joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ddc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x14002de0d
cmp qword [rdx + 0x50], 0
je 0x14002de05
cmp r8, qword [rdx + 0x1f8]
jne 0x14002de67
cmp byte [rdx + 0x3e0], 0
je 0x14002de67
mov byte [rdx + 0x3e0], 0
mov rdx, rsi
call fcn.14002a770
call fcn.140024690
test rax, rax
je 0x14002de50
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x27], 0x74656b63
mov rcx, rax
mov dword [rsp + 0x21], 0x65736f6c
mov word [rsp + 0x25], 0x6f73
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x20], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002de50
mov rcx, rsi
call rax
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov rdx, rsi
call fcn.14002a770
test rdi, rdi
je 0x14002debc
mov rax, qword [rdi + 0xd8]
test rax, rax
je 0x14002de98
mov byte [rax + 0x182], 1
mov rdx, rsi
mov rax, qword [rbx + 0x50]
mov rcx, qword [rbx + 0x58]
call rax
mov ecx, eax
jmp 0x14002decd
mov rax, qword [rdi + 0xd0]
test rax, rax
je 0x14002debc
mov byte [rax + 0x182], 1
mov rdx, rsi
mov rax, qword [rbx + 0x50]
mov rcx, qword [rbx + 0x58]
call rax
mov ecx, eax
jmp 0x14002decd
mov rcx, qword [rbx + 0x58]
mov rdx, rsi
call qword [rbx + 0x50]
mov ecx, eax
test rdi, rdi
je 0x14002deec
mov rax, qword [rdi + 0xd8]
test rax, rax
jne 0x14002dee5
mov rax, qword [rdi + 0xd0]
test rax, rax
je 0x14002deec
mov byte [rax + 0x182], 0
mov eax, ecx
jmp 0x14002de52

Function at 0x14002e2c0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14002e390
lea r8, [rsp + 0x30]
mov rdx, rcx
call fcn.140050760
test eax, eax
jg 0x14002e390
xor r8d, r8d
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rbx + rdx], r8b
jne 0x14002e2f1
test rdx, rdx
je 0x14002e34c
lea rcx, [rbx - 1]
add rcx, rdx
cmp rcx, rbx
jb 0x14002e34c
nop dword [rax + rax]
cmp byte [rcx], 0x2e
je 0x14002e31f
dec rcx
cmp rcx, rbx
jae 0x14002e310
jmp 0x14002e34c
cmp rcx, rbx
je 0x14002e34c
lea rax, [rcx - 1]
cmp rax, rbx
jb 0x14002e34c
nop dword [rax]
cmp byte [rax], 0x2e
je 0x14002e33f
dec rax
cmp rax, rbx
jae 0x14002e330
jmp 0x14002e34c
lea r8, [rax + 1]
mov rax, rbx
sub rax, r8
add rdx, rax
test r8, r8
cmovne rbx, r8
lea r8, [rbx + rdx]
mov edx, 0x1505
cmp rbx, r8
jae 0x14002e387
lea r9, [0x1400b9950]
nop dword [rax + rax]
movzx eax, byte [rbx]
inc rbx
imul rdx, rdx, 0x21
movsx rcx, byte [rax + r9]
xor rdx, rcx
cmp rbx, r8
jb 0x14002e370
movzx eax, dl
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140032a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov r8, qword [rdx + 0x10]
mov r15, rcx
mov qword [rdx + 0x18], r8
mov rbx, rdx
mov rcx, r8
test r8, r8
je 0x140032acf
movzx eax, byte [r8]
test al, al
je 0x140032acf
nop dword [rax]
lea rcx, [rcx + 1]
test al, al
js 0x140032ae9
movzx eax, byte [rcx]
test al, al
jne 0x140032ac0
xor eax, eax
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x160
pop r15
pop rbx
pop rbp
ret
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov rcx, r8
call fcn.1400567a0
test al, al
je 0x140032b12
mov rax, qword [rsp + 0x20]
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
jmp 0x140032acf
mov qword [rsp + 0x190], rsi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x158], rdi
mov esi, 1
mov qword [rsp + 0x150], r14
mov dword [rsp + 0x30], 0x4c746547
mov dword [rsp + 0x36], 0x72724574
mov word [rsp + 0x3b], 0x72
mov word [rsp + 0x34], 0x7361
mov byte [rsp + 0x3a], 0x6f
mov dword [rsp + 0x28], 0x6c6c642e
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x20], 0x6e72654b
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140032b91
call rax
mov esi, eax
call fcn.14003d670
mov edi, eax
call fcn.14006ac68
test esi, esi
lea rdx, str.Error
mov r8d, 0x100
lea rcx, [rsp + 0x40]
mov r14d, dword [rax]
lea rax, str.No_error
cmove rdx, rax
mov byte [rsp + 0x40], 0
call fcn.14006e660
mov byte [rbp + 0x3f], 0
call fcn.14006ac68
mov rsi, qword [rsp + 0x190]
cmp dword [rax], r14d
je 0x140032be7
call fcn.14006ac68
mov dword [rax], r14d
call fcn.14003d670
mov r14, qword [rsp + 0x150]
cmp edi, eax
je 0x140032bff
mov ecx, edi
call fcn.14004fed0
mov r8, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
lea rdx, str.Failed_to_convert__s_to_ACE___s
mov rcx, r15
call fcn.14002b570
mov rdi, qword [rsp + 0x158]
mov eax, 3
jmp 0x140032ad1

Function at 0x140038220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
call fcn.140024690
test rax, rax
je 0x14003828e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x27], 0x74656b63
mov rcx, rax
mov dword [rsp + 0x21], 0x65736f6c
mov word [rsp + 0x25], 0x6f73
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x20], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003828e
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x40
pop rbx
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x40
pop rbx
ret
Function at 0x1400382b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov dword [rbp - 0x1e], 0x43726574
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x14], 0x6365536c
mov dword [rbp - 0x10], 0x6e6f6974
mov dword [rbp - 0x18], 0x61636974
mov word [rbp - 0x1a], 0x6972
mov word [rbp - 0x20], 0x6e45
mov byte [rbp - 0xc], 0
mov dword [rbp - 0x28], 0x6c6c642e
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x30], 0x6e72654b
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140038334
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x140038350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov word [rbp - 0x1d], 0x6576
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x14], 0x6365536c
mov word [rbp - 0x10], 0x6974
mov word [rbp - 0xd], 0x6e
mov word [rbp - 0x20], 0x654c
mov byte [rbp - 0xe], 0x6f
mov dword [rbp - 0x1b], 0x74697243
mov word [rbp - 0x17], 0x6369
mov byte [rbp - 0x1e], 0x61
mov byte [rbp - 0x15], 0x61
mov dword [rbp - 0x28], 0x6c6c642e
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x30], 0x6e72654b
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400383e0
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140038400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, qword [rcx]
mov rdi, rcx
test rbx, rbx
je 0x1400384a5
lea rcx, [rbp - 0x30]
mov word [rbp - 0x16], 0x6369
mov dword [rbp - 0x20], 0x656c6544
mov dword [rbp - 0xe], 0x6e6f69
mov word [rbp - 0x19], 0x6972
mov dword [rbp - 0x13], 0x6365536c
mov word [rbp - 0x1c], 0x6574
mov byte [rbp - 0xf], 0x74
mov byte [rbp - 0x1a], 0x43
mov byte [rbp - 0x14], 0x61
mov byte [rbp - 0x17], 0x74
mov dword [rbp - 0x28], 0x6c6c642e
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x30], 0x6e72654b
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003849c
mov rcx, rbx
call rax
mov rcx, qword [rdi]
call qword [fcn.14006baa8]
mov rcx, qword [rdi + 0x10]
call qword [fcn.14006baa8]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400384d2
nop dword [rax + rax]
mov rbx, qword [rcx + 0x28]
call qword [fcn.14006baa8]
mov rcx, rbx
test rbx, rbx
jne 0x1400384c0
mov rcx, qword [rdi + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x1400384e1
call fcn.140038220
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
mov qword [rdi + 0x70], rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x14003b0b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, rdx
movzx edx, byte [rcx]
test dl, dl
je 0x14003b0e5
lea r9, [0x1400b9950]
movzx eax, byte [r8]
test al, al
je 0x14003b0e5
movzx eax, byte [rax + r9]
movzx edx, dl
cmp byte [rdx + r9], al
jne 0x14003b0f7
movzx edx, byte [rcx + 1]
inc rcx
inc r8
test dl, dl
jne 0x14003b0c1
xor edx, edx
mov eax, edx
cmp byte [rcx], al
sete al
cmp byte [r8], dl
setne dl
xor eax, edx
ret
xor eax, eax
ret

Function at 0x14003b390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, qword [rbp + 0x30]
lea rcx, [rbp - 0x30]
mov rbx, r8
mov word [rbp - 0xe], 0x65
mov word [rbp - 0x18], 0x6f54
mov dword [rbp - 0x1d], 0x61684365
mov dword [rbp - 0x16], 0x746c754d
mov word [rbp - 0x20], 0x6957
mov byte [rbp - 0x19], 0x72
mov byte [rbp - 0x1e], 0x64
mov word [rbp - 0x11], 0x7942
mov byte [rbp - 0x12], 0x69
mov byte [rbp - 0xf], 0x74
mov dword [rbp - 0x28], 0x6c6c642e
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x30], 0x6e72654b
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14003b456
mov eax, dword [rbp + 0x38]
mov r9d, 0xffffffff
mov qword [rsp + 0x38], 0
mov r8, rbx
mov qword [rsp + 0x30], 0
xor edx, edx
mov dword [rsp + 0x28], eax
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call r10
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14003b480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, qword [rbp + 0x40]
lea rcx, [rbp - 0x30]
mov rdi, r8
mov dword [rbp - 0x16], 0x6469576f
mov ebx, edx
mov dword [rbp - 0x1f], 0x69746c75
mov dword [rbp - 0x10], 0x726168
mov word [rbp - 0x1b], 0x7942
mov word [rbp - 0x12], 0x4365
mov word [rbp - 0x18], 0x5465
mov byte [rbp - 0x20], 0x4d
mov byte [rbp - 0x19], 0x74
mov dword [rbp - 0x28], 0x6c6c642e
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x30], 0x6e72654b
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14003b52c
mov eax, dword [rbp + 0x48]
mov r9d, 0xffffffff
mov dword [rsp + 0x28], eax
mov r8, rdi
mov edx, ebx
mov qword [rsp + 0x20], rsi
mov ecx, 0xfde9
call r10
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003cdc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov word [rbp - 0x1a], 0x6f43
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x1f], 0x65537265
movzx esi, r8b
mov dword [rbp - 0x18], 0x7469646e
mov edi, edx
mov dword [rbp - 0x12], 0x73614d6e
mov word [rbp - 0xe], 0x6b
mov byte [rbp - 0x1b], 0x74
mov word [rbp - 0x14], 0x6f69
mov byte [rbp - 0x20], 0x56
mov dword [rbp - 0x28], 0x6c6c642e
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x30], 0x6e72654b
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003ce57
movzx r8d, sil
mov edx, edi
mov rcx, rbx
call rax
jmp 0x14003ce5a
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x14003d010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, rcx
mov r14d, 1
mov edx, r14d
xor ecx, ecx
xor r15d, r15d
call qword [fcn.14006bce8]
mov rdi, rax
test rax, rax
je 0x14003d10c
nop word [rax + rax]
xor ebx, ebx
mov dword [rbp - 0xf], 0x6c626169
lea rcx, [rbp - 0x30]
mov byte [rbp - 9], bl
mov byte [rbp - 0x24], bl
mov r15, rdi
mov esi, r14d
mov dword [rbp - 0x15], 0x56746e65
mov dword [rbp - 0x1a], 0x6e6f7269
mov dword [rbp - 0x20], 0x45746547
mov word [rbp - 0x11], 0x7261
mov word [rbp - 0xb], 0x4165
mov word [rbp - 0x1c], 0x766e
mov byte [rbp - 0x16], 0x6d
mov dword [rbp - 0x28], 0x6c6c642e
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x30], 0x6e72654b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003d0de
mov r8d, r14d
mov rdx, rdi
mov rcx, r12
call rax
mov ebx, eax
mov r14d, ebx
test ebx, ebx
je 0x14003d141
cmp ebx, esi
je 0x14003d141
cmp ebx, 0x8000
ja 0x14003d141
cmp ebx, esi
jb 0x14003d13c
mov edx, ebx
mov rcx, rdi
call qword [fcn.14006bce8]
mov rdi, rax
test rax, rax
jne 0x14003d060
mov rcx, r15
call qword [fcn.14006baa8]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rax, rdi
jmp 0x14003d117
mov rcx, rdi
jmp 0x14003d10f
Function at 0x14003d150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov dword [rbp - 0x30], 0x61766441
lea rcx, [rbp - 0x30]
mov word [rbp - 0x28], 0x642e
mov r14d, r9d
mov dword [rbp - 0x2c], 0x32336970
xor ebx, ebx
mov word [rbp - 0x25], 0x6c
mov byte [rbp - 0x26], 0x6c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14003d20b
lea rdx, [rbp - 0x20]
mov word [rbp - 0x17], 0x7269
mov rcx, rax
mov dword [rbp - 0x14], 0x746e6f43
mov dword [rbp - 0xf], 0x417478
mov dword [rbp - 0x1c], 0x71634174
mov dword [rbp - 0x20], 0x70797243
mov byte [rbp - 0x10], 0x65
mov byte [rbp - 0x15], 0x65
mov byte [rbp - 0x18], 0x75
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003d202
mov r9d, r14d
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x14003d230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov dword [rbp - 0x30], 0x61766441
lea rcx, [rbp - 0x30]
mov word [rbp - 0x28], 0x642e
xor ebx, ebx
mov dword [rbp - 0x2c], 0x32336970
mov word [rbp - 0x25], 0x6c
mov byte [rbp - 0x26], 0x6c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14003d2d8
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x19], 0x7361656c
mov rcx, rax
mov dword [rbp - 0x15], 0x6e6f4365
mov dword [rbp - 0x10], 0x747865
mov dword [rbp - 0x1f], 0x74707972
mov word [rbp - 0x1b], 0x6552
mov byte [rbp - 0x11], 0x74
mov byte [rbp - 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003d2cf
xor edx, edx
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x14003d300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
mov word [rbp - 0x2e], 0x5f32
mov word [rbp - 0x2b], 0x2e32
mov word [rbp - 0x30], 0x7357
mov word [rbp - 0x28], 0x6c6c
mov byte [rbp - 0x2c], 0x33
mov byte [rbp - 0x26], 0
mov byte [rbp - 0x29], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14003d359
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14003d3a0
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x6f727245
mov rcx, rax
mov dword [rbp - 0x20], 0x47415357
mov dword [rbp - 0x1a], 0x7473614c
mov word [rbp - 0x12], 0x72
mov word [rbp - 0x1c], 0x7465
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003d3a0
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x50
pop rbp
ret
mov eax, 0xffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x50
pop rbp
ret

Function at 0x14003d3c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
mov word [rbp - 0x3b], 0x3233
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x40], 0x70797243
xor ebx, ebx
mov dword [rbp - 0x38], 0x6c6c64
mov byte [rbp - 0x39], 0x2e
mov byte [rbp - 0x3c], 0x74
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14003d479
lea rdx, [rbp - 0x30]
mov word [rbp - 0x1b], 0x746e
mov rcx, rax
mov dword [rbp - 0x25], 0x69666974
mov dword [rbp - 0x21], 0x65746163
mov word [rbp - 0x18], 0x7478
mov dword [rbp - 0x2e], 0x72467472
mov word [rbp - 0x30], 0x6543
mov dword [rbp - 0x29], 0x72654365
mov word [rbp - 0x1d], 0x6f43
mov byte [rbp - 0x19], 0x65
mov byte [rbp - 0x16], bl
mov byte [rbp - 0x2a], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003d470
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14003d4a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, qword [rbp + 0x50]
mov rsi, rcx
lea rcx, [rbp - 0x40]
mov word [rbp - 0x3b], 0x3233
mov r14d, r9d
mov dword [rbp - 0x40], 0x70797243
xor ebx, ebx
mov dword [rbp - 0x38], 0x6c6c64
mov byte [rbp - 0x39], 0x2e
mov byte [rbp - 0x3c], 0x74
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14003d579
lea rdx, [rbp - 0x30]
mov word [rbp - 0x1e], 0x4965
mov rcx, rax
mov word [rbp - 0x30], 0x6543
mov word [rbp - 0x1b], 0x7453
mov dword [rbp - 0x2b], 0x43646e69
mov dword [rbp - 0x26], 0x66697472
mov word [rbp - 0x2d], 0x4674
mov dword [rbp - 0x22], 0x74616369
mov word [rbp - 0x18], 0x6572
mov byte [rbp - 0x19], 0x6f
mov byte [rbp - 0x2e], 0x72
mov byte [rbp - 0x1c], 0x6e
mov byte [rbp - 0x16], bl
mov byte [rbp - 0x27], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003d570
mov qword [rsp + 0x28], rbx
mov r9d, r14d
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov edx, 0x10001
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x14003d5a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
mov word [rbp - 0x2b], 0x3233
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x70797243
xor ebx, ebx
mov dword [rbp - 0x28], 0x6c6c64
mov byte [rbp - 0x29], 0x2e
mov byte [rbp - 0x2c], 0x74
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14003d641
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1b], 0x6f6c
mov rcx, rax
mov dword [rbp - 0x18], 0x6f745365
mov dword [rbp - 0x20], 0x74726543
mov word [rbp - 0x14], 0x6572
mov byte [rbp - 0x19], 0x73
mov byte [rbp - 0x12], bl
mov byte [rbp - 0x1c], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003d638
xor edx, edx
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x14003d670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x20], 0x4c746547
mov dword [rbp - 0x1a], 0x72724574
mov word [rbp - 0x15], 0x72
mov word [rbp - 0x1c], 0x7361
mov byte [rbp - 0x16], 0x6f
mov dword [rbp - 0x28], 0x6c6c642e
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x30], 0x6e72654b
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003d6ee
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x50
pop rbp
ret
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x50
pop rbp
ret