joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401c2e40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbp, r9
mov rbx, r8
mov esi, edx
mov qword [rsp + 0x50], rbx
mov r14, qword [rsp + 0xd0]
lea rdx, [rsp + 0x58]
mov rcx, r8
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
cmp qword [rax + 0x18], 8
jb 0x1401c2e8f
mov rax, qword [rax]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r15 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1401c2f04
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401c2eff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401c2eff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402b2268
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r15w
cmp rdi, 0xffffffffffffffff
je 0x1401c2f75
shl esi, 9
mov edx, esi
imul rdx, rbp
mov qword [rsp + 0x48], rdx
xor r9d, r9d
lea r8, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0xd8]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov eax, 1
jmp 0x1401c2f80
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1402b25d0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401d2310
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov r11d, dword [rcx + 0x2b0]
lea eax, [rdx - 2]
imul r11d, eax
mov rbx, r9
movzx eax, r8w
mov r10, rcx
add r11d, dword [rcx + 0x70]
add r11, qword [rcx + 0x280]
add r11, rax
cmp byte [rcx + 0x1a], 0
jne 0x1401d2380
mov ecx, dword [rcx + 0x10]
mov r8, r11
mov rax, qword [rsp + 0x78]
mov edx, ecx
imul edx, dword [rsp + 0x70]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
shl edx, 9
mov dword [rsp + 0x20], edx
movzx edx, byte [r10 + 0x2fa]
call fcn.1401c1720
test eax, eax
setne al
add rsp, 0x40
pop rbx
ret
mov r9d, dword [rsp + 0x70]
mov r8, rbx
mov rdx, r11
add rsp, 0x40
pop rbx
jmp fcn.1401d23a0
Function at 0x1401d26b0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [rcx + 0x280]
mov r11, r9
add rbx, rdx
mov r10, rcx
cmp byte [rcx + 0x1a], 0
jne 0x1401d2709
mov ecx, dword [rcx + 0x10]
mov edx, ecx
mov rax, qword [rsp + 0x70]
imul edx, r8d
mov r8, rbx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
shl edx, 9
mov dword [rsp + 0x20], edx
movzx edx, byte [r10 + 0x2fa]
call fcn.1401c1720
test eax, eax
setne al
add rsp, 0x40
pop rbx
ret
mov r9d, r8d
mov rdx, rbx
mov r8, r11
add rsp, 0x40
pop rbx
jmp fcn.1401d23a0

Function at 0x1401d36b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov r10d, dword [rcx + 0x48]
mov rdi, r9
mov eax, dword [rcx + 0x6c]
mov rbx, rcx
movzx r9d, word [rsp + 0x70]
lea r11d, [rax + r10*2]
movzx r10d, byte [rcx + 0x2a]
add r11d, dword [rcx + 0x68]
lea rax, [rdx - 2]
imul r10, rax
movzx eax, r8w
add r11, r10
add r11, qword [rcx + 0x50]
add r11, rax
cmp byte [rcx + 0xbb], 0
jne 0x1401d373d
mov ecx, dword [rcx + 0xb4]
mov r8, r11
mov rax, qword [rsp + 0x78]
mov edx, ecx
imul edx, r9d
mov r9, rdi
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
shl edx, 9
mov dword [rsp + 0x20], edx
movzx edx, byte [rbx + 0x28]
call fcn.1401c1720
test eax, eax
setne al
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov r8, rdi
mov rdx, r11
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp fcn.1401d3760
Function at 0x1401d3a70
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [rcx + 0x50]
mov r11, r9
add rbx, rdx
mov r10, rcx
cmp byte [rcx + 0xbb], 0
jne 0x1401d3ac9
mov ecx, dword [rcx + 0xb4]
mov edx, ecx
mov rax, qword [rsp + 0x70]
imul edx, r8d
mov r8, rbx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
shl edx, 9
mov dword [rsp + 0x20], edx
movzx edx, byte [r10 + 0x28]
call fcn.1401c1720
test eax, eax
setne al
add rsp, 0x40
pop rbx
ret
mov r9d, r8d
mov rdx, rbx
mov r8, r11
add rsp, 0x40
pop rbx
jmp fcn.1401d3760

Function at 0x1401d51e0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov r10d, dword [rcx + 0x26]
mov rbx, r9
imul r10, rdx
mov eax, r8d
mov r11, rcx
add r10, qword [rcx + 0x52]
add r10, rax
cmp byte [rcx + 0x271], 0
jne 0x1401d5239
mov ecx, dword [rcx + 0x232]
xor edx, edx
mov dword [rsp + 0x30], edx
mov eax, ecx
imul eax, dword [rsp + 0x70]
mov r8, r10
mov qword [rsp + 0x28], rdx
movzx edx, byte [r11 + 0x20]
shl eax, 9
mov dword [rsp + 0x20], eax
call fcn.1401c1720
add rsp, 0x40
pop rbx
ret
mov r9d, dword [rsp + 0x70]
mov r8, rbx
mov rdx, r10
add rsp, 0x40
pop rbx
jmp fcn.1401d5250
Function at 0x1401d5250
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r15d, r9d
mov qword [rsp + 0x68], r8
mov r12, rdx
mov r13, rcx
imul r15d, dword [rcx + 0x232]
shl r15d, 9
lea r14, [rcx + 0x272]
xor ebp, ebp
mov esi, ebp
test r14, r14
je 0x1401d52dc
lea rcx, [rsp + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_void____ptr64]
mov ebx, ebp
mov rdi, r14
movzx eax, word [rdi]
mov word [rsp + 0x40], ax
mov word [rsp + 0x48], ax
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_bool___cdecl_QChar::isNull_void_const___ptr64]
test al, al
jne 0x1401d52dc
inc esi
inc ebx
add rdi, 2
cmp ebx, 0xff
jb 0x1401d52b0
mov r8d, esi
mov rdx, r14
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QChar_const____ptr64__int____ptr64]
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
cmp qword [rax + 0x18], 8
jb 0x1401d5308
mov rax, qword [rax]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov ebx, 1
mov r8d, ebx
mov edx, 0x80000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1401d5381
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401d537c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401d537c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402b2268
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], bp
cmp rdi, 0xffffffffffffffff
je 0x1401d53ec
mov eax, dword [r13 + 0x232]
shl eax, 9
imul rax, r12
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea r8, [rsp + 0x64]
mov edx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x58]
mov r8d, r15d
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401d53ee
mov ebx, ebp
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov eax, ebx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401d5930
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x48
cmp byte [rcx + 0x271], 0
mov r11, r8
mov r8, rdx
mov r10, rcx
jne 0x1401d5971
add r8, qword [rcx + 0x52]
xor eax, eax
movzx edx, byte [rcx + 0x20]
mov ecx, dword [rcx + 0x232]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
mov r9, r11
call fcn.1401c1720
add rsp, 0x48
ret
mov ecx, dword [rcx + 0x232]
xor edx, edx
shl ecx, 9
mov eax, r9d
div ecx
mov rdx, qword [r10 + 0x52]
mov rcx, r10
add rdx, r8
mov r9d, eax
mov r8, r11
add rsp, 0x48
jmp fcn.1401d5250
Function at 0x1401d79b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r15, rcx
mov qword [rsp + 0x48], r9
mov r13, rdx
mov dword [rsp + 0x40], 0x46445025
xor bpl, bpl
mov dword [rsp + 0x50], 0x74654d2f
mov byte [0x1411dd03d], bpl
xor esi, esi
mov ecx, dword [rcx + 0x28]
movzx r12d, r8b
imul ecx, dword [r15 + 0x48]
mov dword [rsp + 0x54], 0x74616461
lea edx, [rsi + 1]
shl ecx, 2
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x1401d7b05
mov qword [rsp + 0x70], rbx
xor edx, edx
mov ebx, dword [r15 + 0x48]
mov rcx, rax
imul ebx, dword [r15 + 0x28]
lea r8d, [rbx*4]
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [r15 + 0x48]
mov r9, r14
mov dword [rsp + 0x30], esi
movzx edx, r12b
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebx
mov rbx, qword [rsp + 0x48]
mov r8, rbx
call fcn.1401c1720
test eax, eax
je 0x1401d7af7
mov eax, dword [rsp + 0x40]
cmp eax, dword [r14]
jne 0x1401d7abc
cmp byte [0x1411dd026], sil
jne 0x1401d7abc
mov edx, dword [r15 + 0x28]
mov r9b, 0x61
imul edx, dword [r15 + 0x48]
mov r8, qword [rsp + 0x50]
mov ecx, esi
lea rax, [rcx + 9]
cmp rax, rdx
jae 0x1401d7abc
cmp r8, qword [rcx + r14]
jne 0x1401d7aa9
cmp r9b, byte [rcx + r14 + 8]
je 0x1401d7ab5
cmp esi, 0x400
jae 0x1401d7adf
inc esi
jmp 0x1401d7a91
mov byte [0x1411dd03d], 1
mov r9, rbx
movzx r8d, r12b
mov rdx, r13
mov rcx, r15
call fcn.1402046e0
cmp byte [0x1411dd03d], 0
movzx ebp, al
je 0x1401d7ae8
mov bpl, 1
jmp 0x1401d7aec
mov byte [0x1411dd03d], bpl
jmp 0x1401d7af7
test al, al
je 0x1401d7af7
mov eax, dword [r15 + 0x888]
mov qword [r13 + 0x10], rax
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x70]
movzx eax, bpl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x1401d7b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov r12d, dword [rcx + 0x28]
mov r13, rdx
imul r12d, dword [rcx + 0x48]
mov r15, rcx
xor esi, esi
mov dword [rbp + 0x48], 0x4d494e41
xor r14b, r14b
mov dword [rbp - 0x18], 0x43495042
mov dword [rbp - 0x14], 0x4d524644
add r12d, r12d
lea edx, [rsi + 1]
mov ecx, r12d
mov dword [rbp - 0x10], r12d
mov ebx, r12d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
test rax, rax
je 0x1401d7d11
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r8, qword [rbp + 0x60]
xor eax, eax
movzx edx, byte [rbp + 0x58]
mov r9, rdi
mov ecx, dword [r15 + 0x48]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
call fcn.1401c1720
test eax, eax
je 0x1401d7cff
mov eax, dword [rbp + 0x48]
cmp eax, dword [rdi]
jne 0x1401d7cff
mov eax, dword [rbp - 0x18]
cmp eax, dword [rdi + 8]
jne 0x1401d7cff
cmp byte [0x1411dd028], sil
je 0x1401d7c17
movzx eax, byte [rdi + 0xf]
mov byte [rbp + 0x48], al
movzx eax, byte [rdi + 0xe]
mov byte [rbp + 0x49], al
movzx eax, byte [rdi + 0xd]
mov byte [rbp + 0x4a], al
movzx eax, byte [rdi + 0xc]
mov byte [rbp + 0x4b], al
mov eax, dword [rbp + 0x48]
jmp 0x1401d7c1a
mov eax, dword [rdi + 0xc]
cmp byte [0x1411dd026], r14b
lea esi, [rax + 0x10]
jne 0x1401d7cff
mov r12d, dword [r15 + 0x48]
mov r13d, dword [r15 + 0x28]
mov ebx, dword [rbp - 0x14]
mov r9d, dword [rbp - 0x10]
nop dword [rax]
mov r8d, r9d
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r8d, r12d
mov rax, rsi
imul r8d, r13d
cqo
xor ecx, ecx
mov r9, rdi
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp - 0x10]
idiv r8
movzx edx, byte [rbp + 0x58]
add rax, qword [rbp + 0x60]
mov dword [rsp + 0x20], ecx
mov r8, rax
mov ecx, r12d
call fcn.1401c1720
test eax, eax
je 0x1401d7cfb
mov r13d, dword [r15 + 0x28]
mov rax, rsi
mov r12d, dword [r15 + 0x48]
mov ecx, r13d
mov r9d, dword [rbp - 0x10]
cqo
imul ecx, r12d
idiv rcx
mov ecx, edx
lea rax, [rcx + 4]
cmp rax, r9
jae 0x1401d7d26
cmp ebx, dword [rcx + rdi]
jne 0x1401d7cfb
lea eax, [rdx + 4]
add rax, rdi
cmp byte [0x1411dd028], 0
je 0x1401d7ce2
movzx ecx, byte [rax + 3]
mov byte [rbp + 0x48], cl
movzx ecx, byte [rax + 2]
mov byte [rbp + 0x49], cl
movzx ecx, byte [rax + 1]
mov byte [rbp + 0x4a], cl
movzx ecx, byte [rax]
mov byte [rbp + 0x4b], cl
mov eax, dword [rbp + 0x48]
jmp 0x1401d7ce4
mov eax, dword [rax]
add rsi, 8
mov r14b, 1
add rsi, rax
cmp byte [0x1411dd026], 0
je 0x1401d7c40
mov r13, qword [rbp + 0x50]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r14b, r14b
je 0x1401d7d11
mov qword [r13 + 0x10], rsi
movzx eax, r14b
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r13, qword [rbp + 0x50]
mov rcx, rdi
mov r14b, 1
mov qword [r13 + 0x10], rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1401d7d0d
Function at 0x1401d9a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0x98
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r13, rcx
mov qword [rbp - 0x19], rdx
mov ecx, dword [rcx + 0x28]
mov edx, 1
mov r12, r9
mov qword [rbp - 0x21], r9
movzx r14d, r8b
mov byte [rbp - 0x29], r8b
imul ecx, dword [r13 + 0x48]
xor r15b, r15b
mov dword [rbp - 0x11], 0xe011cfd0
mov dword [rbp - 0xd], 0xe11ab1a1
mov dword [rbp + 7], 0x6f0052
mov dword [rbp + 0xb], 0x74006f
mov dword [rbp + 0xf], 0x450020
mov dword [rbp + 0x13], 0x74006e
mov word [rbp + 0x17], 0x72
mov byte [rbp + 0x19], 0x79
mov word [rbp - 0x25], 0x5200
mov dword [rbp - 9], 0x6f0043
mov dword [rbp - 5], 0x74006e
mov dword [rbp - 1], 0x6e0065
mov dword [rbp + 3], 0x730074
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rsi, rax
test rax, rax
je 0x1401d9c98
mov eax, dword [r13 + 0x48]
xor edx, edx
imul eax, dword [r13 + 0x28]
mov rcx, rsi
mov qword [rsp + 0x90], rbx
mov r8d, eax
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [r13 + 0x48]
xor eax, eax
mov dword [rsp + 0x30], eax
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8, r12
movzx edx, r14b
mov dword [rsp + 0x20], ebx
call fcn.1401c1720
test eax, eax
je 0x1401d9c87
mov rax, qword [rbp - 0x11]
cmp rax, qword [rsi]
jne 0x1401d9c87
cmp byte [0x1411dd028], r15b
mov r14d, dword [rsi + 0x2c]
je 0x1401d9be9
mov byte [rbp - 0xe], r14b
mov eax, r14d
shr eax, 0x18
mov byte [rbp - 0x11], al
mov eax, r14d
shr eax, 0x10
mov byte [rbp - 0x10], al
mov eax, r14d
shr eax, 8
mov byte [rbp - 0xf], al
mov r14d, dword [rbp - 0x11]
mov eax, dword [rsi + 0x30]
mov ecx, eax
shr ecx, 0x18
mov byte [rbp - 0x11], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbp - 0x10], cl
mov ecx, eax
shl r14d, 0x10
add r14d, 0x200
mov byte [rbp - 0xe], al
shr ecx, 8
mov byte [rbp - 0xf], cl
mov r12d, dword [rbp - 0x11]
jmp 0x1401d9bf8
mov r12d, dword [rsi + 0x30]
shl r14d, 0x10
add r14d, 0x200
mov eax, dword [r13 + 0x48]
xor edx, edx
imul eax, dword [r13 + 0x28]
mov rcx, rsi
mov r8d, eax
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
mov r8, qword [rbp - 0x21]
mov r9, rsi
movzx edx, byte [rbp - 0x29]
inc r8
mov ecx, dword [r13 + 0x48]
mov eax, r12d
add r8, rax
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call fcn.1401c1720
test eax, eax
je 0x1401d9c87
mov r8d, 0x13
lea rcx, [rbp + 7]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401d9c5f
movzx eax, word [rbp - 0x25]
cmp ax, word [rsi]
jne 0x1401d9c87
mov rax, qword [rbp - 9]
cmp rax, qword [rsi + 0x80]
jne 0x1401d9c87
mov rax, qword [rbp - 1]
cmp rax, qword [rsi + 0x88]
jne 0x1401d9c87
mov rax, qword [rbp - 0x19]
mov r15b, 1
mov ecx, r14d
mov qword [rax + 0x10], rcx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x90]
movzx eax, r15b
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x1401e0410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
xor esi, esi
mov dword [rbp - 0x34], 0x46464952
mov r13, rcx
mov dword [rbp - 0x20], 0x5453494c
mov ecx, 0x1000000
mov dword [rbp - 0x18], 0x4b4e554a
mov rbx, r9
mov dword [rbp - 0x38], 0x4144544d
lea edx, [rsi + 1]
mov dword [rbp - 0x24], 0x31786469
movzx edi, r8b
mov dword [rbp - 0x30], 0x58564944
mov dword [rbp - 0x2c], 0x78766964
xor r12b, r12b
mov dword [rbp - 0x28], 0x64697678
mov r14d, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r15, rax
test rax, rax
je 0x1401e061c
xor edx, edx
mov r8d, 0x1000000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [r13 + 0x48]
mov r9, r15
mov dword [rsp + 0x30], esi
mov r8, rbx
mov qword [rsp + 0x28], rsi
movzx edx, dil
mov dword [rsp + 0x20], 0x1000000
call fcn.1401c1720
test eax, eax
je 0x1401e0613
mov eax, dword [rbp - 0x34]
cmp eax, dword [r15]
jne 0x1401e0613
mov eax, dword [rbp - 0x30]
cmp eax, dword [r15 + 0x70]
je 0x1401e04fe
mov eax, dword [rbp - 0x2c]
cmp eax, dword [r15 + 0x70]
je 0x1401e04fe
mov eax, dword [rbp - 0x28]
cmp eax, dword [r15 + 0x70]
jne 0x1401e0504
mov r14d, 0xc
cmp byte [0x1411dd026], sil
jne 0x1401e0613
mov esi, dword [rbp - 0x20]
mov ebx, dword [rbp - 0x18]
mov edi, dword [rbp - 0x38]
nop word [rax + rax]
mov ecx, dword [r13 + 0x28]
mov rax, r14
imul ecx, dword [r13 + 0x48]
cqo
idiv rcx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], rax
lea r13d, [rdx + 4]
cmp r13d, 0x1000000
jae 0x1401e0606
xor edx, edx
mov r8d, 0x1000000
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
mov r8, qword [rbp - 0x18]
xor eax, eax
add r8, qword [rbp + 0x60]
mov r9, r15
movzx edx, byte [rbp + 0x58]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x48]
mov dword [rsp + 0x20], 0x1000000
mov ecx, dword [rax + 0x48]
call fcn.1401c1720
test eax, eax
je 0x1401e0613
mov ecx, dword [rbp - 0x20]
add rcx, r15
cmp esi, dword [rcx]
je 0x1401e05a2
cmp ebx, dword [rcx]
je 0x1401e05a2
cmp edi, dword [rcx]
jne 0x1401e05fa
lea eax, [r13 + 4]
cmp eax, 0x1000000
jae 0x1401e05e1
movsxd rcx, r13d
add rcx, r15
cmp byte [0x1411dd028], 0
je 0x1401e05dc
movzx eax, byte [rcx + 3]
mov byte [rbp - 0x38], al
movzx eax, byte [rcx + 2]
mov byte [rbp - 0x37], al
movzx eax, byte [rcx + 1]
mov byte [rbp - 0x36], al
movzx eax, byte [rcx]
mov byte [rbp - 0x35], al
mov eax, dword [rbp - 0x38]
jmp 0x1401e05de
mov eax, dword [rcx]
add r14, rax
add r14, 8
mov r12b, 1
cmp byte [0x1411dd026], 0
jne 0x1401e060b
mov r13, qword [rbp + 0x48]
jmp 0x1401e0520
mov eax, dword [rbp - 0x24]
cmp eax, dword [rcx]
jne 0x1401e0606
mov r12b, 1
jmp 0x1401e060b
test r12b, r12b
je 0x1401e0613
mov rax, qword [rbp + 0x50]
mov qword [rax + 0x10], r14
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, r12b
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401e48f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r14, rdx
mov dword [rbp - 0x28], 0x694c5153
mov r15, rcx
mov dword [rbp - 0x24], 0x66206574
xor esi, esi
mov dword [rbp - 0x20], 0x696c7062
mov ecx, 0x10000
mov word [rbp - 0x1c], 0x7473
mov r13, r9
movzx r12d, r8b
xor dil, dil
lea edx, [rsi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
je 0x1401e4a4a
xor edx, edx
mov r8d, 0x10000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [r15 + 0x48]
