joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rsi, rcx
mov r13, qword [rbp + 0x68]
xor ebx, ebx
lea rdx, [0x140075378]
lea rcx, [rbp - 0x48]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001f097
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14001f10c
mov dword [rbp - 0x31], 0x63697672
mov dword [rbp - 0x36], 0x53797265
mov dword [rbp - 0x2c], 0x656a624f
mov dword [rbp - 0x22], 0x79746972
mov word [rbp - 0x24], 0x7563
mov word [rbp - 0x38], 0x7551
mov word [rbp - 0x27], 0x5374
mov byte [rbp - 0x25], 0x65
mov byte [rbp - 0x2d], 0x65
mov byte [rbp - 0x32], 0x65
mov byte [rbp - 0x1e], 0
mov byte [rbp - 0x28], 0x63
lea rdx, [rbp - 0x38]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x14001f104
mov qword [rsp + 0x20], r13
mov r9d, r12d
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14001f140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov word [rsp + 0x3d], 0x70
mov word [rsp + 0x38], 0x7373
mov dword [rsp + 0x31], 0x72507465
mov word [rsp + 0x35], 0x636f
mov byte [rsp + 0x30], 0x47
mov word [rsp + 0x3a], 0x6548
mov byte [rsp + 0x37], 0x65
mov byte [rsp + 0x3c], 0x61
lea rdx, [0x1400753f0]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025500
mov rbx, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001f1ce
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140025420
test rax, rax
je 0x14001f1e2
call rax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x50
pop rbx
ret
Function at 0x14001f200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15d, r9d
mov r14, r8
mov ebp, edx
mov rsi, rcx
mov r12, qword [rsp + 0xc8]
xor ebx, ebx
lea rdx, [0x140075378]
lea rcx, [rsp + 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001f279
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14001f2ef
mov word [rsp + 0x4f], 0x78
mov word [rsp + 0x41], 0x7075
mov dword [rsp + 0x46], 0x54657461
mov dword [rsp + 0x4a], 0x6e656b6f
mov word [rsp + 0x44], 0x6369
mov byte [rsp + 0x40], 0x44
mov byte [rsp + 0x43], 0x6c
mov byte [rsp + 0x4e], 0x45
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140025420
mov r10, rax
test rax, rax
je 0x14001f2e7
mov qword [rsp + 0x28], r12
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x20], eax
mov r9d, r15d
mov r8, r14
mov edx, ebp
mov rcx, rsi
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001f3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov dword [rbp - 0xd], 0x656d6954
mov word [rbp - 0x17], 0x6954
mov word [rbp - 0x1c], 0x7379
mov word [rbp - 0x1f], 0x7465
mov byte [rbp - 9], 0
mov word [rbp - 0x1a], 0x6574
mov dword [rbp - 0x13], 0x69467341
mov word [rbp - 0x15], 0x656d
mov byte [rbp - 0x18], 0x6d
mov byte [rbp - 0x20], 0x47
mov word [rbp - 0xf], 0x656c
mov byte [rbp - 0x1d], 0x53
lea rdx, [0x1400753f0]
lea rcx, [rbp - 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025500
mov rdi, rax
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001f499
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x14001f4af
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x14001f4e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r15d, r9d
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
mov r12, qword [rsp + 0xc0]
mov ebx, 1
lea rdx, [0x140075378]
lea rcx, [rsp + 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, ebx
jg 0x14001f55c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14001f5c1
mov dword [rsp + 0x43], 0x6e65704f
mov word [rsp + 0x4b], 0x5778
mov word [rsp + 0x40], 0x6552
mov word [rsp + 0x48], 0x7965
mov byte [rsp + 0x4a], 0x45
mov byte [rsp + 0x47], 0x4b
mov byte [rsp + 0x42], 0x67
mov byte [rsp + 0x4d], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x14001f5b9
mov qword [rsp + 0x20], r12
mov r9d, r15d
mov r8d, r14d
mov rdx, rbp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001f5f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15, r9
mov r14, r8
mov rbp, rdx
mov rsi, rcx
mov r12, qword [rsp + 0xd0]
mov r13, qword [rsp + 0xd8]
mov ebx, 1
lea rdx, [0x140075378]
lea rcx, [rsp + 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, ebx
jg 0x14001f676
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14001f6e3
mov dword [rsp + 0x41], 0x75516765
mov dword [rsp + 0x4d], 0x577845
mov byte [rsp + 0x40], 0x52
mov word [rsp + 0x48], 0x6156
mov word [rsp + 0x4b], 0x6575
mov word [rsp + 0x45], 0x7265
mov byte [rsp + 0x4a], 0x6c
mov byte [rsp + 0x47], 0x79
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x14001f6db
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r9, r15
mov r8, r14
mov rdx, rbp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001f710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r15, r9
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075358]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001f780
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14001f7e3
mov word [rsp + 0x34], 0x6e72
mov word [rsp + 0x3c], 0x6946
mov dword [rsp + 0x37], 0x61655274
mov dword [rsp + 0x30], 0x65746e49
mov byte [rsp + 0x3b], 0x64
mov word [rsp + 0x3f], 0x65
mov byte [rsp + 0x36], 0x65
mov byte [rsp + 0x3e], 0x6c
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x14001f7db
mov r9, r15
mov r8d, r14d
mov rdx, rbp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001f810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r15, r9
movzx r14d, r8w
mov rbp, rdx
mov rsi, rcx
mov r12, qword [rsp + 0xf0]
mov r13d, dword [rsp + 0xf8]
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x50], rax
xor ebx, ebx
lea rdx, [0x140075358]
lea rcx, [rsp + 0x48]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001f8b0
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14001f93b
mov word [rsp + 0x66], 0x7465
mov word [rsp + 0x60], 0x6e49
mov dword [rsp + 0x68], 0x6e6e6f43
mov word [rsp + 0x6f], 0x41
mov word [rsp + 0x63], 0x7265
mov word [rsp + 0x6c], 0x6365
mov byte [rsp + 0x65], 0x6e
mov byte [rsp + 0x62], 0x74
mov byte [rsp + 0x6e], 0x74
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x14001f933
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r12
mov r9, r15
movzx r8d, r14w
mov rdx, rbp
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400255d0
mov rax, rbx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001f970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r15, r9
mov r14, r8
mov rbp, rdx
mov rsi, rcx
mov r12, qword [rsp + 0xf0]
mov r13, qword [rsp + 0xf8]
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x50], rax
xor ebx, ebx
lea rdx, [0x140075358]
lea rcx, [rsp + 0x48]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001fa0f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14001fa86
mov word [rsp + 0x6a], 0x7571
mov dword [rsp + 0x62], 0x704f7074
mov word [rsp + 0x60], 0x7448
mov dword [rsp + 0x6d], 0x417473
mov dword [rsp + 0x66], 0x65526e65
mov byte [rsp + 0x6c], 0x65
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x14001fa7e
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r9, r15
mov r8, r14
mov rdx, rbp
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400255d0
mov rax, rbx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001fab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15, r9
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075358]
lea rcx, [rsp + 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001fb20
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14001fb92
mov word [rsp + 0x4b], 0x6575
mov dword [rsp + 0x47], 0x71655264
mov dword [rsp + 0x40], 0x70747448
mov word [rsp + 0x4e], 0x4174
mov word [rsp + 0x44], 0x6553
mov byte [rsp + 0x4d], 0x73
mov byte [rsp + 0x50], 0
mov byte [rsp + 0x46], 0x6e
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140025420
mov r10, rax
test rax, rax
je 0x14001fb8a
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x20], eax
mov r9, r15
mov r8d, r14d
mov rdx, rbp
mov rcx, rsi
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001fbc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r15, r9
mov r14, r8
mov ebp, edx
mov rsi, rcx
mov r12, qword [rsp + 0xc0]
xor ebx, ebx
lea rdx, [0x140075358]
lea rcx, [rsp + 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001fc39
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14001fc9f
mov word [rsp + 0x43], 0x5170
mov word [rsp + 0x48], 0x4979
mov word [rsp + 0x40], 0x7448
mov dword [rsp + 0x4a], 0x416f666e
mov byte [rsp + 0x4e], 0
mov word [rsp + 0x45], 0x6575
mov byte [rsp + 0x42], 0x74
mov byte [rsp + 0x47], 0x72
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x14001fc97
mov qword [rsp + 0x20], r12
mov r9, r15
mov r8, r14
mov edx, ebp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001fcd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, r9
mov r15, r8
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075358]
lea rcx, [rbp - 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001fd41
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14001fda9
mov dword [rbp - 0x16], 0x4f797265
mov word [rbp - 0x20], 0x6e49
mov word [rbp - 0xe], 0x416e
mov byte [rbp - 0xc], 0
mov word [rbp - 0x11], 0x6974
mov word [rbp - 0x18], 0x7551
mov dword [rbp - 0x1d], 0x656e7265
mov byte [rbp - 0xf], 0x6f
mov byte [rbp - 0x1e], 0x74
mov byte [rbp - 0x12], 0x70
mov byte [rbp - 0x19], 0x74
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x14001fda1
mov r9, r12
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001fdd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r15d, r9d
mov r14, r8
mov ebp, edx
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075358]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001fe3f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14001fea8
mov dword [rsp + 0x3f], 0x416e6f
mov word [rsp + 0x3b], 0x704f
mov dword [rsp + 0x31], 0x7265746e
mov word [rsp + 0x35], 0x656e
mov word [rsp + 0x38], 0x6553
mov byte [rsp + 0x30], 0x49
mov byte [rsp + 0x37], 0x74
mov word [rsp + 0x3d], 0x6974
mov byte [rsp + 0x3a], 0x74
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x14001fea0
mov r9d, r15d
mov r8, r14
mov edx, ebp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001fed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r15, r9
mov r14, r8
mov ebp, edx
mov rsi, rcx
mov r12d, dword [rsp + 0xc0]
xor ebx, ebx
lea rdx, [0x140075358]
lea rcx, [rsp + 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001ff49
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14001ffa5
mov dword [rsp + 0x46], 0x704f7465
mov word [rsp + 0x40], 0x6e49
mov word [rsp + 0x43], 0x7265
mov dword [rsp + 0x4a], 0x416e65
mov byte [rsp + 0x42], 0x74
mov byte [rsp + 0x45], 0x6e
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x14001ff9d
mov dword [rsp + 0x20], r12d
mov r9, r15
mov r8, r14
mov edx, ebp
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400255d0
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001ffd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075358]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14002003a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x140020097
mov word [rsp + 0x35], 0x656e
mov dword [rsp + 0x40], 0x656c64
mov dword [rsp + 0x30], 0x65746e49
mov dword [rsp + 0x37], 0x6f6c4374
mov word [rsp + 0x3e], 0x6e61
mov word [rsp + 0x3b], 0x6573
mov byte [rsp + 0x34], 0x72
mov byte [rsp + 0x3d], 0x48
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x14002008f
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400200c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075378]
lea rcx, [rbp - 0x40]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140020133
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x1400201a9
mov word [rbp - 0x21], 0x7443
mov dword [rbp - 0x1c], 0x6c646e61
mov dword [rbp - 0x29], 0x72655372
mov dword [rbp - 0x2e], 0x74736967
mov dword [rbp - 0x16], 0x417845
mov word [rbp - 0x24], 0x6369
mov word [rbp - 0x30], 0x6552
mov byte [rbp - 0x22], 0x65
mov word [rbp - 0x1e], 0x486c
mov word [rbp - 0x18], 0x7265
mov byte [rbp - 0x25], 0x76
mov byte [rbp - 0x1f], 0x72
mov byte [rbp - 0x2a], 0x65
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x1400201a1
mov r8, r15
mov rdx, r14
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400255d0
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400201e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075398]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14002024a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x1400202a8
mov word [rsp + 0x36], 0x656c
mov dword [rsp + 0x31], 0x46687461
mov word [rsp + 0x3c], 0x7374
mov word [rsp + 0x39], 0x6978
mov byte [rsp + 0x38], 0x45
mov word [rsp + 0x3e], 0x41
mov byte [rsp + 0x3b], 0x73
mov byte [rsp + 0x30], 0x50
mov byte [rsp + 0x35], 0x69
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x1400202a0
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400202d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r15d, r9d
mov r14, r8
mov rbp, rdx
mov rsi, rcx
mov r12, qword [rsp + 0xc0]
mov ebx, 1
lea rdx, [0x140075398]
lea rcx, [rsp + 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, ebx
jg 0x14002034c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x1400203b0
mov dword [rsp + 0x47], 0x4165756c
mov dword [rsp + 0x43], 0x61567465
mov word [rsp + 0x41], 0x5348
mov byte [rsp + 0x40], 0x53
mov byte [rsp + 0x4b], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140025420
mov r10, rax
test rax, rax
je 0x1400203a8
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9d, r15d
mov r8, r14
mov rdx, rbp
mov rcx, rsi
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret