joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032c80
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
movzx eax, byte [0x14023d0b0]
test eax, eax
jne 0x140032c94
jmp 0x140032eec
mov dword [rsp + 0x24], 0x20
movss xmm0, dword [0x14015e4cc]
call fcn.140065630
nop
xorps xmm2, xmm2
movss xmm1, dword [0x14015e98c]
lea rcx, [rsp + 0x28]
call fcn.14000d120
xor edx, edx
mov rcx, rax
call fcn.140065520
nop
mov r8d, dword [rsp + 0x24]
xor edx, edx
lea rcx, str.Cheats_List
call fcn.1400603d0
nop
movzx eax, byte [0x14023cd59]
test eax, eax
je 0x140032d12
movzx eax, byte [0x14023cd69]
test eax, eax
jne 0x140032d05
mov ecx, dword [0x1401c70a0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140032d12
lea rcx, str.Aimbot__Toggle_
call fcn.1400a5440
nop
movzx edx, byte [0x14023cd68]
lea rcx, [0x1401381b0]
call fcn.140032b30
movzx edx, byte [0x14023d0a5]
lea rcx, [0x1401381bc]
call fcn.140032b30
movzx edx, byte [0x14023d0b4]
lea rcx, [0x1401381c8]
call fcn.140032b30
movzx edx, byte [0x14023cd3b]
lea rcx, str.Crosshair
call fcn.140032b30
movzx edx, byte [0x14023d0b1]
lea rcx, str.Enemy_Sensor
call fcn.140032b30
movzx edx, byte [0x1401713c1]
lea rcx, [0x1401381f8]
call fcn.140032b30
movzx edx, byte [0x14023d0b8]
lea rcx, str.External_Radar
call fcn.140032b30
movzx edx, byte [0x14023d0a4]
lea rcx, [0x140138210]
call fcn.140032b30
movzx edx, byte [0x14023d0b6]
lea rcx, [0x140138220]
call fcn.140032b30
nop
movss xmm0, dword [0x14023d09c]
ucomiss xmm0, dword [0x14015e378]
je 0x140032ddc
lea rcx, str.Flash_Immunity
call fcn.1400a5440
nop
movzx edx, byte [0x14023d0b2]
lea rcx, [0x140138240]
call fcn.140032b30
nop
cmp dword [0x1401c7080], 0x5a
je 0x140032e06
lea rcx, str.Fov_Changer
call fcn.1400a5440
nop
movzx edx, byte [0x14023cd51]
lea rcx, [0x140138260]
call fcn.140032b30
cmp dword [0x14023d0ac], 0
je 0x140032e29
mov byte [rsp + 0x20], 1
jmp 0x140032e2e
mov byte [rsp + 0x20], 0
movzx edx, byte [rsp + 0x20]
lea rcx, str.HitSound
call fcn.140032b30
movzx edx, byte [0x14023d0a6]
lea rcx, str.Money_Service
call fcn.140032b30
movzx edx, byte [0x14023d0d8]
lea rcx, [0x140138290]
call fcn.140032b30
movzx edx, byte [0x14023d0d9]
lea rcx, [0x1401382a0]
call fcn.140032b30
movzx edx, byte [0x14023cd58]
lea rcx, [0x1401382ac]
call fcn.140032b30
movzx edx, byte [0x14023d0da]
lea rcx, [0x1401382b0]
call fcn.140032b30
movzx edx, byte [0x14023d0b3]
lea rcx, [0x1401382c0]
call fcn.140032b30
nop
movzx eax, byte [0x14023cd48]
test eax, eax
je 0x140032ee6
movzx eax, byte [0x14023cd52]
test eax, eax
jne 0x140032ed9
mov ecx, dword [0x14023cd6c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140032ee6
lea rcx, str.TriggerBot__Toggle_
call fcn.1400a5440
nop
call fcn.140063e40
nop
add rsp, 0x38
ret
Function at 0x140033a80
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
movzx eax, byte [0x14023d0b6]
test eax, eax
jne 0x140033a94
jmp 0x140033b42
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140033aae
jmp 0x140033b42
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140033ac5
jmp 0x140033b42
movss xmm3, dword [0x14015e8f0]
mov r8d, 0x44
lea rdx, [0x14023a9c6]
mov ecx, 0x41
call fcn.140032bb0
movss xmm3, dword [0x14015e8f0]
mov r8d, 0x41
lea rdx, [0x14023aa1c]
mov ecx, 0x44
call fcn.140032bb0
movss xmm3, dword [0x14015e8f0]
mov r8d, 0x53
lea rdx, [0x14023a9c7]
mov ecx, 0x57
call fcn.140032bb0
movss xmm3, dword [0x14015e8f0]
mov r8d, 0x57
lea rdx, [0x14023a9c5]
mov ecx, 0x53
call fcn.140032bb0
nop
add rsp, 0x28
ret

Function at 0x140034000
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [0x14023d0a5]
test eax, eax
jne 0x140034028
jmp 0x1400340fe
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14003403f
mov byte [rsp + 0x21], 1
jmp 0x140034044
mov byte [rsp + 0x21], 0
movzx eax, byte [rsp + 0x21]
mov byte [rsp + 0x20], al
mov rcx, qword [rsp + 0x50]
call fcn.14000f160
mov byte [rsp + 0x22], al
lea rdx, [rsp + 0x30]
lea rcx, [0x14023d2d0]
call fcn.140038ec0
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1400340b3
movzx eax, byte [rsp + 0x22]
test eax, eax
je 0x1400340b3
mov dword [rsp + 0x24], 0x11
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x28]
call fcn.1400276c0
mov rcx, rax
call fcn.1400276e0
nop
mov edx, 0x10001
lea rcx, [0x14023d2d0]
call fcn.140038e80
nop
jmp 0x1400340fe
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1400340d9
movzx eax, byte [rsp + 0x22]
test eax, eax
jne 0x1400340d9
mov edx, 0x100
lea rcx, [0x14023d2d0]
call fcn.140038e80
nop
jmp 0x1400340fe
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400340fe
cmp dword [rsp + 0x30], 0x10001
jne 0x1400340fe
mov edx, 0x100
lea rcx, [0x14023d2d0]
call fcn.140038e80
nop
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret
Function at 0x1400388c0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x4d0
lea rbp, [rsp + 0x20]
mov rax, qword [0x140171340]
xor rax, rbp
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x60], 0x438
mov rax, qword [rbp + 0x4c0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
call fcn.140038820
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x90]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
jne 0x14003893d
mov qword [rbp + 0x30], 0
jmp 0x1400389db
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x14003894d
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x14003897c
mov qword [rbp + 0x28], 0
jmp 0x1400389d3
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x40], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x1400389a4
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.140126120
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x40]
mov r8d, ecx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.140038830
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.140025740
mov rcx, qword [rbp + 0x30]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x140038a01
inc rcx
test dl, dl
jne 0x1400389ee
xor eax, eax
jmp 0x140038a06
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140038a32
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.140009c80
mov rax, qword [rbp + 0x48]
jmp 0x140038a6b
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14003891e
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov qword [rbp + 0x50], 0
mov rcx, qword [rbp + 0x4c8]
call fcn.140009c80
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x4a0]
xor rcx, rbp
call fcn.140124e00
lea rsp, [rbp + 0x4b0]
pop rbp
ret
Function at 0x14003a4d0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x2c0
lea rbp, [rsp + 0x20]
mov rax, qword [0x140171340]
xor rax, rbp
mov qword [rbp + 0x290], rax
mov dword [rbp + 0x50], 0x238
xor edx, edx
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
call fcn.140038820
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x7c]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14003a542
mov qword [rbp + 0x38], 0
jmp 0x14003a5e0
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x40], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x14003a552
