joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140086470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x22], 0x5f32
mov word [rsp + 0x25], 0x2e32
mov word [rsp + 0x20], 0x7357
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x24], 0x33
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x27], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1400864c9
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret

Function at 0x140087260
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0xa76], 0
mov rdi, r9
mov rsi, r8
movsxd r10, edx
mov rbx, rcx
je 0x14008731e
cmp qword [rcx + 0x270], 0
je 0x1400872d1
mov dl, 1
call fcn.140083940
mov r8, qword [rcx + 0x1d8]
mov edx, r10d
mov qword [rsp + 0x20], r8
mov r8, rsi
call qword [rcx + 0x270]
xor edx, edx
mov rcx, rbx
mov r8d, eax
call fcn.140083940
mov eax, r8d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov edx, r10d
test r10d, r10d
je 0x1400872e3
sub edx, 1
je 0x1400872e3
cmp edx, 1
jne 0x14008731e
mov r9, qword [rbx + 0x1d0]
lea rcx, [r10 + r10*2]
mov edx, 2
lea rax, [0x1400e0318]
add rcx, rax
lea r8d, [rdx - 1]
call fcn.1400551fc
mov r9, qword [rbx + 0x1d0]
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call fcn.1400551fc
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140087990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.140087a20
test rax, rax
je 0x1400879fa
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2a], 0x6f727245
mov rcx, rax
mov dword [rsp + 0x20], 0x47415357
mov dword [rsp + 0x26], 0x7473614c
mov word [rsp + 0x2e], 0x72
mov word [rsp + 0x24], 0x7465
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400879fa
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret

Function at 0x140087a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x22], 0x5f32
mov word [rsp + 0x25], 0x2e32
mov word [rsp + 0x20], 0x7357
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x24], 0x33
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x27], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140087a79
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret
Function at 0x140089500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x6c6c642e
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x20], 0x6e72654b
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret

Function at 0x140089560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
call fcn.140089cf0
test rax, rax
je 0x1400895ce
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x27], 0x74656b63
mov rcx, rax
mov dword [rsp + 0x21], 0x65736f6c
mov word [rsp + 0x25], 0x6f73
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x20], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400895ce
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x40
pop rbx
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x40
pop rbx
ret

Function at 0x1400895f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.140089cf0
test rax, rax
je 0x14008965a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2a], 0x6f727245
mov rcx, rax
mov dword [rsp + 0x20], 0x47415357
mov dword [rsp + 0x26], 0x7473614c
mov word [rsp + 0x2e], 0x72
mov word [rsp + 0x24], 0x7465
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14008965a
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret

Function at 0x140089680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x90]
mov rsi, r9
mov edi, r8d
mov rbx, rcx
call fcn.140089cf0
test rax, rax
je 0x1400896fc
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x73746567
mov rcx, rax
mov dword [rsp + 0x34], 0x6f6b636f
mov word [rsp + 0x38], 0x7470
mov byte [rsp + 0x3a], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400896fc
mov r9, rsi
mov qword [rsp + 0x20], rbp
mov r8d, edi
mov edx, 0xffff
mov rcx, rbx
call rax
jmp 0x140089701
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14004d9a0
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140089730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, ecx
call fcn.140089cf0
test rax, rax
je 0x1400897a0
lea rdx, [rsp + 0x20]
mov word [rsp + 0x28], 0x7473
mov rcx, rax
mov word [rsp + 0x2e], 0x72
mov dword [rsp + 0x21], 0x65534153
mov word [rsp + 0x2b], 0x7272
mov word [rsp + 0x26], 0x614c
mov byte [rsp + 0x20], 0x57
mov byte [rsp + 0x2d], 0x6f
mov byte [rsp + 0x25], 0x74
mov byte [rsp + 0x2a], 0x45
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400897a0
mov ecx, ebx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x40
pop rbx
ret

Function at 0x140089970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call fcn.140089cf0
test rax, rax
je 0x1400899d8
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x26], 0x6d616e6b
mov rcx, rax
mov dword [rsp + 0x20], 0x73746567
mov word [rsp + 0x24], 0x636f
mov word [rsp + 0x2a], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400899d8
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x1400899dd
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140089c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call fcn.140089cf0
test rax, rax
je 0x140089cc1
lea rdx, [rsp + 0x20]
mov word [rsp + 0x27], 0x616e
mov rcx, rax
mov word [rsp + 0x20], 0x6567
mov dword [rsp + 0x23], 0x72656570
mov byte [rsp + 0x22], 0x74
mov word [rsp + 0x2a], 0x65
mov byte [rsp + 0x29], 0x6d
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140089cc1
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x140089cc6
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140089cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x22], 0x5f32
mov word [rsp + 0x25], 0x2e32
mov word [rsp + 0x20], 0x7357
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x24], 0x33
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x27], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140089d49
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret
Function at 0x14008af80
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14008afb6
call fcn.1400a2f80
test al, al
jne 0x14008afb6
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14008b010
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x14008afd0
xor eax, eax
add rsp, 0x20
pop rbx
ret
sub rsp, 0x28
lea r9, [rcx + rdx]
mov r8, rcx
mov edx, 0x1505
cmp rcx, r9
jae 0x14008b001
movzx ecx, byte [r8]
call fcn.140095b30
imul rdx, rdx, 0x21
movsx rcx, al
inc r8
xor rdx, rcx
cmp r8, r9
jb 0x14008afe5
movzx eax, dl
add rsp, 0x28
ret

Function at 0x1400906e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x4c746547
mov dword [rsp + 0x26], 0x72724574
mov word [rsp + 0x2b], 0x72
mov word [rsp + 0x24], 0x7361
mov byte [rsp + 0x2a], 0x6f
call fcn.140090760
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140090742
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret
mov eax, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret

Function at 0x140090760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x6c6c642e
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x20], 0x6e72654b
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret

Function at 0x140093530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov word [rsp + 0x23], 0x6576
mov dword [rsp + 0x2c], 0x6365536c
mov word [rsp + 0x30], 0x6974
mov word [rsp + 0x33], 0x6e
mov word [rsp + 0x20], 0x654c
mov byte [rsp + 0x32], 0x6f
mov dword [rsp + 0x25], 0x74697243
mov word [rsp + 0x29], 0x6369
mov byte [rsp + 0x22], 0x61
mov byte [rsp + 0x2b], 0x61
call fcn.140093790
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400935a7
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x40
pop rbx
ret
Function at 0x1400935c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov dword [rbp - 0x1a], 0x456e6f69
mov dword [rbp - 0x24], 0x63697469
mov word [rbp - 0x2b], 0x6c61
mov dword [rbp - 0x30], 0x74696e49
mov word [rbp - 0x1f], 0x536c
mov word [rbp - 0x1c], 0x7463
mov word [rbp - 0x16], 0x78
mov dword [rbp - 0x29], 0x43657a69
mov byte [rbp - 0x1d], 0x65
mov byte [rbp - 0x25], 0x72
mov byte [rbp - 0x20], 0x61
mov byte [rbp - 0x2c], 0x69
call fcn.140093790
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140093644
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 1]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14004d9a0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x140093670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov word [rsp + 0x2a], 0x6369
mov dword [rsp + 0x20], 0x656c6544
mov dword [rsp + 0x32], 0x6e6f69
mov word [rsp + 0x27], 0x6972
mov dword [rsp + 0x2d], 0x6365536c
mov word [rsp + 0x24], 0x6574
mov byte [rsp + 0x31], 0x74
mov byte [rsp + 0x26], 0x43
mov byte [rsp + 0x2c], 0x61
mov byte [rsp + 0x29], 0x74
call fcn.140093790
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400936e6
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x40
pop rbx
ret

Function at 0x140093700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov dword [rsp + 0x22], 0x43726574
mov dword [rsp + 0x2c], 0x6365536c
mov dword [rsp + 0x30], 0x6e6f6974
mov dword [rsp + 0x28], 0x61636974
mov word [rsp + 0x26], 0x6972
mov word [rsp + 0x20], 0x6e45
mov byte [rsp + 0x34], 0
call fcn.140093790
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140093768
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x40
pop rbx
ret

Function at 0x140093790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x6c6c642e
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x20], 0x6e72654b
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret
Function at 0x140093870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
call fcn.140093990
test rax, rax
je 0x1400938de
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x27], 0x74656b63
mov rcx, rax
mov dword [rsp + 0x21], 0x65736f6c
mov word [rsp + 0x25], 0x6f73
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x20], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400938de
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x40
pop rbx
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x40
pop rbx
ret

Function at 0x140093900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.140093990
test rax, rax
je 0x14009396a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2a], 0x6f727245
mov rcx, rax
mov dword [rsp + 0x20], 0x47415357
mov dword [rsp + 0x26], 0x7473614c
mov word [rsp + 0x2e], 0x72
mov word [rsp + 0x24], 0x7465
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14009396a
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret

Function at 0x140093990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x22], 0x5f32
mov word [rsp + 0x25], 0x2e32
mov word [rsp + 0x20], 0x7357
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x24], 0x33
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x27], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1400939e9
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret

Function at 0x140095c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rdx, [0x1400f3480]
jmp fcn.140095ca0

Function at 0x140095ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
movzx r10d, byte [rcx]
mov r9, rdx
mov r8, rcx
test r10b, r10b
je 0x140095ce0
movzx ecx, byte [r9]
test cl, cl
je 0x140095ce0
call fcn.140095b30
movzx ecx, r10b
movzx edx, al
call fcn.140095b30
cmp al, dl
jne 0x140095cf7
movzx r10d, byte [r8 + 1]
inc r8
inc r9
test r10b, r10b
jne 0x140095cb3
xor ecx, ecx
mov eax, ecx
cmp byte [r8], al
sete al
cmp byte [r9], cl
setne cl
xor eax, ecx
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x140096070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [rsp + 0x80]
mov rdi, r8
mov ebx, edx
mov dword [rsp + 0x3a], 0x6469576f
mov dword [rsp + 0x31], 0x69746c75
mov dword [rsp + 0x40], 0x726168
mov word [rsp + 0x35], 0x7942
mov word [rsp + 0x3e], 0x4365
mov word [rsp + 0x38], 0x5465
mov byte [rsp + 0x30], 0x4d
mov byte [rsp + 0x37], 0x74
call fcn.140096220
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140096110
mov eax, dword [rsp + 0x88]
mov r9d, 0xffffffff
mov dword [rsp + 0x28], eax
mov r8, rdi
mov edx, ebx
mov qword [rsp + 0x20], rsi
mov ecx, 0xfde9
call r10
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14004d9a0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x140096140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, qword [rsp + 0x90]
mov rbx, r8
mov word [rsp + 0x52], 0x65
mov word [rsp + 0x48], 0x6f54
mov dword [rsp + 0x43], 0x61684365
mov dword [rsp + 0x4a], 0x746c754d
mov word [rsp + 0x40], 0x6957
mov byte [rsp + 0x47], 0x72
mov byte [rsp + 0x42], 0x64
mov word [rsp + 0x4f], 0x7942
mov byte [rsp + 0x4e], 0x69
mov byte [rsp + 0x51], 0x74
call fcn.140096220
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400961f4
mov eax, dword [rsp + 0x98]
mov r9d, 0xffffffff
mov qword [rsp + 0x38], 0
mov r8, rbx
mov qword [rsp + 0x30], 0
xor edx, edx
mov dword [rsp + 0x28], eax
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call r10
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004d9a0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x140096220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x6c6c642e
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x20], 0x6e72654b
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret
Function at 0x140097aa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx esi, r8b
mov word [rsp + 0x26], 0x6f43
mov edi, edx
mov dword [rsp + 0x21], 0x65537265
mov rbx, rcx
mov dword [rsp + 0x28], 0x7469646e
mov dword [rsp + 0x2e], 0x73614d6e
mov word [rsp + 0x32], 0x6b
mov byte [rsp + 0x25], 0x74
mov word [rsp + 0x2c], 0x6f69
mov byte [rsp + 0x20], 0x56
call fcn.140097b40
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140097b1c
movzx r8d, sil
mov edx, edi
mov rcx, rbx
call rax
jmp 0x140097b1f
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140097b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x6c6c642e
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x20], 0x6e72654b
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret

Function at 0x140097df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rbp - 8], rax
mov esi, r8d
mov dword [rbp - 0xf], 0x6c626169
mov rdi, rdx
mov dword [rbp - 0x15], 0x56746e65
mov rbx, rcx
mov dword [rbp - 0x1a], 0x6e6f7269
mov dword [rbp - 0x20], 0x45746547
mov word [rbp - 0x11], 0x7261
mov word [rbp - 0xb], 0x4165
mov word [rbp - 0x1c], 0x766e
mov byte [rbp - 9], 0
mov byte [rbp - 0x16], 0x6d
call fcn.140097e90
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140097e6e
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14004d9a0
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140097e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x6c6c642e
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x20], 0x6e72654b
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret
Function at 0x14009b510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [rsp + 0x80]
mov edi, r9d
mov rbx, r8
mov dword [rsp + 0x3a], 0x6469576f
mov dword [rsp + 0x31], 0x69746c75
mov dword [rsp + 0x40], 0x726168
mov word [rsp + 0x35], 0x7942
mov word [rsp + 0x3e], 0x4365
mov word [rsp + 0x38], 0x5465
mov byte [rsp + 0x30], 0x4d
mov byte [rsp + 0x37], 0x74
call fcn.14009b660
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14009b5b1
mov eax, dword [rsp + 0x88]
mov r9d, edi
mov dword [rsp + 0x28], eax
mov r8, rbx
mov edx, 8
mov qword [rsp + 0x20], rsi
mov ecx, 0xfde9
call r10
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14004d9a0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14009b5e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x4c746547
mov dword [rsp + 0x26], 0x72724574
mov word [rsp + 0x2b], 0x72
mov word [rsp + 0x24], 0x7361
mov byte [rsp + 0x2a], 0x6f
call fcn.14009b660
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14009b642
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret
mov eax, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret

Function at 0x14009b660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x6c6c642e
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x20], 0x6e72654b
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d9a0
add rsp, 0x48
ret

Function at 0x14009b6c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f2088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.14009bc70
mov rdi, rax
test rax, rax
je 0x14009b760
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x24], 0x63696669
mov rcx, rax
mov dword [rbp - 0x28], 0x74726543
mov word [rbp - 0x2a], 0x6d75
mov dword [rbp - 0x18], 0x65726f
mov dword [rbp - 0x1e], 0x6e497365
mov word [rbp - 0x30], 0x6543
mov word [rbp - 0x2d], 0x4574
mov byte [rbp - 0x2e], 0x72
mov word [rbp - 0x1a], 0x7453
mov word [rbp - 0x20], 0x7461
mov byte [rbp - 0x2b], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14009b757
mov rdx, r14
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14004d9a0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret