + 0x400], 0x37383843
mov word [rbp + 0x40e], 0x3646
mov word [rbp + 0x41f], 0x39
mov word [rbp + 0x404], 0x3444
mov dword [rbp + 0x413], 0x42413436
mov word [rbp + 0x41c], 0x4638
mov word [rbp + 0x411], 0x4232
mov byte [rbp + 0x41e], 0x39
mov byte [rbp + 0x406], 0x32
mov byte [rbp + 0x41b], 0x36
mov byte [rbp + 0x40d], 0x39
mov byte [rbp + 0x410], 0x44
lea r8, [rbp + 0x400]
mov edx, 0x400
lea rcx, [rbp + 0xc40]
call fcn.140056124
lea rcx, [rbp - 0x80]
call fcn.140006680
nop
mov dword [rsp + 0x20], 0x10
mov r9d, 0x20
lea r8, [rbp + 0x428]
lea rdx, [rbp + 0xc40]
lea rcx, [rbp - 0x80]
call section..text
mov r9, qword [rsp + 0x40]
sub r9, qword [rsp + 0x38]
mov dword [rsp + 0x20], 1
lea r8, [rbp + 0x840]
lea rdx, [rbp + 0x440]
lea rcx, [rbp - 0x80]
call fcn.140003010
lea rdx, [rbp + 0x840]
add rdx, rsi
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], rbx
mov byte [rdi], 0
cmp byte [rdx], 0
je 0x140008789
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140008780
mov r8, rbx
mov rcx, rdi
call fcn.1400175f0
mov dword [rsp + 0x30], 1
lea rcx, [rbp - 0x80]
call fcn.140012620
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400087b5
call fcn.140052004
mov rax, rdi
mov rcx, qword [rbp + 0x1040]
xor rcx, rsp
call fcn.140052380
mov rbx, qword [rsp + 0x1188]
add rsp, 0x1150
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000a0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rax, [rbp - 0x15]
lea r9, [rbp - 0x19]
lea r8, [rbp - 9]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x11]
lea rdx, [rbp + 0x17]
xor ebx, ebx
mov rcx, 0xffffffff80000002
mov word [rbp + 0x33], 0x4e20
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x36], 0x75435c5c
mov dword [rbp + 0x26], 0x74666f73
mov dword [rbp + 0x2e], 0x776f646e
mov word [rbp + 0x1e], 0x5c45
mov word [rbp + 0x21], 0x694d
mov dword [rbp + 0x3e], 0x72655674
mov dword [rbp + 0x2a], 0x69575c5c
mov word [rbp + 0x1b], 0x4157
mov dword [rbp + 0x3a], 0x6e657272
mov dword [rbp + 0x42], 0x6e6f6973
mov word [rbp + 0x24], 0x6f72
mov word [rbp + 0x18], 0x464f
mov byte [rbp + 0x35], 0x54
mov byte [rbp + 0x20], 0x5c
mov byte [rbp + 0x1a], 0x54
mov byte [rbp + 0x17], 0x53
mov byte [rbp + 0x32], 0x73
mov byte [rbp + 0x1d], 0x52
mov byte [rbp + 0x46], 0
mov byte [rbp + 0x23], 0x63
mov word [rbp + 1], 0x726f
mov dword [rbp + 4], 0x69737265
mov word [rbp + 9], 0x4e6e
mov word [rbp - 2], 0x614d
mov word [rbp - 5], 0x6e65
mov word [rbp + 0xc], 0x626d
mov word [rbp - 8], 0x7275
mov byte [rbp - 9], 0x43
mov byte [rbp], 0x6a
mov byte [rbp - 3], 0x74
mov word [rbp + 0xf], 0x72
mov byte [rbp - 6], 0x72
mov byte [rbp + 3], 0x56
mov byte [rbp + 0xb], 0x75
mov byte [rbp + 0xe], 0x65
mov byte [rbp + 8], 0x6f
mov dword [rbp - 0x19], 4
mov dword [rbp - 0x11], ebx
mov dword [rbp - 0x15], 4
call fcn.14000e550
test eax, eax
sete al
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140052380
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
Function at 0x14000a940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
xor ebx, ebx
mov r12d, r9d
mov r15, r8
mov r14, rdx
mov dword [rbp - 0x2f], 0x33726573
mov byte [rbp - 0x30], 0x55
mov word [rbp - 0x28], 0x6c6c
mov word [rbp - 0x2b], 0x2e32
mov byte [rbp - 0x29], 0x64
mov byte [rbp - 0x26], bl
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000a9e5
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x1d], 0x65676173
mov dword [rbp - 0x18], 0x41786f
mov word [rbp - 0x20], 0x654d
mov byte [rbp - 0x1e], 0x73
mov byte [rbp - 0x19], 0x42
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000a9dc
mov r9d, r12d
mov r8, r15
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140052380
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000c840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
mov r15, r8
mov r14d, edx
xor ebx, ebx
mov dword [rbp - 0x2d], 0x33697061
mov dword [rbp - 0x27], 0x6c6c64
mov word [rbp - 0x2f], 0x7664
mov word [rbp - 0x29], 0x2e32
mov byte [rbp - 0x30], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000c8ef
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x14], 0x6e656b6f
mov word [rbp - 0x18], 0x7365
mov dword [rbp - 0x20], 0x6e65704f
mov byte [rbp - 0x10], bl
mov word [rbp - 0x1b], 0x6f72
mov word [rbp - 0x16], 0x5473
mov byte [rbp - 0x1c], 0x50
mov byte [rbp - 0x19], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000c8e6
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140052380
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d0e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, qword [rbp + 0x68]
mov rsi, rcx
lea rcx, [rbp - 0x38]
mov r12d, r9d
mov r15, r8
mov r14d, edx
xor ebx, ebx
mov dword [rbp - 0x35], 0x33697061
mov dword [rbp - 0x2f], 0x6c6c64
mov word [rbp - 0x37], 0x7664
mov word [rbp - 0x31], 0x2e32
mov byte [rbp - 0x38], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000d1a8
lea rdx, [rbp - 0x28]
mov rcx, rax
mov word [rbp - 0x25], 0x6f54
mov word [rbp - 0x28], 0x6547
mov word [rbp - 0x1d], 0x726f
mov dword [rbp - 0x18], 0x6e6f69
mov dword [rbp - 0x23], 0x496e656b
mov word [rbp - 0x1a], 0x7461
mov byte [rbp - 0x1b], 0x6d
mov byte [rbp - 0x26], 0x74
mov word [rbp - 0x1f], 0x666e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d19f
mov r9d, r12d
mov r8, r15
mov edx, r14d
mov rcx, rsi
mov qword [rsp + 0x20], r13
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140052380
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14000d2d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r13, qword [rbp + 0x68]
mov rsi, rcx
lea rcx, [rbp - 0x38]
mov r12d, r9d
mov r15d, r8d
mov r14, rdx
mov ebx, 1
mov dword [rbp - 0x35], 0x33697061
mov dword [rbp - 0x2f], 0x6c6c64
mov word [rbp - 0x37], 0x7664
mov word [rbp - 0x31], 0x2e32
mov byte [rbp - 0x38], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000d38b
lea rdx, [rbp - 0x28]
mov rcx, rax
mov dword [rbp - 0x1f], 0x41784579
mov word [rbp - 0x27], 0x6765
mov dword [rbp - 0x24], 0x4b6e6570
mov byte [rbp - 0x28], 0x52
mov byte [rbp - 0x1b], 0
mov byte [rbp - 0x25], 0x4f
mov byte [rbp - 0x20], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d382
mov r9d, r12d
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
mov qword [rsp + 0x20], r13
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140052380
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000e230
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx + 8]
mov r10, rcx
movzx r11d, dl
mov edx, dword [rcx]
mov r8d, r9d
and r8d, 0xfffd
mov ecx, edx
shr edx, 8
or r8d, 2
mov eax, r8d
xor eax, 1
imul eax, r8d
lea r8, [0x140149930]
shr eax, 8
xor r11b, al
movsx rax, r11b
xor rcx, rax
movzx eax, cl
mov ecx, dword [r8 + rax*4]
xor ecx, edx
movzx eax, cl
mov dword [r10], ecx
add eax, dword [r10 + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [r10 + 4], ecx
movzx eax, byte [r10 + 7]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, dword [r8 + rcx*4]
xor eax, r9d
mov dword [r10 + 8], eax
movzx eax, r11b
ret

Function at 0x14000e440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x28], 0x72694632
mov dword [rsp + 0x23], 0x73736563
mov word [rsp + 0x21], 0x6f72
mov word [rsp + 0x2d], 0x74
mov byte [rsp + 0x2c], 0x73
mov byte [rsp + 0x20], 0x50
mov byte [rsp + 0x27], 0x33
call fcn.1401246a0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e4ac
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140052380
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000e4d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov dword [rsp + 0x22], 0x466c6163
mov word [rsp + 0x27], 0x6565
mov word [rsp + 0x20], 0x6f4c
mov byte [rsp + 0x26], 0x72
mov byte [rsp + 0x29], 0
call fcn.1401246a0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e538
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140052380
add rsp, 0x40
pop rbx
ret
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140052380
add rsp, 0x40
pop rbx
ret
Function at 0x14000ec70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140176220]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, qword [rsp + 0xf0]
mov r15, qword [rsp + 0xf8]
mov r12, qword [rsp + 0x100]
mov r13, qword [rsp + 0x108]
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x52], 0x65746165
mov word [rsp + 0x5a], 0x7365
mov word [rsp + 0x57], 0x6f72
mov byte [rsp + 0x56], 0x50
mov byte [rsp + 0x59], 0x63
mov word [rsp + 0x50], 0x7243
mov word [rsp + 0x5c], 0x4173
mov byte [rsp + 0x5e], 0
call fcn.1401246a0
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000ed43
mov eax, dword [rsp + 0xe8]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xe0]
mov r9, rbp
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x20], eax
call r10
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140052380
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret