joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400086c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov edi, edx
mov ebx, ecx
mov word [rbp - 0x24], 0x706c
mov dword [rbp - 0x2e], 0x65746165
mov word [rbp - 0x1d], 0x7370
mov dword [rbp - 0x21], 0x616e5332
mov word [rbp - 0x1a], 0x746f
mov dword [rbp - 0x28], 0x65686c6f
mov byte [rbp - 0x22], 0x33
mov byte [rbp - 0x18], 0
mov word [rbp - 0x30], 0x7243
mov word [rbp - 0x2a], 0x6f54
mov byte [rbp - 0x1b], 0x68
call fcn.14000c060
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008742
mov edx, edi
mov ecx, ebx
call rax
jmp 0x140008746
or rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140057700
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x140008770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x98
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov rax, qword [rbp + 0x87]
mov r13, qword [rbp + 0x7f]
mov rsi, rcx
mov qword [rbp - 0x41], rax
mov rax, qword [rbp + 0x8f]
lea rcx, [rbp - 0x31]
mov r12, r9
mov r15d, r8d
mov r14, rdx
mov qword [rbp - 0x39], rax
mov ebx, 1
mov dword [rbp - 0x2e], 0x33697061
mov dword [rbp - 0x28], 0x6c6c64
mov word [rbp - 0x30], 0x7664
mov word [rbp - 0x2a], 0x2e32
mov byte [rbp - 0x31], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000886e
lea rdx, [rbp - 0x21]
mov rcx, rax
mov dword [rbp - 0x16], 0x41784579
mov dword [rbp - 0x1f], 0x65724367
mov word [rbp - 0x1b], 0x7461
mov word [rbp - 0x21], 0x6552
mov word [rbp - 0x18], 0x654b
mov byte [rbp - 0x12], 0
mov byte [rbp - 0x19], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140008865
mov rax, qword [rbp - 0x39]
mov r9, r12
mov r8d, r15d
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x41]
mov rdx, r14
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0x77]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x6f]
mov rcx, rsi
mov dword [rsp + 0x20], eax
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.140057700
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140009a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x3b], 0x6d654d73
mov dword [rsp + 0x33], 0x72506574
mov word [rsp + 0x38], 0x6563
mov dword [rsp + 0x3f], 0x79726f
mov byte [rsp + 0x37], 0x6f
mov byte [rsp + 0x3a], 0x73
mov word [rsp + 0x30], 0x7257
mov byte [rsp + 0x32], 0x69
call fcn.14000c060
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140009a8e
mov r9, rbp
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], r14
call rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140057700
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140009d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x20], 0x42746547
mov dword [rsp + 0x28], 0x70795479
mov word [rsp + 0x2d], 0x41
mov dword [rsp + 0x24], 0x72616e69
mov byte [rsp + 0x2c], 0x65
call fcn.14000c060
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140009d63
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140057700
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000a500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xb8
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x87]
mov r13, qword [rbp + 0x6f]
mov rsi, rcx
mov qword [rbp - 0x49], rax
mov rax, qword [rbp + 0x8f]
lea rcx, [rbp - 0x31]
mov qword [rbp - 0x51], rax
mov rax, qword [rbp + 0x97]
mov r12, r9
mov qword [rbp - 0x41], rax
mov rax, qword [rbp + 0x9f]
mov r15, r8
mov r14, rdx
xor ebx, ebx
mov dword [rbp - 0x2e], 0x33697061
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x28], 0x6c6c64
mov word [rbp - 0x30], 0x7664
mov word [rbp - 0x2a], 0x2e32
mov byte [rbp - 0x31], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000a632
lea rdx, [rbp - 0x21]
mov rcx, rax
mov dword [rbp - 0x10], 0x417265
mov dword [rbp - 0x1b], 0x636f7250
mov dword [rbp - 0x21], 0x61657243
mov word [rbp - 0x13], 0x5573
mov word [rbp - 0x16], 0x7373
mov byte [rbp - 0x14], 0x41
mov word [rbp - 0x1d], 0x6574
mov byte [rbp - 0x11], 0x73
mov byte [rbp - 0x17], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000a629
mov rax, qword [rbp - 0x39]
mov r9, r12
mov r8, r15
mov qword [rsp + 0x50], rax
mov rax, qword [rbp - 0x41]
mov rdx, r14
mov qword [rsp + 0x48], rax
mov rax, qword [rbp - 0x51]
mov rcx, rsi
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x49]
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0x7f]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x77]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.140057700
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000b900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x40]
mov r12, r9
mov r15, r8
mov r14, rdx
xor ebx, ebx
mov dword [rbp - 0x3d], 0x33697061
mov dword [rbp - 0x37], 0x6c6c64
mov word [rbp - 0x3f], 0x7664
mov word [rbp - 0x39], 0x2e32
mov byte [rbp - 0x40], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000b9c1
lea rdx, [rbp - 0x30]
mov rcx, rax
mov dword [rbp - 0x2b], 0x69727563
mov word [rbp - 0x19], 0x6c63
mov dword [rbp - 0x30], 0x53746547
mov dword [rbp - 0x23], 0x69726373
mov dword [rbp - 0x27], 0x65447974
mov dword [rbp - 0x1e], 0x44726f74
mov byte [rbp - 0x2c], 0x65
mov byte [rbp - 0x17], bl
mov byte [rbp - 0x1a], 0x61
mov byte [rbp - 0x1f], 0x70
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000b9b8
mov r9, r12
mov r8, r15
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140057700
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14000c060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x21], 0x656e7265
mov word [rsp + 0x28], 0x642e
mov word [rsp + 0x25], 0x336c
mov word [rsp + 0x2a], 0x6c6c
mov byte [rsp + 0x27], 0x32
mov byte [rsp + 0x20], 0x4b
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140057700
add rsp, 0x48
ret

Function at 0x14000c0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
mov r15d, r8d
mov r14, rdx
xor ebx, ebx
mov dword [rbp - 0x2d], 0x33697061
mov dword [rbp - 0x27], 0x6c6c64
mov word [rbp - 0x2f], 0x7664
mov word [rbp - 0x29], 0x2e32
mov byte [rbp - 0x30], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000c16a
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x1f], 0x6570
mov word [rbp - 0x1c], 0x6553
mov dword [rbp - 0x19], 0x65636976
mov byte [rbp - 0x1a], 0x72
mov word [rbp - 0x15], 0x41
mov byte [rbp - 0x20], 0x4f
mov byte [rbp - 0x1d], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000c161
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140057700
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d5f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x3d], 0x79726f6d
mov dword [rsp + 0x35], 0x65636f72
mov dword [rsp + 0x31], 0x50646165
mov dword [rsp + 0x39], 0x654d7373
mov byte [rsp + 0x41], 0
mov byte [rsp + 0x30], 0x52
call fcn.14000c060
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d673
mov r9, rbp
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], r14
call rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140057700
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000e3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
mov rbx, rcx
mov dword [rbp - 0x18], 0x6d695465
mov dword [rbp - 0x1f], 0x6c61636f
mov word [rbp - 0xe], 0x5465
mov dword [rbp - 0xc], 0x656d69
mov word [rbp - 0x11], 0x6946
mov byte [rbp - 0x20], 0x4c
mov word [rbp - 0x14], 0x5465
mov word [rbp - 0x1a], 0x6c69
mov byte [rbp - 0x1b], 0x46
mov byte [rbp - 0xf], 0x6c
mov byte [rbp - 0x12], 0x6f
call fcn.14000c060
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e472
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140057700
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x14000e790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x11], rdx
xor ebx, ebx
mov dword [rbp - 0x25], ebx
call fcn.140023360
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x14000e7f0
mov ecx, 0x80004005
call fcn.140022950
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov dword [rbp - 0x25], 1
mov qword [rbp - 0x21], rbx
mov dword [rbp - 1], ebx
xor eax, eax
mov qword [rbp + 3], rax
mov dword [rbp + 0xb], eax
mov dword [rbp + 0x11], 0x336c6c65
mov dword [rbp + 0x17], 0x6c6c64
mov word [rbp + 0xf], 0x6873
mov word [rbp + 0x15], 0x2e32
lea rcx, [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14000e8f7
mov edx, 0x2bf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140185dc8], rax
test rax, rax
je 0x14000e867
lea rdx, [rbp - 1]
mov rcx, qword [rsi]
call rax
mov word [rbp + 0x26], 0x776f
mov dword [rbp + 0x29], 0x646c6f46
mov dword [rbp + 0x21], 0x4b746547
mov word [rbp + 0x2d], 0x7265
mov dword [rbp + 0x30], 0x687461
mov word [rbp + 0x1f], 0x4853
mov byte [rbp + 0x25], 0x6e
mov byte [rbp + 0x28], 0x6e
mov byte [rbp + 0x2f], 0x50
lea rdx, [rbp + 0x1f]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140185dd0], rax
test rax, rax
je 0x14000e8ed
lea r9, [rbp - 0x21]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 1]
call rax
test eax, eax
jne 0x14000e8ed
mov r8, qword [rbp - 0x21]
test r8, r8
je 0x14000e8ed
mov word [rbp - 0x29], 0x7325
mov byte [rbp - 0x27], al
lea rdx, [rbp - 0x29]
mov rcx, rdi
call fcn.140022e80
mov rcx, qword [rbp - 0x21]
call fcn.140011de0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000e90f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140057700
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rdx
mov r14, rcx
call fcn.140023360
mov rcx, rax
xor edx, edx
test rax, rax
setne dl
test edx, edx
jne 0x14000f755
mov ecx, 0x80004005
call fcn.140022950
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x19], rbx
mov dword [rbp + 0x31], 0x656c676f
mov dword [rbp + 0x39], 0x656d6f
mov dword [rbp + 0x35], 0x72684320
mov word [rbp + 0x2f], 0x6f47
mov dword [rbp + 0x27], 0x6f726843
mov word [rbp + 0x2c], 0x65
mov byte [rbp + 0x2b], 0x6d
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 7]
call fcn.140021120
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14012afa0
movzx edi, al
test al, al
jne 0x14000f8b4
lea rdx, [rbp + 0x2f]
lea rcx, [rbp - 0x11]
call fcn.140021120
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
mov r9, rsi
mov r8b, 1
xor edx, edx
mov rcx, rax
call fcn.14012afa0
movzx edi, al
test al, al
jne 0x14000f8b4
lea rdx, [rbp + 0x2f]
lea rcx, [rbp - 9]
call fcn.140021120
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
mov dl, 1
mov rcx, rax
call fcn.14012afa0
movzx edi, al
test al, al
jne 0x14000f8b4
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 1]
call fcn.140021120
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14012afa0
movzx edi, al
test al, al
jne 0x14000f8b4
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 0xf]
call fcn.140021120
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
mov r9, rsi
mov r8b, 1
xor edx, edx
mov rcx, rax
call fcn.14012afa0
movzx edi, al
test al, al
jne 0x14000f8b4
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 0x1f]
call fcn.140021120
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
mov dl, 1
mov rcx, rax
call fcn.14012afa0
movzx edi, al
test al, al
jne 0x14000f8b4
mov rcx, rsi
call fcn.140001450
movzx edi, al
mov byte [r14], 1
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000f8cc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
movzx eax, dil
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140057700
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000fe30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x40]
mov r14d, edx
xor ebx, ebx
mov dword [rbp - 0x3d], 0x33697061
mov dword [rbp - 0x37], 0x6c6c64
mov word [rbp - 0x3f], 0x7664
mov word [rbp - 0x39], 0x2e32
mov byte [rbp - 0x40], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000fef8
lea rdx, [rbp - 0x30]
mov rcx, rax
mov dword [rbp - 0x17], 0x726f74
mov dword [rbp - 0x30], 0x74696e49
mov word [rbp - 0x2b], 0x6c61
mov dword [rbp - 0x28], 0x6553657a
mov word [rbp - 0x1e], 0x6544
mov word [rbp - 0x21], 0x7469
mov word [rbp - 0x24], 0x7563
mov dword [rbp - 0x1b], 0x70697263
mov byte [rbp - 0x22], 0x72
mov byte [rbp - 0x1f], 0x79
mov byte [rbp - 0x1c], 0x73
mov byte [rbp - 0x29], 0x69
mov byte [rbp - 0x2c], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000feef
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140057700
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140010270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, qword [rbp + 0x68]
mov rsi, rcx
lea rcx, [rbp - 0x38]
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov ebx, 0x80004005
mov dword [rbp - 0x38], 0x6c656853
mov word [rbp - 0x33], 0x3233
mov dword [rbp - 0x30], 0x6c6c64
mov byte [rbp - 0x34], 0x6c
mov byte [rbp - 0x31], 0x2e
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14001032c
lea rdx, [rbp - 0x28]
mov rcx, rax
mov dword [rbp - 0x27], 0x74654748
mov word [rbp - 0x1a], 0x4168
mov dword [rbp - 0x1f], 0x61507265
mov dword [rbp - 0x23], 0x646c6f46
mov byte [rbp - 0x1b], 0x74
mov byte [rbp - 0x28], 0x53
mov byte [rbp - 0x18], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140010323
mov r9d, r12d
mov r8, r15
mov edx, r14d
mov rcx, rsi
mov qword [rsp + 0x20], r13
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140057700
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140010370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edi, edx
mov rbx, rcx
mov dword [rsp + 0x2c], 0x6a624f65
mov dword [rsp + 0x30], 0x746365
mov word [rsp + 0x21], 0x6961
mov dword [rsp + 0x27], 0x676e6953
mov word [rsp + 0x24], 0x6f46
mov byte [rsp + 0x23], 0x74
mov byte [rsp + 0x26], 0x72
mov byte [rsp + 0x20], 0x57
mov byte [rsp + 0x2b], 0x6c
call fcn.14000c060
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400103e9
mov edx, edi
mov rcx, rbx
call rax
jmp 0x1400103ec
or eax, 0xffffffff
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140057700
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140010410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
xor ebx, ebx
mov dword [rbp - 0x28], 0x6c6c64
mov word [rbp - 0x2a], 0x2e69
mov word [rbp - 0x30], 0x6853
mov word [rbp - 0x2d], 0x6177
mov byte [rbp - 0x2b], 0x70
mov byte [rbp - 0x2e], 0x6c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400104b1
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x15], 0x41737473
mov word [rbp - 0x20], 0x6150
mov dword [rbp - 0x19], 0x69784565
mov dword [rbp - 0x1d], 0x6c694668
mov byte [rbp - 0x11], bl
mov byte [rbp - 0x1e], 0x74
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400104a8
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140057700
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x140010520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebp, r9d
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov word [rsp + 0x22], 0x7472
mov dword [rsp + 0x28], 0x636f6c6c
mov word [rsp + 0x25], 0x6c61
mov word [rsp + 0x20], 0x6956
mov byte [rsp + 0x27], 0x41
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x24], 0x75
call fcn.14000c060
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140010596
mov r9d, ebp
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140057700
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400105b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x21], 0x6f4d7465
mov dword [rsp + 0x2d], 0x656d614e
mov word [rsp + 0x31], 0x41
mov dword [rsp + 0x27], 0x6946656c
mov word [rsp + 0x25], 0x7564
mov word [rsp + 0x2b], 0x656c
mov byte [rsp + 0x20], 0x47
call fcn.14000c060
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140010625
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140057700
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140011200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, qword [rbp + 0x68]
mov rsi, rcx
lea rcx, [rbp - 0x38]
mov r12d, r9d
mov r15, r8
mov r14d, edx
xor ebx, ebx
mov dword [rbp - 0x35], 0x33697061
mov dword [rbp - 0x2f], 0x6c6c64
mov word [rbp - 0x37], 0x7664
mov word [rbp - 0x31], 0x2e32
mov byte [rbp - 0x38], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400112c8
lea rdx, [rbp - 0x28]
mov rcx, rax
mov word [rbp - 0x25], 0x6f54
mov word [rbp - 0x28], 0x6547
mov word [rbp - 0x1d], 0x726f
mov dword [rbp - 0x18], 0x6e6f69
mov dword [rbp - 0x23], 0x496e656b
mov word [rbp - 0x1a], 0x7461
mov byte [rbp - 0x1b], 0x6d
mov byte [rbp - 0x26], 0x74
mov word [rbp - 0x1f], 0x666e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400112bf
mov r9d, r12d
mov r8, r15
mov edx, r14d
mov rcx, rsi
mov qword [rsp + 0x20], r13
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140057700
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400113e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140176280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x40]
xor ebx, ebx
mov dword [rbp - 0x3d], 0x33697061
mov dword [rbp - 0x37], 0x6c6c64
mov word [rbp - 0x3f], 0x7664
mov word [rbp - 0x39], 0x2e32
mov byte [rbp - 0x40], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400114a4
lea rdx, [rbp - 0x30]
mov rcx, rax
mov word [rbp - 0x2a], 0x7265
mov word [rbp - 0x1d], 0x6170
mov dword [rbp - 0x22], 0x69446c72
mov dword [rbp - 0x1b], 0x65686374
mov byte [rbp - 0x1e], 0x73
mov word [rbp - 0x17], 0x4172
mov word [rbp - 0x27], 0x6369
mov dword [rbp - 0x2e], 0x53747261
mov word [rbp - 0x24], 0x7443
mov word [rbp - 0x30], 0x7453
mov byte [rbp - 0x25], 0x65
mov byte [rbp - 0x28], 0x76
mov byte [rbp - 0x15], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001149b
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140057700
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret