joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180082850
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov r8, qword [0x180147720]
movabs rbp, 0x7ffffffeffff
xor esi, esi
mov ebx, edx
mov rdi, rcx
lea rax, [r8 - 0x10000]
cmp rax, rbp
ja 0x1800826d1
test r8, r8
jne 0x180082800
movabs rax, 0x2baa037a5176c9c5
mov qword [rsp + 0x38], rsi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [0x18003e860]
mov qword [rsp + 0x40], rsi
call fcn.18003e2f0
test al, al
je 0x18008278b
mov r10, qword [rsp + 0x38]
lea rax, [r10 - 0x10000]
cmp rax, rbp
ja 0x18008278b
mov eax, dword [0x18002f2d4]
mov r8, rsi
mov dword [rsp + 0x60], eax
movabs r9, 0x2492492492492493
movzx eax, word [0x18002f2d8]
mov word [rsp + 0x64], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul edx, eax, 0x38
movzx eax, r8b
sub al, dl
add al, 0x31
xor byte [rsp + r8 + 0x60], al
inc r8
cmp r8, 6
jb 0x180082740
lea r8, [rsp + 0x60]
movabs rdx, 0x11837e716e5fd5ec
mov rcx, r10
call fcn.18003e550
jmp 0x1800827f6
mov eax, dword [0x18002f2dc]
mov r8, rsi
mov dword [rsp + 0x60], eax
movabs r9, 0x2492492492492493
movzx eax, word [0x18002f2e0]
mov word [rsp + 0x64], ax
nop
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x38
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x60], al
inc r8
cmp r8, 6
jb 0x1800827b0
lea rdx, [rsp + 0x60]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18003e740
mov qword [0x180147720], rax
mov r8, rax
mov qword [rsp + 0x30], r8
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rsp + 0x38], rdi
mov ecx, ebx
mov qword [rsp + 0x40], rsi
call fcn.18003e820
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov edx, ecx
mov rcx, qword [0x1801476f0]
jmp 0x180082690
Function at 0x180082860
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x180147450]
call fcn.18007ff00
test al, al
je 0x1800825b6
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x180082be0
mov rcx, qword [rbx + 8]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1800825e5
mov rax, qword [0x180147660]
xor edx, edx
call rax
test eax, eax
js 0x1800825e5
mov rcx, qword [rbx + 8]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [0x180147658]
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov r8, qword [0x180147730]
movabs rbp, 0x7ffffffeffff
xor esi, esi
mov rbx, rdx
mov rdi, rcx
lea rax, [r8 - 0x10000]
cmp rax, rbp
ja 0x1800828a2
test r8, r8
jne 0x1800829c4
movabs rax, 0x2baa037a5176c9c5
mov qword [rsp + 0x38], rsi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [0x18003e860]
mov qword [rsp + 0x40], rsi
call fcn.18003e2f0
test al, al
je 0x18008294f
mov r10, qword [rsp + 0x38]
lea rax, [r10 - 0x10000]
cmp rax, rbp
ja 0x18008294f
mov eax, dword [0x18002f930]
mov r8, rsi
mov dword [rsp + 0x60], eax
movabs r9, 0x4ec4ec4ec4ec4ec5
movzx eax, word [0x18002f934]
mov word [rsp + 0x64], ax
nop dword [rax]
nop dword [rax + rax]
mov rax, r9
mul r8
shr rdx, 4
movsx eax, dl
imul edx, eax, 0x34
movzx eax, r8b
sub al, dl
add al, 0x31
xor byte [rsp + r8 + 0x60], al
inc r8
cmp r8, 6
jb 0x180082910
lea r8, [rsp + 0x60]
movabs rdx, 0x11837e716e5fd5ec
mov rcx, r10
call fcn.18003e550
jmp 0x1800829ba
mov eax, dword [0x18002f938]
mov r8, rsi
mov dword [rsp + 0x60], eax
movabs r9, 0x4ec4ec4ec4ec4ec5
movzx eax, word [0x18002f93c]
mov word [rsp + 0x64], ax
nop dword [rax]
nop word [rax + rax]
mov rax, r9
mul r8
shr rdx, 4
movsx eax, dl
imul ecx, eax, 0x34
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x60], al
inc r8
cmp r8, 6
jb 0x180082980
lea rdx, [rsp + 0x60]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18003e740
mov qword [0x180147730], rax
mov r8, rax
mov qword [rsp + 0x30], r8
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rsp + 0x38], rdi
mov rcx, rbx
mov qword [rsp + 0x40], rsi
call fcn.18003e820
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rdx, rcx
mov rcx, qword [0x1801474f0]
jmp 0x180082860

Function at 0x180082bd0
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [0x1801474e0], ecx
setge cl
jmp 0x180082a10
Function at 0x140008594
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbp, rdx
mov rdi, rcx
mov eax, 0xfeff
mov word [rsp + 0x60], ax
lea rdx, [0x140157588]
mov rcx, qword [rcx]
call fcn.14011cecc
mov rsi, rax
test rax, rax
jne 0x140008602
mov rcx, qword [rdi]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x1401a8050]
je 0x1400085fe
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x1400085fe
mov rcx, qword [rdi]
sub rcx, 0xc
call fcn.14011be18
xor eax, eax
jmp 0x140008679
mov r9, rax
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x60]
call fcn.14011ccec
mov r11, qword [rbp]
movsxd rdx, dword [r11 - 8]
mov rbx, rdx
lea edx, [rdx + rdx + 1]
mov rcx, rbp
call fcn.140002cfc
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov edx, 2
call fcn.14011ccec
mov rcx, rsi
call fcn.14011cad8
nop
mov rax, qword [rdi]
add rax, 0xfffffffffffffff4
cmp rax, qword [0x1401a8050]
je 0x140008674
or ecx, 0xffffffff
lock xadd dword [rax], ecx
dec ecx
test ecx, ecx
jg 0x140008674
mov rcx, qword [rdi]
sub rcx, 0xc
call fcn.14011be18
mov eax, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014654
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1401aeec0]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
mov byte [rsp + 0x40], 0x4b
mov byte [rsp + 0x41], 0x65
mov byte [rsp + 0x42], 0x72
mov byte [rsp + 0x43], 0x6e
mov byte [rsp + 0x44], 0x65
mov byte [rsp + 0x45], 0x6c
mov byte [rsp + 0x46], 0x33
mov byte [rsp + 0x47], 0x32
mov byte [rsp + 0x48], 0x2e
mov byte [rsp + 0x49], 0x64
mov byte [rsp + 0x4a], 0x6c
mov byte [rsp + 0x4b], 0x6c
mov byte [rsp + 0x4c], 0
call fcn.140003880
mov rcx, qword [rax]
call qword [0x140155838]
mov rbx, rax
mov rax, qword [rsp + 0x38]
add rax, 0xfffffffffffffff4
cmp rax, qword [0x1401a8050]
je 0x1400146f2
or ecx, 0xffffffff
lock xadd dword [rax], ecx
dec ecx
test ecx, ecx
jg 0x1400146f2
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff4
call fcn.14011be18
test rbx, rbx
je 0x140014771
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov byte [rsp + 0x50], 0x49
mov byte [rsp + 0x51], 0x73
mov byte [rsp + 0x52], 0x44
mov byte [rsp + 0x53], 0x65
mov byte [rsp + 0x54], 0x62
mov byte [rsp + 0x55], 0x75
mov byte [rsp + 0x56], 0x67
mov byte [rsp + 0x57], 0x67
mov byte [rsp + 0x58], 0x65
mov byte [rsp + 0x59], 0x72
mov byte [rsp + 0x5a], 0x50
mov byte [rsp + 0x5b], 0x72
mov byte [rsp + 0x5c], 0x65
mov byte [rsp + 0x5d], 0x73
mov byte [rsp + 0x5e], 0x65
mov byte [rsp + 0x5f], 0x6e
mov byte [rsp + 0x60], 0x74
mov byte [rsp + 0x61], 0
call qword [0x1401557e8]
test rax, rax
je 0x140014771
call rax
test eax, eax
je 0x140014771
mov eax, 1
jmp 0x1400147cc
and dword [rsp + 0x30], 0
lea rcx, str.ntdll.dll
call qword [0x140155838]
test rax, rax
je 0x1400147ca
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [0x1401557e8]
mov rbx, rax
test rax, rax
je 0x1400147ca
call qword [0x140155770]
and qword [rsp + 0x20], 0
mov r9d, 4
lea edx, [r9 + 3]
lea r8, [rsp + 0x30]
mov rcx, rax
call rbx
test eax, eax
jne 0x1400147ca
cmp dword [rsp + 0x30], eax
jne 0x14001476a
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14011b6f0
add rsp, 0x70
pop rbx
ret
Function at 0x14003d560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1401aeec0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [0x1401a8058]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x40], 0x77
mov byte [rsp + 0x41], 0x69
mov byte [rsp + 0x42], 0x6e
mov byte [rsp + 0x43], 0x64
mov byte [rsp + 0x44], 0x6f
mov byte [rsp + 0x45], 0x77
mov byte [rsp + 0x46], 0x73
mov byte [rsp + 0x47], 0x64
mov byte [rsp + 0x48], 0x65
mov byte [rsp + 0x49], 0x66
mov byte [rsp + 0x4a], 0x65
mov byte [rsp + 0x4b], 0x6e
mov byte [rsp + 0x4c], 0x64
mov byte [rsp + 0x4d], 0x65
mov byte [rsp + 0x4e], 0x72
mov byte [rsp + 0x4f], 0x3a
mov byte [rsp + 0x50], 0x2f
mov byte [rsp + 0x51], 0x2f
mov byte [rsp + 0x52], 0x73
mov byte [rsp + 0x53], 0x65
mov byte [rsp + 0x54], 0x74
mov byte [rsp + 0x55], 0x74
mov byte [rsp + 0x56], 0x69
mov byte [rsp + 0x57], 0x6e
mov byte [rsp + 0x58], 0x67
mov byte [rsp + 0x59], 0x73
mov byte [rsp + 0x5a], 0x2f
mov byte [rsp + 0x5b], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1400039c8
call qword [0x140155e10]
mov rcx, rax
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
mov rbx, qword [rsp + 0x30]
mov r9, rbx
lea r8, [0x140158440]
lea rdx, str.open
call qword [0x1401559b0]
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x1401a8050]
je 0x14003d678
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x14003d678
call fcn.14011be18
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14011b6f0
add rsp, 0x70
pop rbx
ret
Function at 0x14003dc90
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x1401aeec0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbp, r8
mov r15, rdx
mov qword [rsp + 0x30], rdx
mov r12, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x40], r8
mov rdi, qword [r8]
cmp dword [rdi - 0xc], 0
jl 0x14003dcf1
mov qword [rsp + 0x20], rdi
lock add dword [rdi - 0xc], 1
jmp 0x14003dd1e
mov rax, qword [0x1401a8058]
mov qword [rsp + 0x20], rax
test rdi, rdi
jne 0x14003dd06
xor eax, eax
jmp 0x14003dd0f
mov rcx, rdi
call qword [0x140155830]
mov r8, rdi
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.1400035cc
lea rdx, [0x14015bf48]
mov rcx, qword [r12]
call fcn.14011cecc
mov r14, rax
xor r13d, r13d
mov rbx, qword [rsp + 0x20]
test rax, rax
je 0x14003de7c
mov ecx, 0x155cc0
call fcn.14011ba54
mov rsi, rax
mov qword [rsp + 0x28], rax
mov r9, r14
lea edx, [r13 + 1]
mov r8d, 0xff
lea rcx, [rsp + 0x50]
call fcn.14011de54
mov byte [rsi], 0xd
mov byte [rsi + 1], 0xa
add rsi, 2
test eax, eax
je 0x14003ddde
xor edi, edi
movsxd r15, eax
test eax, eax
jle 0x14003ddb2
test r13d, r13d
je 0x14003dd8e
mov byte [rsi], 0x2c
inc rsi
movzx r8d, byte [rsp + rdi + 0x50]
lea rdx, str.0x_02x
mov rcx, rsi
call fcn.14011da9c
add rsi, 4
inc r13d
inc rdi
cmp rdi, r15
jl 0x14003dd83
mov byte [rsi], 0xd
mov byte [rsi + 1], 0xa
add rsi, 2
mov r9, r14
mov edx, 1
mov r8d, 0xff
lea rcx, [rsp + 0x50]
call fcn.14011de54
test eax, eax
jne 0x14003dd7a
mov r15, qword [rsp + 0x30]
mov byte [rsi], 0x7d
mov byte [rsi + 1], 0xd
mov byte [rsi + 2], 0xa
mov byte [rsi + 3], 0x3b
add rsi, 4
lea rdx, [0x140157588]
mov rcx, rbx
call fcn.14011cecc
mov r14, rax
test rax, rax
je 0x14003de7c
mov r9, rax
mov edx, 1
lea r8d, [rdx + 5]
lea rcx, str.UCHAR
call fcn.14011ccec
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r15
repne scasb al, byte [rdi]
not rcx
lea edi, [rax + 1]
sub rcx, rdi
mov r8, rcx
mov r9, r14
mov rdx, rdi
mov rcx, r15
call fcn.14011ccec
mov r9, r14
lea r8d, [rdi + 3]
mov rdx, rdi
lea rcx, [0x14015bf30]
call fcn.14011ccec
mov rax, qword [rsp + 0x28]
sub rsi, rax
mov r9, r14
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.14011ccec
mov rcx, r14
call fcn.14011cad8
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x1401a8050]
je 0x14003de9c
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x14003de9c
call fcn.14011be18
nop
mov rcx, qword [r12]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x1401a8050]
je 0x14003dec8
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x14003dec8
mov rcx, qword [r12]
sub rcx, 0xc
call fcn.14011be18
nop
mov rax, qword [rbp]
add rax, 0xfffffffffffffff4
cmp rax, qword [0x1401a8050]
je 0x14003def3
or ecx, 0xffffffff
lock xadd dword [rax], ecx
dec ecx
test ecx, ecx
jg 0x14003def3
mov rcx, qword [rbp]
sub rcx, 0xc
call fcn.14011be18
mov eax, r13d
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14011b6f0
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140083314
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 0x6b838]
mov rbx, rcx
test r9, r9
jne 0x140083332
or eax, 0xffffffff
jmp 0x140083351
mov edx, 1
mov r8d, 0x6b800
add rcx, 0x20
call fcn.14011de54
mov dword [rbx + 0x10], eax
test eax, eax
je 0x14008332d
movzx eax, byte [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14008335c
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9, qword [rcx + 0x6b840]
mov rbx, rcx
test r9, r9
jne 0x140083376
or eax, 0xffffffff
jmp 0x140083399
mov eax, dword [rcx + 0x18]
mov edx, 1
add eax, dword [rcx + 0xc]
sub eax, ecx
add rcx, 0x20
sub eax, 0x20
movsxd r8, eax
call fcn.14011ccec
mov dword [rbx + 0x10], 0x6b800
add rsp, 0x20
pop rbx
ret
Function at 0x1400a8b4c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbp, rdx
mov rdi, rcx
mov eax, 0xfeff
mov word [rsp + 0x60], ax
lea rdx, [0x140157588]
mov rcx, qword [rcx]
call fcn.14011cecc
mov rsi, rax
test rax, rax
jne 0x1400a8bba
mov rcx, qword [rdi]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x1401a8050]
je 0x1400a8bb6
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x1400a8bb6
mov rcx, qword [rdi]
sub rcx, 0xc
call fcn.14011be18
xor eax, eax
jmp 0x1400a8c31
mov r9, rax
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x60]
call fcn.14011ccec
mov r11, qword [rbp]
movsxd rdx, dword [r11 - 8]
mov rbx, rdx
lea edx, [rdx + rdx + 1]
mov rcx, rbp
call fcn.140002cfc
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov edx, 2
call fcn.14011ccec
mov rcx, rsi
call fcn.14011cad8
nop
mov rax, qword [rdi]
add rax, 0xfffffffffffffff4
cmp rax, qword [0x1401a8050]
je 0x1400a8c2c
or ecx, 0xffffffff
lock xadd dword [rax], ecx
dec ecx
test ecx, ecx
jg 0x1400a8c2c
mov rcx, qword [rdi]
sub rcx, 0xc
call fcn.14011be18
mov eax, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a8f14
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov r13, rdx
mov rsi, rcx
lea rdx, [0x14015bf48]
mov rcx, qword [rcx]
call fcn.14011cecc
mov rbx, rax
xor r14d, r14d
cmp rax, r14
jne 0x1400a8f89
mov rcx, qword [rsi]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x1401a8050]
je 0x1400a8f82
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx], eax
add eax, edi
cmp eax, r14d
jg 0x1400a8f82
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.14011be18
xor eax, eax
jmp 0x1400a915b
mov word [rsp + 0x80], r14w
mov r9, rax
mov r15d, 1
mov r8, r15
lea edi, [r15 + 1]
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.14011de54
mov rcx, rbx
call fcn.14011cad8
mov eax, r14d
mov ebx, 0xfeff
cmp word [rsp + 0x80], bx
cmove eax, r15d
mov dword [0x1401bb3a4], eax
lea rdx, [0x14015bf48]
mov rcx, qword [rsi]
call fcn.14011cecc
mov r12, rax
cmp dword [0x1401bb3a4], r14d
je 0x1400a9005
mov r9, rax
mov r8, r15
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.14011de54
mov edi, 0x8000
mov edx, edi
mov rcx, r13
call fcn.140002cfc
mov r11, qword [0x1401a8058]
mov qword [rsp + 0x88], r11
lea edx, [rdi + 4]
lea rcx, [rsp + 0x88]
call fcn.140002cfc
mov rbp, rax
mov byte [rax], r14b
mov r9, r12
mov r8, rdi
mov rdx, r15
mov rcx, rax
call fcn.14011de54
or edi, 0xffffffff
cmp eax, r14d
je 0x1400a90fe
cmp word [rsp + 0x80], bx
jne 0x1400a9083
cdqe
mov byte [rax + rbp], r14b
mov byte [rax + rbp + 1], r14b
mov rcx, rbp
call qword [0x140155830]
mov r8, rbp
mov edx, eax
mov rcx, r13
call fcn.1400026b8
jmp 0x1400a90dd
cdqe
mov byte [rax + rbp], r14b
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.140003880
nop
mov rbx, qword [rsp + 0x20]
mov r8, rbx
mov edx, dword [rbx - 8]
mov rcx, r13
call fcn.1400026b8
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x1401a8050]
je 0x1400a90d1
mov eax, edi
lock xadd dword [rcx], eax
add eax, edi
cmp eax, r14d
jg 0x1400a90d8
call fcn.14011be18
mov ebx, 0xfeff
jmp 0x1400a90dd
mov ebx, 0xfeff
jmp 0x1400a90dd
mov ebx, 0xfeff
mov byte [rbp], r14b
mov r9, r12
mov r8d, 0x8000
mov rdx, r15
mov rcx, rbp
call fcn.14011de54
cmp eax, r14d
jne 0x1400a9056
mov rcx, r12
call fcn.14011cad8
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x1401a8050]
je 0x1400a912f
mov eax, edi
lock xadd dword [rcx], eax
add eax, edi
cmp eax, r14d
jg 0x1400a912f
call fcn.14011be18
nop
mov rax, qword [rsi]
add rax, 0xfffffffffffffff4
cmp rax, qword [0x1401a8050]
je 0x1400a9158
mov ecx, edi
lock xadd dword [rax], ecx
add ecx, edi
cmp ecx, r14d
jg 0x1400a9158
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.14011be18
mov eax, r15d
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a91a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1401aeec0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
and dword [rsp + 0x20], 0
mov rax, qword [0x1401a8058]
mov qword [rcx], rax
mov dword [rsp + 0x20], 1
mov byte [rsp + 0x38], 0x68
mov byte [rsp + 0x39], 0x74
mov byte [rsp + 0x3a], 0x74
mov byte [rsp + 0x3b], 0x70
mov byte [rsp + 0x3c], 0x3a
mov byte [rsp + 0x3d], 0x2f
mov byte [rsp + 0x3e], 0x2f
mov byte [rsp + 0x3f], 0x77
mov byte [rsp + 0x40], 0x77
mov byte [rsp + 0x41], 0x77
mov byte [rsp + 0x42], 0x2e
mov byte [rsp + 0x43], 0x73
mov byte [rsp + 0x44], 0x75
mov byte [rsp + 0x45], 0x72
mov byte [rsp + 0x46], 0x66
mov byte [rsp + 0x47], 0x6f
mov byte [rsp + 0x48], 0x6b
mov byte [rsp + 0x49], 0x2e
mov byte [rsp + 0x4a], 0x64
mov byte [rsp + 0x4b], 0x65
mov byte [rsp + 0x4c], 0x2f
mov byte [rsp + 0x4d], 0
lea rdx, [rsp + 0x38]
call fcn.1400039c8
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14011b6f0
add rsp, 0x60
pop rbx
ret
Function at 0x1400f3324
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1401aeec0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [0x1401a8058]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x48], 0x2f
mov byte [rsp + 0x49], 0x6e
mov byte [rsp + 0x4a], 0x61
mov byte [rsp + 0x4b], 0x6d
mov byte [rsp + 0x4c], 0x65
mov byte [rsp + 0x4d], 0x20
mov byte [rsp + 0x4e], 0x4d
mov byte [rsp + 0x4f], 0x69
mov byte [rsp + 0x50], 0x63
mov byte [rsp + 0x51], 0x72
mov byte [rsp + 0x52], 0x6f
mov byte [rsp + 0x53], 0x73
mov byte [rsp + 0x54], 0x6f
mov byte [rsp + 0x55], 0x66
mov byte [rsp + 0x56], 0x74
mov byte [rsp + 0x57], 0x2e
mov byte [rsp + 0x58], 0x53
mov byte [rsp + 0x59], 0x63
mov byte [rsp + 0x5a], 0x61
mov byte [rsp + 0x5b], 0x6e
mov byte [rsp + 0x5c], 0x6e
mov byte [rsp + 0x5d], 0x65
mov byte [rsp + 0x5e], 0x72
mov byte [rsp + 0x5f], 0x73
mov byte [rsp + 0x60], 0x41
mov byte [rsp + 0x61], 0x6e
mov byte [rsp + 0x62], 0x64
mov byte [rsp + 0x63], 0x43
mov byte [rsp + 0x64], 0x61
mov byte [rsp + 0x65], 0x6d
mov byte [rsp + 0x66], 0x65
mov byte [rsp + 0x67], 0x72
mov byte [rsp + 0x68], 0x61
mov byte [rsp + 0x69], 0x73
mov byte [rsp + 0x6a], 0
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.1400039c8
lea rdx, str.control
lea rcx, [rsp + 0x38]
call fcn.140003880
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
mov r8, qword [rax]
lea rdx, str.open
xor ecx, ecx
call qword [0x1401559b0]
mov r11, qword [rsp + 0x38]
add r11, 0xfffffffffffffff4
cmp r11, qword [0x1401a8050]
je 0x1400f3472
or eax, 0xffffffff
lock xadd dword [r11], eax
dec eax
test eax, eax
jg 0x1400f3472
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff4
call fcn.14011be18
nop
mov rcx, qword [rsp + 0x30]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x1401a8050]
je 0x1400f3496
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x1400f3496
call fcn.14011be18
movabs rax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14011b6f0
add rsp, 0x88
ret
Function at 0x1400f34b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1401aeec0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [0x1401a8058]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x48], 0x2f
mov byte [rsp + 0x49], 0x6e
mov byte [rsp + 0x4a], 0x61
mov byte [rsp + 0x4b], 0x6d
mov byte [rsp + 0x4c], 0x65
mov byte [rsp + 0x4d], 0x20
mov byte [rsp + 0x4e], 0x4d
mov byte [rsp + 0x4f], 0x69
mov byte [rsp + 0x50], 0x63
mov byte [rsp + 0x51], 0x72
mov byte [rsp + 0x52], 0x6f
mov byte [rsp + 0x53], 0x73
mov byte [rsp + 0x54], 0x6f
mov byte [rsp + 0x55], 0x66
mov byte [rsp + 0x56], 0x74
mov byte [rsp + 0x57], 0x2e
mov byte [rsp + 0x58], 0x44
mov byte [rsp + 0x59], 0x65
mov byte [rsp + 0x5a], 0x76
mov byte [rsp + 0x5b], 0x69
mov byte [rsp + 0x5c], 0x63
mov byte [rsp + 0x5d], 0x65
mov byte [rsp + 0x5e], 0x73
mov byte [rsp + 0x5f], 0x41
mov byte [rsp + 0x60], 0x6e
mov byte [rsp + 0x61], 0x64
mov byte [rsp + 0x62], 0x50
mov byte [rsp + 0x63], 0x72
mov byte [rsp + 0x64], 0x69
mov byte [rsp + 0x65], 0x6e
mov byte [rsp + 0x66], 0x74
mov byte [rsp + 0x67], 0x65
mov byte [rsp + 0x68], 0x72
mov byte [rsp + 0x69], 0x73
mov byte [rsp + 0x6a], 0
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.1400039c8
lea rdx, str.control
lea rcx, [rsp + 0x38]
call fcn.140003880
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
mov r8, qword [rax]
lea rdx, str.open
xor ecx, ecx
call qword [0x1401559b0]
mov r11, qword [rsp + 0x38]
add r11, 0xfffffffffffffff4
cmp r11, qword [0x1401a8050]
je 0x1400f3606
or eax, 0xffffffff
lock xadd dword [r11], eax
dec eax
test eax, eax
jg 0x1400f3606
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff4
call fcn.14011be18
nop
mov rcx, qword [rsp + 0x30]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x1401a8050]
je 0x1400f362a
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x1400f362a
call fcn.14011be18
movabs rax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14011b6f0
add rsp, 0x88
ret

Function at 0x1400f364c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1401aeec0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [0x1401a8058]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x40], 0x64
mov byte [rsp + 0x41], 0x65
mov byte [rsp + 0x42], 0x76
mov byte [rsp + 0x43], 0x6d
mov byte [rsp + 0x44], 0x67
mov byte [rsp + 0x45], 0x6d
mov byte [rsp + 0x46], 0x74
mov byte [rsp + 0x47], 0x2e
mov byte [rsp + 0x48], 0x6d
mov byte [rsp + 0x49], 0x73
mov byte [rsp + 0x4a], 0x63
mov byte [rsp + 0x4b], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1400039c8
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
mov r8, rbx
lea rdx, str.open
xor ecx, ecx
call qword [0x1401559b0]
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x1401a8050]
je 0x1400f3709
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x1400f3709
call fcn.14011be18
movabs rax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14011b6f0
add rsp, 0x60
pop rbx
ret