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x14003a581
mov qword [rbp + 0x30], 0
jmp 0x14003a5d8
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x48], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x14003a5a9
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.140126120
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x48]
mov r8d, ecx
mov rdx, qword [rbp + 0x28]
mov rcx, rax
call fcn.140038830
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov rcx, qword [rbp + 0x2b8]
call fcn.140025740
mov rcx, qword [rbp + 0x38]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x14003a606
inc rcx
test dl, dl
jne 0x14003a5f3
xor eax, eax
jmp 0x14003a60b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14003a631
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x58]
mov dword [rbp + 0x1c], eax
mov rcx, qword [rbp + 0x2b8]
call fcn.140009c80
mov eax, dword [rbp + 0x1c]
jmp 0x14003a668
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003a526
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rbp + 0x20], 0
mov rcx, qword [rbp + 0x2b8]
call fcn.140009c80
mov eax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x290]
xor rcx, rbp
call fcn.140124e00
lea rsp, [rbp + 0x2a0]
pop rbp
ret
Function at 0x14003af20
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14015d5bc]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edx, 0xf8
lea rcx, [rsp + 0x60]
call fcn.140009120
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.1400349e0
nop
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x60]
call fcn.140034900
mov eax, dword [rsp + 0x40]
or eax, 1
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x60]
call fcn.140033f10
mov rax, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x178
ret
Function at 0x14003bf10
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14003bf62
xor eax, eax
jmp 0x14003c0a6
mov rax, qword [rsp + 0x18]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax], 0x4550
je 0x14003bf8f
xor eax, eax
jmp 0x14003c0a6
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
mov rdi, rax
lea rsi, [rcx + 0x18]
mov ecx, 0xf0
rep movsb byte [rdi], byte [rsi]
mov eax, 8
imul rax, rax, 0
mov eax, dword [rsp + rax + 0xc0]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov dword [rsp], 0
jmp 0x14003c020
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x14]
cmp dword [rsp], eax
jae 0x14003c0a4
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x30]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x14003c08f
inc rax
test dl, dl
jne 0x14003c07c
xor eax, eax
jmp 0x14003c094
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14003c09f
mov rax, qword [rsp + 0x48]
jmp 0x14003c0a6
jmp 0x14003c018
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x158
pop rdi
pop rsi
ret
Function at 0x14003c850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x7b
mov byte [rsp + 0x22], 0x75
mov byte [rsp + 0x23], 0x62
mov byte [rsp + 0x24], 0x7e
mov byte [rsp + 0x25], 0x75
mov byte [rsp + 0x26], 0x7c
mov byte [rsp + 0x27], 0x23
mov byte [rsp + 0x28], 0x22
mov byte [rsp + 0x29], 0x3e
mov byte [rsp + 0x2a], 0x74
mov byte [rsp + 0x2b], 0x7c
mov byte [rsp + 0x2c], 0x7c
mov byte [rsp + 0x2d], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d744], eax
jle 0x14003c91d
lea rcx, [0x14023d744]
call fcn.140124ec8
cmp dword [0x14023d744], 0xffffffff
jne 0x14003c91d
mov edx, 8
lea rcx, [0x14023d780]
call fcn.140009120
lea rdx, [0x14023d780]
lea rcx, [rsp + 0x20]
call fcn.140042e10
lea rcx, [0x140131020]
call fcn.140125274
nop
lea rcx, [0x14023d744]
call fcn.140124e5c
nop
lea rcx, [0x14023d780]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x14003c940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x5c
mov byte [rsp + 0x22], 0x7f
mov byte [rsp + 0x23], 0x71
mov byte [rsp + 0x24], 0x74
mov byte [rsp + 0x25], 0x5c
mov byte [rsp + 0x26], 0x79
mov byte [rsp + 0x27], 0x72
mov byte [rsp + 0x28], 0x62
mov byte [rsp + 0x29], 0x71
mov byte [rsp + 0x2a], 0x62
mov byte [rsp + 0x2b], 0x69
mov byte [rsp + 0x2c], 0x51
mov byte [rsp + 0x2d], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d8a0], eax
jle 0x14003ca0d
lea rcx, [0x14023d8a0]
call fcn.140124ec8
cmp dword [0x14023d8a0], 0xffffffff
jne 0x14003ca0d
mov edx, 8
lea rcx, [0x14023d750]
call fcn.140009120
lea rdx, [0x14023d750]
lea rcx, [rsp + 0x20]
call fcn.140042e10
lea rcx, [0x140131000]
call fcn.140125274
nop
lea rcx, [0x14023d8a0]
call fcn.140124e5c
nop
lea rcx, [0x14023d750]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret
Function at 0x14003ca30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x56
mov byte [rsp + 0x22], 0x62
mov byte [rsp + 0x23], 0x75
mov byte [rsp + 0x24], 0x75
mov byte [rsp + 0x25], 0x5c
mov byte [rsp + 0x26], 0x79
mov byte [rsp + 0x27], 0x72
mov byte [rsp + 0x28], 0x62
mov byte [rsp + 0x29], 0x71
mov byte [rsp + 0x2a], 0x62
mov byte [rsp + 0x2b], 0x69
mov byte [rsp + 0x2c], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d808], eax
jle 0x14003caf8
lea rcx, [0x14023d808]
call fcn.140124ec8
cmp dword [0x14023d808], 0xffffffff
jne 0x14003caf8
mov edx, 8
lea rcx, [0x14023d840]
call fcn.140009120
lea rdx, [0x14023d840]
lea rcx, [rsp + 0x20]
call fcn.140042d50
lea rcx, [0x140130fe0]
call fcn.140125274
nop
lea rcx, [0x14023d808]
call fcn.140124e5c
nop
lea rcx, [0x14023d840]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x14003cb20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x65
mov byte [rsp + 0x22], 0x62
mov byte [rsp + 0x23], 0x7c
mov byte [rsp + 0x24], 0x7d
mov byte [rsp + 0x25], 0x7f
mov byte [rsp + 0x26], 0x7e
mov byte [rsp + 0x27], 0x3e
mov byte [rsp + 0x28], 0x74
mov byte [rsp + 0x29], 0x7c
mov byte [rsp + 0x2a], 0x7c
mov byte [rsp + 0x2b], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d920], eax
jle 0x14003cbe3
lea rcx, [0x14023d920]
call fcn.140124ec8
cmp dword [0x14023d920], 0xffffffff
jne 0x14003cbe3
mov edx, 8
lea rcx, [0x14023d908]
call fcn.140009120
lea rdx, [0x14023d908]
lea rcx, [rsp + 0x20]
call fcn.140042c90
lea rcx, [0x140130fc0]
call fcn.140125274
nop
lea rcx, [0x14023d920]
call fcn.140124e5c
nop
lea rcx, [0x14023d908]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret
Function at 0x14003cc10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x63
mov byte [rsp + 0x22], 0x78
mov byte [rsp + 0x23], 0x75
mov byte [rsp + 0x24], 0x7c
mov byte [rsp + 0x25], 0x7c
mov byte [rsp + 0x26], 0x23
mov byte [rsp + 0x27], 0x22
mov byte [rsp + 0x28], 0x3e
mov byte [rsp + 0x29], 0x74
mov byte [rsp + 0x2a], 0x7c
mov byte [rsp + 0x2b], 0x7c
mov byte [rsp + 0x2c], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d860], eax
jle 0x14003ccd8
lea rcx, [0x14023d860]
call fcn.140124ec8
cmp dword [0x14023d860], 0xffffffff
jne 0x14003ccd8
mov edx, 8
lea rcx, [0x14023d7e8]
call fcn.140009120
lea rdx, [0x14023d7e8]
lea rcx, [rsp + 0x20]
call fcn.140042d50
lea rcx, [0x140130fa0]
call fcn.140125274
nop
lea rcx, [0x14023d860]
call fcn.140124e5c
nop
lea rcx, [0x14023d7e8]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x14003cd00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x45
mov byte [rsp + 0x22], 0x42
mov byte [rsp + 0x23], 0x5c
mov byte [rsp + 0x24], 0x54
mov byte [rsp + 0x25], 0x7f
mov byte [rsp + 0x26], 0x67
mov byte [rsp + 0x27], 0x7e
mov byte [rsp + 0x28], 0x7c
mov byte [rsp + 0x29], 0x7f
mov byte [rsp + 0x2a], 0x71
mov byte [rsp + 0x2b], 0x74
mov byte [rsp + 0x2c], 0x44
mov byte [rsp + 0x2d], 0x7f
mov byte [rsp + 0x2e], 0x56
mov byte [rsp + 0x2f], 0x79
mov byte [rsp + 0x30], 0x7c
mov byte [rsp + 0x31], 0x75
mov byte [rsp + 0x32], 0x51
mov byte [rsp + 0x33], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d938], eax
jle 0x14003cdeb
lea rcx, [0x14023d938]
call fcn.140124ec8
cmp dword [0x14023d938], 0xffffffff
jne 0x14003cdeb
mov edx, 8
lea rcx, [0x14023d928]
call fcn.140009120
lea rdx, [0x14023d928]
lea rcx, [rsp + 0x20]
call fcn.140042bd0
lea rcx, [0x140130f80]
call fcn.140125274
nop
lea rcx, [0x14023d938]
call fcn.140124e5c
nop
lea rcx, [0x14023d928]
call fcn.14000a080
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret
Function at 0x14003ce10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x43
mov byte [rsp + 0x22], 0x78
mov byte [rsp + 0x23], 0x75
mov byte [rsp + 0x24], 0x7c
mov byte [rsp + 0x25], 0x7c
mov byte [rsp + 0x26], 0x55
mov byte [rsp + 0x27], 0x68
mov byte [rsp + 0x28], 0x75
mov byte [rsp + 0x29], 0x73
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x2b], 0x64
mov byte [rsp + 0x2c], 0x75
mov byte [rsp + 0x2d], 0x51
mov byte [rsp + 0x2e], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d850], eax
jle 0x14003cee2
lea rcx, [0x14023d850]
call fcn.140124ec8
cmp dword [0x14023d850], 0xffffffff
jne 0x14003cee2
mov edx, 8
lea rcx, [0x14023d848]
call fcn.140009120
lea rdx, [0x14023d848]
lea rcx, [rsp + 0x20]
call fcn.140042b10
lea rcx, [0x140130f60]
call fcn.140125274
nop
lea rcx, [0x14023d850]
call fcn.140124e5c
nop
lea rcx, [0x14023d848]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x14003cf00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x78
mov byte [rsp + 0x22], 0x64
mov byte [rsp + 0x23], 0x64
mov byte [rsp + 0x24], 0x60
mov byte [rsp + 0x25], 0x63
mov byte [rsp + 0x26], 0x2a
mov byte [rsp + 0x27], 0x3f
mov byte [rsp + 0x28], 0x3f
mov byte [rsp + 0x29], 0x76
mov byte [rsp + 0x2a], 0x79
mov byte [rsp + 0x2b], 0x7c
mov byte [rsp + 0x2c], 0x75
mov byte [rsp + 0x2d], 0x63
mov byte [rsp + 0x2e], 0x3e
mov byte [rsp + 0x2f], 0x7f
mov byte [rsp + 0x30], 0x76
mov byte [rsp + 0x31], 0x76
mov byte [rsp + 0x32], 0x63
mov byte [rsp + 0x33], 0x78
mov byte [rsp + 0x34], 0x7f
mov byte [rsp + 0x35], 0x62
mov byte [rsp + 0x36], 0x75
mov byte [rsp + 0x37], 0x3e
mov byte [rsp + 0x38], 0x73
mov byte [rsp + 0x39], 0x71
mov byte [rsp + 0x3a], 0x64
mov byte [rsp + 0x3b], 0x3f
mov byte [rsp + 0x3c], 0x72
mov byte [rsp + 0x3d], 0x47
mov byte [rsp + 0x3e], 0x25
mov byte [rsp + 0x3f], 0x48
mov byte [rsp + 0x40], 0x5e
mov byte [rsp + 0x41], 0x40
mov byte [rsp + 0x42], 0x7e
mov byte [rsp + 0x43], 0x23
mov byte [rsp + 0x44], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d900], eax
jle 0x14003d040
lea rcx, [0x14023d900]
call fcn.140124ec8
cmp dword [0x14023d900], 0xffffffff
jne 0x14003d040
mov edx, 8
lea rcx, [0x14023d838]
call fcn.140009120
lea rdx, [0x14023d838]
lea rcx, [rsp + 0x20]
call fcn.140042a50
lea rcx, [0x140130f40]
call fcn.140125274
nop
lea rcx, [0x14023d900]
call fcn.140124e5c
nop
lea rcx, [0x14023d838]
call fcn.14000a080
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x58
ret