mov r9, rbx
mov dword [rsp + 0x30], esi
mov r8, r13
mov qword [rsp + 0x28], rsi
movzx edx, r12b
mov dword [rsp + 0x20], 0x10000
call fcn.1401c1720
test eax, eax
je 0x1401e4a32
mov rax, qword [rbp - 0x28]
cmp rax, qword [rbx]
jne 0x1401e4a1a
cmp byte [0x1411dd028], sil
mov dl, 1
movzx r8d, word [rbx + 0x10]
mov byte [0x1411dd036], dl
jne 0x1401e49eb
movzx eax, r8w
mov byte [rbp - 0x27], r8b
shr ax, 8
mov byte [rbp - 0x28], al
mov eax, dword [rbx + 0x1c]
mov ecx, eax
movzx r8d, word [rbp - 0x28]
shr ecx, 0x18
mov byte [rbp - 0x28], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbp - 0x27], cl
mov ecx, eax
shr ecx, 8
mov byte [rbp - 0x26], cl
mov byte [rbp - 0x25], al
mov ecx, dword [rbp - 0x28]
jmp 0x1401e49ee
mov ecx, dword [rbx + 0x1c]
mov eax, dword [rbp - 0x20]
cmp eax, dword [rbx + 0x3e56]
jne 0x1401e4a11
movzx eax, word [rbp - 0x1c]
cmp ax, word [rbx + 0x3e5a]
jne 0x1401e4a11
movzx edi, dl
xor dl, dl
mov byte [0x1411dd036], dl
movzx esi, r8w
imul esi, ecx
jmp 0x1401e4a21
movzx edx, byte [0x1411dd036]
test dl, dl
je 0x1401e4a32
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor al, al
jmp 0x1401e4a4e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, dil
test dil, dil
je 0x1401e4a4e
mov qword [r14 + 0x10], rsi
jmp 0x1401e4a4e
movzx eax, dil
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1402000d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp + 0xf], rax
xor r15b, r15b
mov dword [rbp - 0x29], 0x43202a28
cmp byte [0x1411dd026], r15b
mov r14, r9
movzx esi, r8b
mov dword [rbp - 0x25], 0x65746e6f
mov r13, rdx
mov dword [rbp - 0x21], 0x742d746e
mov rdi, rcx
mov dword [rbp - 0x1d], 0x3a657079
mov dword [rbp - 1], 0x3656676d
mov r12b, 0x35
mov dword [rbp + 7], 0x6c6c6543
mov dword [rbp - 0x19], 0x65746f4e
mov dword [rbp - 0x15], 0x6b6f6f62
mov dword [rbp - 0x11], 0x6e676953
mov dword [rbp - 0xd], 0x72757461
je 0x14020015f
xor al, al
jmp 0x140200287
mov edx, 1
mov qword [rsp + 0x88], rbx
mov ecx, 0xa00000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
je 0x14020027b
xor edx, edx
mov r8d, 0xa00000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [rdi + 0x48]
xor eax, eax
mov dword [rsp + 0x30], eax
mov r9, rbx
mov qword [rsp + 0x28], rax
mov r8, r14
movzx edx, sil
mov dword [rsp + 0x20], 0xa00000
call fcn.1401c1720
test eax, eax
je 0x140200272
mov rax, qword [rbp - 0x29]
cmp rax, qword [rbx]
jne 0x140200272
mov rax, qword [rbp - 0x21]
cmp rax, qword [rbx + 8]
jne 0x140200272
mov eax, dword [rbp - 1]
cmp eax, dword [rbx + 0x6250]
jne 0x140200272
cmp r12b, byte [rbx + 0x6254]
jne 0x140200272
cmp byte [0x1411dd026], 0
mov edx, 0x62ef
mov r8d, edx
mov r15b, 1
jne 0x14020026b
mov r11d, dword [rbp + 7]
mov dil, 0x65
mov r9, qword [rbp - 0x11]
mov sil, 0x5b
mov r10, qword [rbp - 0x19]
nop dword [rax]
mov ecx, edx
lea rax, [rcx + 0x11]
cmp rax, 0xa00000
jae 0x14020026b
cmp r11d, dword [rcx + rbx]
jne 0x140200247
cmp sil, byte [rcx + rbx + 4]
jne 0x140200247
mov eax, 0x32
add edx, eax
add r8d, eax
jmp 0x140200220
cmp r10, qword [rcx + rbx]
jne 0x14020025b
cmp r9, qword [rcx + rbx + 8]
jne 0x14020025b
cmp dil, byte [rcx + rbx + 0x10]
je 0x140200267
mov eax, 1
add edx, eax
add r8d, eax
jmp 0x140200220
add r8d, 0x2f
mov ecx, r8d
mov qword [r13 + 0x10], rcx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x88]
movzx eax, r15b
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret