joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a6b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x2f]
sub rsp, 0xf0
mov rax, qword [0x1400fa080]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, rdx
mov rdi, rcx
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x14010cdd0], eax
jle 0x14003a7a0
lea rcx, [0x14010cdd0]
call fcn.1400bcb88
cmp dword [0x14010cdd0], 0xffffffff
jne 0x14003a7a0
mov qword [rbp - 1], rbx
mov qword [rbp + 0xf], rbx
mov qword [rbp + 0x17], 0xf
mov byte [rbp - 1], bl
lea r8d, [rbx + 0x1c]
lea rdx, str.MmMapLockedPagesSpecifyCache
lea rcx, [rbp - 1]
call fcn.140037020
nop
lea r8, [rbp - 1]
mov rdx, qword [0x1401095d8]
mov rcx, rdi
call fcn.14003b110
mov qword [0x14010cd28], rax
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x14003a794
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a78e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a78e
call qword [0x1400c1c00]
int3
call fcn.1400bd290
nop
lea rcx, [0x14010cdd0]
call fcn.1400bcb28
mov r8, qword [0x14010cd28]
test r8, r8
jne 0x14003a89a
mov dword [rbp - 0x71], 0x27412704
mov dword [rbp - 0x6d], 0x2742273c
mov dword [rbp - 0x69], 0x27052725
mov dword [rbp - 0x65], 0x270a270c
mov dword [rbp - 0x61], 0x270c2702
mov dword [rbp - 0x5d], 0x271e2749
mov dword [rbp - 0x59], 0x274c2704
mov dword [rbp - 0x55], 0x2707270b
mov dword [rbp - 0x51], 0x27142701
mov dword [rbp - 0x4d], 0x273f2751
mov dword [rbp - 0x49], 0x2739271e
mov dword [rbp - 0x45], 0x27062714
mov dword [rbp - 0x41], 0x2717273b
mov dword [rbp - 0x3d], 0x2711271a
mov dword [rbp - 0x39], 0x2718271e
mov dword [rbp - 0x35], 0x271f272d
mov dword [rbp - 0x31], 0x27e52718
mov dword [rbp - 0x2d], 0x27d127f2
mov dword [rbp - 0x29], 0x27e127f3
mov dword [rbp - 0x25], 0x27ef27e6
mov dword [rbp - 0x21], 0x27f127e1
mov dword [rbp - 0x1d], 0x27eb27ca
mov dword [rbp - 0x19], 0x27e427e8
mov dword [rbp - 0x15], 0x27e8
mov byte [rbp - 0x11], 1
mov ecx, 0x275f
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x71], ax
inc rbx
cmp rbx, 0x2f
jb 0x14003a861
mov byte [rbp - 0x11], 0
lea rdx, [rbp - 0x71]
mov rcx, qword [0x1400c1660]
call fcn.1400414a0
lea rdx, [0x140041680]
mov rcx, rax
call qword [0x1400c1698]
xor eax, eax
jmp 0x14003a8d8
mov qword [rbp + 0x1f], rbx
mov dword [rsp + 0x40], 0x10
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov r9, rsi
lea rdx, [rbp + 0x1f]
mov rcx, rdi
call fcn.140041db0
mov rcx, qword [rbp + 0x1f]
test al, al
cmove rcx, rbx
mov rax, rcx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400bc9e0
mov rbx, qword [rsp + 0x120]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003a900
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x1400fa080]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rdx
mov rdi, rcx
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x14010cdb4], eax
jle 0x14003a9f0
lea rcx, [0x14010cdb4]
call fcn.1400bcb88
cmp dword [0x14010cdb4], 0xffffffff
jne 0x14003a9f0
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], 0xf
mov byte [rbp + 0x17], bl
lea r8d, [rbx + 0x19]
lea rdx, str.MmProtectMdlSystemAddress
lea rcx, [rbp + 0x17]
call fcn.140037020
nop
lea r8, [rbp + 0x17]
mov rdx, qword [0x1401095d8]
mov rcx, rdi
call fcn.14003b110
mov qword [0x14010cd78], rax
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x14003a9e4
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a9de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a9de
call qword [0x1400c1c00]
int3
call fcn.1400bd290
nop
lea rcx, [0x14010cdb4]
call fcn.1400bcb28
mov r8, qword [0x14010cd78]
test r8, r8
jne 0x14003aae9
mov dword [rbp - 0x49], 0x27412704
mov dword [rbp - 0x45], 0x2742273c
mov dword [rbp - 0x41], 0x27052725
mov dword [rbp - 0x3d], 0x270a270c
mov dword [rbp - 0x39], 0x270c2702
mov dword [rbp - 0x35], 0x271e2749
mov dword [rbp - 0x31], 0x274c2704
mov dword [rbp - 0x2d], 0x2707270b
mov dword [rbp - 0x29], 0x27142701
mov dword [rbp - 0x25], 0x273f2751
mov dword [rbp - 0x21], 0x2724271e
mov dword [rbp - 0x1d], 0x27192707
mov dword [rbp - 0x19], 0x271d2703
mov dword [rbp - 0x15], 0x270e271a
mov dword [rbp - 0x11], 0x27182736
mov dword [rbp - 0xd], 0x272d2711
mov dword [rbp - 9], 0x27f32706
mov dword [rbp - 5], 0x27e727f5
mov dword [rbp - 1], 0x27c527ee
mov dword [rbp + 3], 0x27e227e1
mov dword [rbp + 7], 0x27ed27f5
mov dword [rbp + 0xb], 0x27f927fa
mov word [rbp + 0xf], bx
mov byte [rbp + 0x11], 1
mov ecx, 0x275f
nop word [rax + rax]
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x49], ax
inc rbx
cmp rbx, 0x2c
jb 0x14003aab0
mov byte [rbp + 0x11], 0
lea rdx, [rbp - 0x49]
mov rcx, qword [0x1400c1660]
call fcn.1400414a0
lea rdx, [0x140041680]
mov rcx, rax
call qword [0x1400c1698]
xor al, al
jmp 0x14003ab0b
mov dword [rsp + 0x20], 0x40
mov r9, rsi
lea rdx, [rbp + 0x37]
mov rcx, rdi
call fcn.140042470
test al, al
je 0x14003aae5
cmp dword [rbp + 0x37], 0
setge al
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400bc9e0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003ab30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1400fa080]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x14010cd18], eax
jle 0x14003ac22
lea rcx, [0x14010cd18]
call fcn.1400bcb88
cmp dword [0x14010cd18], 0xffffffff
jne 0x14003ac22
mov qword [rbp + 7], rbx
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], 0xf
mov byte [rbp + 7], bl
lea r8d, [rbx + 0x12]
lea rdx, str.MmUnmapLockedPages
lea rcx, [rbp + 7]
call fcn.140037020
nop
lea r8, [rbp + 7]
mov rdx, qword [0x1401095d8]
mov rcx, rdi
call fcn.14003b110
mov qword [0x14010cde0], rax
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x14003ac16
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ac10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003ac10
call qword [0x1400c1c00]
int3
call fcn.1400bd290
nop
lea rcx, [0x14010cd18]
call fcn.1400bcb28
mov r8, qword [0x14010cde0]
test r8, r8
jne 0x14003acf9
mov dword [rbp - 0x49], 0x27412704
mov dword [rbp - 0x45], 0x2742273c
mov dword [rbp - 0x41], 0x27052725
mov dword [rbp - 0x3d], 0x270a270c
mov dword [rbp - 0x39], 0x270c2702
mov dword [rbp - 0x35], 0x271e2749
mov dword [rbp - 0x31], 0x274c2704
mov dword [rbp - 0x2d], 0x2707270b
mov dword [rbp - 0x29], 0x27142701
mov dword [rbp - 0x25], 0x273f2751
mov dword [rbp - 0x21], 0x2721271e
mov dword [rbp - 0x1d], 0x271b271b
mov dword [rbp - 0x19], 0x27082716
mov dword [rbp - 0x15], 0x27152735
mov dword [rbp - 0x11], 0x27172718
mov dword [rbp - 0xd], 0x271a2718
mov dword [rbp - 9], 0x27e1272f
mov dword [rbp - 5], 0x27e727e6
mov dword [rbp - 1], 0x27f0
mov byte [rbp + 3], 1
mov ecx, 0x275f
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x49], ax
inc rbx
cmp rbx, 0x25
jb 0x14003acc0
mov byte [rbp + 3], 0
lea rdx, [rbp - 0x49]
mov rcx, qword [0x1400c1660]
call fcn.1400414a0
lea rdx, [0x140041680]
mov rcx, rax
call qword [0x1400c1698]
xor al, al
jmp 0x14003ad0d
mov qword [rsp + 0x20], r14
mov r9, rsi
lea rdx, [rbp + 0x27]
mov rcx, rdi
call fcn.140042b30
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400bc9e0
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14003ad30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1400fa080]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rdx
mov rdi, rcx
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x14010ccf0], eax
jle 0x14003ae20
lea rcx, [0x14010ccf0]
call fcn.1400bcb88
cmp dword [0x14010ccf0], 0xffffffff
jne 0x14003ae20
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], 0xf
mov byte [rbp + 0x17], bl
lea r8d, [rbx + 0x12]
lea rdx, str.MmFreePagesFromMdl
lea rcx, [rbp + 0x17]
call fcn.140037020
nop
lea r8, [rbp + 0x17]
mov rdx, qword [0x1401095d8]
mov rcx, rdi
call fcn.14003b110
mov qword [0x14010cdb8], rax
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x14003ae14
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ae0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003ae0e
call qword [0x1400c1c00]
int3
call fcn.1400bd290
nop
lea rcx, [0x14010ccf0]
call fcn.1400bcb28
mov r8, qword [0x14010cdb8]
test r8, r8
jne 0x14003aef9
mov dword [rbp - 0x39], 0x27412704
mov dword [rbp - 0x35], 0x2742273c
mov dword [rbp - 0x31], 0x27052725
mov dword [rbp - 0x2d], 0x270a270c
mov dword [rbp - 0x29], 0x270c2702
mov dword [rbp - 0x25], 0x271e2749
mov dword [rbp - 0x21], 0x274c2704
mov dword [rbp - 0x1d], 0x2707270b
mov dword [rbp - 0x19], 0x27142701
mov dword [rbp - 0x15], 0x273f2751
mov dword [rbp - 0x11], 0x2732271e
mov dword [rbp - 0xd], 0x27132707
mov dword [rbp - 9], 0x27282712
mov dword [rbp - 5], 0x271d2718
mov dword [rbp - 1], 0x270f271e
mov dword [rbp + 3], 0x270c273b
mov dword [rbp + 7], 0x27ed2710
mov dword [rbp + 0xb], 0x27e627cc
mov dword [rbp + 0xf], 0x27ef
mov byte [rbp + 0x13], 1
mov ecx, 0x275f
nop
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x39], ax
inc rbx
cmp rbx, 0x25
jb 0x14003aec0
mov byte [rbp + 0x13], 0
lea rdx, [rbp - 0x39]
mov rcx, qword [0x1400c1660]
call fcn.1400414a0
lea rdx, [0x140041680]
mov rcx, rax
call qword [0x1400c1698]
xor al, al
jmp 0x14003af08
mov r9, rsi
lea rdx, [rbp + 0x37]
mov rcx, rdi
call fcn.140043200
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400bc9e0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003af30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14003b0e5
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x14010cd98], eax
jle 0x14003b01b
lea rcx, [0x14010cd98]
call fcn.1400bcb88
cmp dword [0x14010cd98], 0xffffffff
jne 0x14003b01b
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x37], rbx
mov qword [rbp + 0x3f], 0xf
mov byte [rbp + 0x27], bl
lea r8d, [rbx + 0xa]
lea rdx, str.ExFreePool
lea rcx, [rbp + 0x27]
call fcn.140037020
nop
lea r8, [rbp + 0x27]
mov rdx, qword [0x1401095d8]
mov rcx, rsi
call fcn.14003b110
mov qword [0x14010cd60], rax
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x14003b00f
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b009
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b009
call qword [0x1400c1c00]
int3
call fcn.1400bd290
nop
lea rcx, [0x14010cd98]
call fcn.1400bcb28
mov r8, qword [0x14010cd60]
test r8, r8
jne 0x14003b0e9
mov dword [rbp - 0x29], 0x27412704
mov dword [rbp - 0x25], 0x2742273c
mov dword [rbp - 0x21], 0x27052725
mov dword [rbp - 0x1d], 0x270a270c
mov dword [rbp - 0x19], 0x270c2702
mov dword [rbp - 0x15], 0x271e2749
mov dword [rbp - 0x11], 0x274c2704
mov dword [rbp - 0xd], 0x2707270b
mov dword [rbp - 9], 0x27142701
mov dword [rbp - 5], 0x27372751
mov dword [rbp - 1], 0x2735270b
mov dword [rbp + 3], 0x271a2719
mov dword [rbp + 7], 0x271b2718
mov dword [rbp + 0xb], 0x270e2718
mov dword [rbp + 0xf], 0x272c271e
mov dword [rbp + 0x13], 0x27112712
mov dword [rbp + 0x17], 0x2713
mov byte [rbp + 0x1b], 1
mov ecx, 0x275f
nop dword [rax + rax]
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x29], ax
inc rbx
cmp rbx, 0x21
jb 0x14003b0b0
mov byte [rbp + 0x1b], 0
lea rdx, [rbp - 0x29]
mov rcx, qword [0x1400c1660]
call fcn.1400414a0
lea rdx, [0x140041680]
mov rcx, rax
call qword [0x1400c1698]
xor al, al
jmp 0x14003b0f6
mov r9, rdi
xor edx, edx
mov rcx, rsi
call fcn.1400438c0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003bbc0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x1400fa080]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14003bdb6
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x14010cdd4], eax
jle 0x14003bcb9
lea rcx, [0x14010cdd4]
call fcn.1400bcb88
cmp dword [0x14010cdd4], 0xffffffff
jne 0x14003bcb9
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], 0xf
mov byte [rbp + 0x17], bl
lea r8d, [rbx + 0x1e]
lea rdx, str.ExAcquireResourceExclusiveLite
lea rcx, [rbp + 0x17]
call fcn.140037020
nop
lea r8, [rbp + 0x17]
mov rdx, qword [0x1401095d8]
mov rcx, rsi
call fcn.14003b110
mov qword [0x14010cdd8], rax
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x14003bcad
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bca7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003bca7
call qword [0x1400c1c00]
int3
call fcn.1400bd290
nop
lea rcx, [0x14010cdd4]
call fcn.1400bcb28
mov r8, qword [0x14010cdd8]
test r8, r8
jne 0x14003bdd7
mov dword [rbp - 0x59], 0x27412704
mov dword [rbp - 0x55], 0x2742273c
mov dword [rbp - 0x51], 0x27052725
mov dword [rbp - 0x4d], 0x270a270c
mov dword [rbp - 0x49], 0x270c2702
mov dword [rbp - 0x45], 0x271e2749
mov dword [rbp - 0x41], 0x274c2704
mov dword [rbp - 0x3d], 0x2707270b
mov dword [rbp - 0x39], 0x27142701
mov dword [rbp - 0x35], 0x27372751
mov dword [rbp - 0x31], 0x2735270b
mov dword [rbp - 0x2d], 0x27072716
mov dword [rbp - 0x29], 0x27112702
mov dword [rbp - 0x25], 0x271f270b
mov dword [rbp - 0x21], 0x27192729
mov dword [rbp - 0x1d], 0x2711270e
mov dword [rbp - 0x19], 0x27f2270a
mov dword [rbp - 0x15], 0x27e727e2
mov dword [rbp - 0x11], 0x27fc27c6
mov dword [rbp - 0xd], 0x27ea27e6
mov dword [rbp - 9], 0x27fb27f2
mov dword [rbp - 5], 0x27fc27e0
mov dword [rbp - 1], 0x27c027ee
mov dword [rbp + 3], 0x27fa27e4
mov dword [rbp + 7], 0x27ea
mov byte [rbp + 0xb], 1
mov ecx, 0x275f
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x59], ax
inc rbx
cmp rbx, 0x31
jb 0x14003bd81
mov byte [rbp + 0xb], 0
lea rdx, [rbp - 0x59]
mov rcx, qword [0x1400c1660]
call fcn.1400414a0
lea rdx, [0x140041680]
mov rcx, rax
call qword [0x1400c1698]
xor al, al
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400bc9e0
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
mov byte [rsp + 0x20], 1
mov r9, rdi
lea rdx, [rbp + 0x37]
mov rcx, rsi
call fcn.140043f70
test al, al
je 0x14003bdb6
cmp byte [rbp + 0x37], 0
je 0x14003bdb6
mov al, 1
jmp 0x14003bdb8
Function at 0x14003be00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14003bfd5
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x14010cdb0], eax
jle 0x14003beeb
lea rcx, [0x14010cdb0]
call fcn.1400bcb88
cmp dword [0x14010cdb0], 0xffffffff
jne 0x14003beeb
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x37], rbx
mov qword [rbp + 0x3f], 0xf
mov byte [rbp + 0x27], bl
lea r8d, [rbx + 0x15]
lea rdx, str.ExReleaseResourceLite
lea rcx, [rbp + 0x27]
call fcn.140037020
nop
lea r8, [rbp + 0x27]
mov rdx, qword [0x1401095d8]
mov rcx, rsi
call fcn.14003b110
mov qword [0x14010cd38], rax
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x14003bedf
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bed9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003bed9
call qword [0x1400c1c00]
int3
call fcn.1400bd290
nop
lea rcx, [0x14010cdb0]
call fcn.1400bcb28
mov r8, qword [0x14010cd38]
test r8, r8
jne 0x14003bfd9
mov dword [rbp - 0x39], 0x27412704
mov dword [rbp - 0x35], 0x2742273c
mov dword [rbp - 0x31], 0x27052725
mov dword [rbp - 0x2d], 0x270a270c
mov dword [rbp - 0x29], 0x270c2702
mov dword [rbp - 0x25], 0x271e2749
mov dword [rbp - 0x21], 0x274c2704
mov dword [rbp - 0x1d], 0x2707270b
mov dword [rbp - 0x19], 0x27142701
mov dword [rbp - 0x15], 0x27372751
mov dword [rbp - 0x11], 0x2726270b
mov dword [rbp - 0xd], 0x271a2710
mov dword [rbp - 9], 0x27192712
mov dword [rbp - 5], 0x271f270a
mov dword [rbp - 1], 0x27192729
mov dword [rbp + 3], 0x2711270e
mov dword [rbp + 7], 0x27f2270a
mov dword [rbp + 0xb], 0x27e727e2
mov dword [rbp + 0xf], 0x27ed27cf
mov dword [rbp + 0x13], 0x27e327f1
mov word [rbp + 0x17], bx
mov byte [rbp + 0x19], 1
mov ecx, 0x275f
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x39], ax
inc rbx
cmp rbx, 0x28
jb 0x14003bfa0
mov byte [rbp + 0x19], 0
lea rdx, [rbp - 0x39]
mov rcx, qword [0x1400c1660]
call fcn.1400414a0
lea rdx, [0x140041680]
mov rcx, rax
call qword [0x1400c1698]
xor al, al
jmp 0x14003bfe6
mov r9, rdi
xor edx, edx
mov rcx, rsi
call fcn.140044630
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003c000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x1400fa080]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14003c205
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x14010cd94], eax
jle 0x14003c0fb
lea rcx, [0x14010cd94]
call fcn.1400bcb88
cmp dword [0x14010cd94], 0xffffffff
jne 0x14003c0fb
mov qword [rbp + 7], rbx
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], 0xf
mov byte [rbp + 7], bl
lea r8d, [rbx + 0x1f]
lea rdx, str.RtlDeleteElementGenericTableAvl
lea rcx, [rbp + 7]
call fcn.140037020
nop
lea r8, [rbp + 7]
mov rdx, qword [0x1401095d8]
mov rcx, rsi
call fcn.14003b110
mov qword [0x14010cd48], rax
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x14003c0ef
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c0e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003c0e9
call qword [0x1400c1c00]
int3
call fcn.1400bd290
nop
lea rcx, [0x14010cd94]
call fcn.1400bcb28
mov r8, qword [0x14010cd48]
test r8, r8
jne 0x14003c209
mov dword [rbp - 0x69], 0x27412704
mov dword [rbp - 0x65], 0x2742273c
mov dword [rbp - 0x61], 0x27052725
mov dword [rbp - 0x5d], 0x270a270c
mov dword [rbp - 0x59], 0x270c2702
mov dword [rbp - 0x55], 0x271e2749
mov dword [rbp - 0x51], 0x274c2704
mov dword [rbp - 0x4d], 0x2707270b
mov dword [rbp - 0x49], 0x27142701
mov dword [rbp - 0x45], 0x27202751
mov dword [rbp - 0x41], 0x27182707
mov dword [rbp - 0x3d], 0x27132731
mov dword [rbp - 0x39], 0x271d271b
mov dword [rbp - 0x35], 0x271f270d
mov dword [rbp - 0x31], 0x2710273e
mov dword [rbp - 0x2d], 0x27132718
mov dword [rbp - 0x29], 0x27ee271a
mov dword [rbp - 0x25], 0x27c527f5
mov dword [rbp - 0x21], 0x27ea27e6
mov dword [rbp - 0x1d], 0x27f427e0
mov dword [rbp - 0x19], 0x27eb27ee
mov dword [rbp - 0x15], 0x27eb27dd
mov dword [rbp - 0x11], 0x27e027e9
mov dword [rbp - 0xd], 0x27cf27e8
mov dword [rbp - 9], 0x27fc27f9
mov word [rbp - 5], bx
mov byte [rbp - 3], 1
mov ecx, 0x275f
nop word [rax + rax]
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x69], ax
inc rbx
cmp rbx, 0x32
jb 0x14003c1d0
mov byte [rbp - 3], 0
lea rdx, [rbp - 0x69]
mov rcx, qword [0x1400c1660]
call fcn.1400414a0
lea rdx, [0x140041680]
mov rcx, rax
call qword [0x1400c1698]
xor al, al
jmp 0x14003c22d
mov qword [rsp + 0x20], r14
mov r9, rdi
lea rdx, [rbp + 0x27]
mov rcx, rsi
call fcn.140044ce0
test al, al
je 0x14003c22b
cmp byte [rbp + 0x27], 0
je 0x14003c22b
mov al, 1
jmp 0x14003c22d
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400bc9e0
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14003c250
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x1400fa080]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14003c455
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x14010cdc4], eax
jle 0x14003c34b
lea rcx, [0x14010cdc4]
call fcn.1400bcb88
cmp dword [0x14010cdc4], 0xffffffff
jne 0x14003c34b
mov qword [rbp + 7], rbx
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], 0xf
mov byte [rbp + 7], bl
lea r8d, [rbx + 0x1f]
lea rdx, str.RtlLookupElementGenericTableAvl
lea rcx, [rbp + 7]
call fcn.140037020
nop
lea r8, [rbp + 7]
mov rdx, qword [0x1401095d8]
mov rcx, rsi
call fcn.14003b110
mov qword [0x14010cd50], rax
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x14003c33f
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c339
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003c339
call qword [0x1400c1c00]
int3
call fcn.1400bd290
nop
lea rcx, [0x14010cdc4]
call fcn.1400bcb28
mov r8, qword [0x14010cd50]
test r8, r8
jne 0x14003c471
mov dword [rbp - 0x69], 0x27412704
mov dword [rbp - 0x65], 0x2742273c
mov dword [rbp - 0x61], 0x27052725
mov dword [rbp - 0x5d], 0x270a270c
mov dword [rbp - 0x59], 0x270c2702
mov dword [rbp - 0x55], 0x271e2749
mov dword [rbp - 0x51], 0x274c2704
mov dword [rbp - 0x4d], 0x2707270b
mov dword [rbp - 0x49], 0x27142701
mov dword [rbp - 0x45], 0x27202751
mov dword [rbp - 0x41], 0x27182707
mov dword [rbp - 0x3d], 0x27192739
mov dword [rbp - 0x39], 0x27132718
mov dword [rbp - 0x35], 0x270a270c
mov dword [rbp - 0x31], 0x2710273e
mov dword [rbp - 0x2d], 0x27132718
mov dword [rbp - 0x29], 0x27ee271a
mov dword [rbp - 0x25], 0x27c527f5
mov dword [rbp - 0x21], 0x27ea27e6
mov dword [rbp - 0x1d], 0x27f427e0
mov dword [rbp - 0x19], 0x27eb27ee
mov dword [rbp - 0x15], 0x27eb27dd
mov dword [rbp - 0x11], 0x27e027e9
mov dword [rbp - 0xd], 0x27cf27e8
mov dword [rbp - 9], 0x27fc27f9
mov word [rbp - 5], bx
mov byte [rbp - 3], 1
mov ecx, 0x275f
nop word [rax + rax]
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x69], ax
inc rbx
cmp rbx, 0x32
jb 0x14003c420
mov byte [rbp - 3], 0
lea rdx, [rbp - 0x69]
mov rcx, qword [0x1400c1660]
call fcn.1400414a0
lea rdx, [0x140041680]
mov rcx, rax
call qword [0x1400c1698]
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400bc9e0
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 0x20], r14
mov r9, rdi
lea rdx, [rbp + 0x27]
mov rcx, rsi
call fcn.1400453b0
test al, al
je 0x14003c455
mov rax, qword [rbp + 0x27]
jmp 0x14003c457