joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140079070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp + 0x20], rax
movups xmm0, xmmword [0x14025e058]
xor ebx, ebx
mov dword [rsp], 0x8b0048
mov dword [rsp + 4], 0x4800c4
mov edi, 0xffff
movq rax, xmm0
mov dword [rsp + 8], 0x580089
psrldq xmm0, 8
movzx edx, bx
movq r10, xmm0
mov dword [rsp + 0xc], 0x480010
add r10, rax
mov dword [rsp + 0x10], 0x680089
mov dword [rsp + 0x14], 0x560018
mov dword [rsp + 0x18], 0x410057
mov dword [rsp + 0x1c], 0x410054
mov dword [rsp + 0x20], 0x410056
mov dword [rsp + 0x24], 0x480057
mov dword [rsp + 0x28], 0xec0081
mov qword [rsp + 0x2c], 0xffffffffffffffff
mov dword [rsp + 0x34], 0x29000f
mov dword [rsp + 0x38], 0xc80070
mov dword [rsp + 0x3c], 0x29000f
mov dword [rsp + 0x40], 0xb80078
mov dword [rsp + 0x44], 0x8b0048
mov qword [rsp + 0x48], 0xffffffffffff0005
mov dword [rsp + 0x50], 0x48ffff
mov dword [rsp + 0x54], 0xc40033
mov dword [rsp + 0x58], 0x890048
mov dword [rsp + 0x5c], 0x240044
mov dword [rsp + 0x60], 0x4dffff
mov dword [rsp + 0x64], 0xf1008b
mov dword [rsp + 0x68], 0x8b0049
mov dword [rsp + 0x6c], 0x4800f0
mov dword [rsp + 0x70], 0xea008b
mov dword [rsp + 0x74], 0x8b0048
mov dword [rsp + 0x78], 0xf00f9
mov dword [rsp + 0x7c], 0xc00057
mov dword [rbp - 0x80], 0x11000f
mov dword [rbp - 0x7c], 0x240044
mov dword [rbp - 0x78], 0x48ffff
mov dword [rbp - 0x74], 0x51008b
mov dword [rbp - 0x70], 0x480010
mov dword [rbp - 0x6c], 0xc20081
mov qword [rbp - 0x68], 0xffffffffffffffff
mov dword [rbp - 0x60], 0x8d0048
mov dword [rbp - 0x5c], 0x24004c
mov dword [rbp - 0x58], 0xe8ffff
mov qword [rbp - 0x54], 0xffffffffffffffff
mov dword [rbp - 0x4c], 0x4c0090
mov dword [rbp - 0x48], 0x44008b
mov dword [rbp - 0x44], 0xffff0024
mov dword [rbp - 0x40], 0x85004d
mov dword [rbp - 0x3c], 0xf00c0
mov qword [rbp - 0x38], 0xffffffffffff0084
mov dword [rbp - 0x30], 0x48ffff
mov dword [rbp - 0x2c], 0x5c008b
mov dword [rbp - 0x28], 0xffff0024
mov dword [rbp - 0x24], 0x850048
mov dword [rbp - 0x20], 0x7400db
mov dword [rbp - 0x1c], 0xf0000e
mov dword [rbp - 0x18], 0x4300ff
mov dword [rbp - 0x14], 0x480008
mov dword [rbp - 0x10], 0x5c008b
mov dword [rbp - 0xc], 0xffff0024
mov dword [rbp - 8], 0x8b004c
mov dword [rbp - 4], 0x240044
mov dword [rbp], 0x49ffff
mov dword [rbp + 4], 0x8008b
mov dword [rbp + 8], 0xf00f3
mov dword [rbp + 0xc], 0x60010
mov dword [rbp + 0x10], 0x8d0048
mov dword [rbp + 0x14], 0x340041
cmp rax, r10
je 0x1400792f2
mov r9, rax
mov r11d, 0x8c
nop dword [rax]
movzx ecx, dx
movzx r8d, word [rsp + rcx*2]
movzx ecx, byte [rax]
cmp r8w, cx
je 0x1400792e1
cmp r8w, di
je 0x1400792e1
inc rax
mov edx, ebx
mov r9, rax
jmp 0x1400792ed
inc dx
cmp dx, r11w
je 0x140079321
inc rax
cmp rax, r10
jne 0x1400792c0
xor eax, eax
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.14008fda0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, r9
jmp 0x1400792f4
Function at 0x140079a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp + 0x47], rax
movups xmm0, xmmword [0x14025e058]
xor ebx, ebx
mov dword [rbp - 0x39], 0x8b0048
mov dword [rbp - 0x35], 0x4800c4
mov r11d, 0xffff
movq rax, xmm0
mov dword [rbp - 0x31], 0x580089
psrldq xmm0, 8
movzx edx, bx
movq r10, xmm0
mov dword [rbp - 0x2d], 0x550010
add r10, rax
mov dword [rbp - 0x29], 0x570056
mov dword [rbp - 0x25], 0x540041
mov dword [rbp - 0x21], 0x550041
mov dword [rbp - 0x1d], 0x560041
mov dword [rbp - 0x19], 0x570041
mov dword [rbp - 0x15], 0x8d0048
mov dword [rbp - 0x11], 0x24006c
mov dword [rbp - 0xd], 0x48ffff
mov dword [rbp - 9], 0xec0081
mov qword [rbp - 5], 0xffffffffffffffff
mov dword [rbp + 3], 0x29000f
mov dword [rbp + 7], 0xb80070
mov dword [rbp + 0xb], 0x29000f
mov dword [rbp + 0xf], 0xa80078
mov dword [rbp + 0x13], 0xf0044
mov dword [rbp + 0x17], 0x400029
mov dword [rbp + 0x1b], 0x44ffff
mov dword [rbp + 0x1f], 0x29000f
mov dword [rbp + 0x23], 0xffff0048
mov dword [rbp + 0x27], 0xf0044
mov dword [rbp + 0x2b], 0x900029
mov qword [rbp + 0x2f], 0xffffffffffffffff
mov dword [rbp + 0x37], 0xf0044
mov dword [rbp + 0x3b], 0x980029
mov qword [rbp + 0x3f], 0xffffffffffffffff
cmp rax, r10
je 0x140079b73
mov r9, rax
nop word [rax + rax]
movzx ecx, dx
movzx r8d, word [rbp + rcx*2 - 0x39]
movzx ecx, byte [rax]
cmp r8w, cx
je 0x140079b62
cmp r8w, r11w
je 0x140079b62
inc rax
mov edx, ebx
mov r9, rax
jmp 0x140079b6e
inc dx
cmp dx, 0x40
je 0x140079b92
inc rax
cmp rax, r10
jne 0x140079b40
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14008fda0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
mov rax, r9
jmp 0x140079b75
Function at 0x14007c260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [0x14025e058]
xor ebx, ebx
mov dword [rbp - 0x80], 0x8b0048
mov dword [rbp - 0x7c], 0x4800c4
mov r11d, 0xffff
movq rax, xmm0
mov dword [rbp - 0x78], 0x580089
psrldq xmm0, 8
movzx edx, bx
movq r10, xmm0
mov dword [rbp - 0x74], 0x550010
add r10, rax
mov dword [rbp - 0x70], 0x570056
mov dword [rbp - 0x6c], 0x540041
mov dword [rbp - 0x68], 0x550041
mov dword [rbp - 0x64], 0x560041
mov dword [rbp - 0x60], 0x570041
mov dword [rbp - 0x5c], 0x8d0048
mov dword [rbp - 0x58], 0xa10068
mov dword [rbp - 0x54], 0x810048
mov qword [rbp - 0x50], 0xffffffffffff00ec
mov dword [rbp - 0x48], 0xfffff
mov dword [rbp - 0x44], 0x700029
mov dword [rbp - 0x40], 0xf00b8
mov dword [rbp - 0x3c], 0x780029
mov dword [rbp - 0x38], 0x4800a8
mov dword [rbp - 0x34], 0x5008b
mov qword [rbp - 0x30], 0xffffffffffffffff
mov dword [rbp - 0x28], 0x330048
mov dword [rbp - 0x24], 0x4800c4
mov dword [rbp - 0x20], 0x450089
mov dword [rbp - 0x1c], 0x4900ff
mov dword [rbp - 0x18], 0xf0008b
cmp rax, r10
je 0x14007c3a3
mov r9, rax
nop word [rax + rax]
movzx ecx, dx
movzx r8d, word [rbp + rcx*2 - 0x80]
movzx ecx, byte [rax]
cmp r8w, cx
je 0x14007c392
cmp r8w, r11w
je 0x14007c392
inc rax
mov edx, ebx
mov r9, rax
jmp 0x14007c39e
inc dx
cmp dx, 0x36
je 0x14007c3ce
inc rax
cmp rax, r10
jne 0x14007c370
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14008fda0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rax, r9
jmp 0x14007c3a5
Function at 0x14007c3e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp + 0x47], rax
movups xmm0, xmmword [0x14025e058]
xor ebx, ebx
mov dword [rbp - 0x49], 0x8b0048
mov dword [rbp - 0x45], 0x4800c4
mov r11d, 0xffff
movq rax, xmm0
mov dword [rbp - 0x41], 0x580089
psrldq xmm0, 8
movzx edx, bx
movq r10, xmm0
mov dword [rbp - 0x3d], 0x550020
add r10, rax
mov dword [rbp - 0x39], 0x570056
mov dword [rbp - 0x35], 0x540041
mov dword [rbp - 0x31], 0x550041
mov dword [rbp - 0x2d], 0x560041
mov dword [rbp - 0x29], 0x570041
mov dword [rbp - 0x25], 0x8d0048
mov qword [rbp - 0x21], 0xffffffffffff00a8
mov dword [rbp - 0x19], 0x48ffff
mov dword [rbp - 0x15], 0xec0081
mov qword [rbp - 0x11], 0xffffffffffffffff
mov dword [rbp - 9], 0x29000f
mov dword [rbp - 5], 0xb80070
mov dword [rbp - 1], 0x29000f
mov dword [rbp + 3], 0xa80078
mov dword [rbp + 7], 0xf0044
mov dword [rbp + 0xb], 0x400029
mov dword [rbp + 0xf], 0x44ffff
mov dword [rbp + 0x13], 0x29000f
mov dword [rbp + 0x17], 0xffff0048
mov dword [rbp + 0x1b], 0x8b0048
mov qword [rbp + 0x1f], 0xffffffffffff0005
mov dword [rbp + 0x27], 0x48ffff
mov dword [rbp + 0x2b], 0xc40033
mov dword [rbp + 0x2f], 0x890048
mov qword [rbp + 0x33], 0xffffffffffff0085
mov dword [rbp + 0x3b], 0x4cffff
mov dword [rbp + 0x3f], 0x4c0089
mov dword [rbp + 0x43], 0xffff0024
cmp rax, r10
je 0x14007c553
mov r9, rax
nop
movzx ecx, dx
movzx r8d, word [rbp + rcx*2 - 0x49]
movzx ecx, byte [rax]
cmp r8w, cx
je 0x14007c542
cmp r8w, r11w
je 0x14007c542
inc rax
mov edx, ebx
mov r9, rax
jmp 0x14007c54e
inc dx
cmp dx, 0x48
je 0x14007c57e
inc rax
cmp rax, r10
jne 0x14007c520
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14008fda0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rax, r9
jmp 0x14007c555
Function at 0x140080280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x14025db80]
lea rdx, [rbp - 0x60]
mulss xmm0, dword [0x14025db7c]
mov rbx, r9
mov r9d, dword [0x14025db84]
mulss xmm1, dword [0x14025db7c]
lea eax, [rcx + 1]
mov dword [0x14025db80], eax
movss dword [rbp - 0x60], xmm0
movss dword [rbp - 0x5c], xmm1
call fcn.140009210
mov rax, qword [rbx]
cmp byte [rax], 0
je 0x1400802fa
movups xmm0, xmmword [0x14025dc28]
mov dword [rbp - 0x28], 0
lea rax, [rbp - 0x28]
movups xmmword [rbp - 0x24], xmm0
jmp 0x140080310
movups xmm0, xmmword [0x14025dc38]
mov dword [rbp - 0x40], 0
lea rax, [rbp - 0x40]
movups xmmword [rbp - 0x3c], xmm0
movups xmm0, xmmword [rax]
mov eax, dword [rax + 0x10]
lea rdx, [rbp - 0x54]
mov dword [rbp - 0x48], eax
movd ecx, xmm0
movups xmmword [rbp - 0x58], xmm0
call fcn.140020f30
xor eax, eax
mov dword [rbp - 0x60], 0x42200000
lea rdx, [rbp - 0x28]
mov word [rbp - 0x3b], ax
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x39], al
mov dword [rbp - 0x5c], 0x42200000
mov dword [rbp - 0x40], 0x9c0d8d62
mov byte [rbp - 0x3c], 0x9c
mov qword [rbp - 0x38], 0x45a
call fcn.140075b90
lea rdx, [rbp - 0x60]
mov rcx, rax
call fcn.14004dde0
test al, al
je 0x140080390
cmp byte [0x14025d3d0], 0
jne 0x140080390
mov rcx, qword [0x14025dbe0]
cmp byte [rcx], 0
sete al
mov byte [rcx], al
mov byte [0x14025d3d0], 1
mov ecx, 1
call fcn.140020790
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x42480000
mov dword [rbp - 0x5c], 0x41500000
call fcn.1400258f0
mov rax, qword [0x14025dbe0]
lea rcx, [rbp - 0x58]
cmp byte [rax], 0
je 0x1400803f2
xor eax, eax
mov dword [rbp - 0x58], 0x28492762
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x4f], eax
mov word [rbp - 0x4b], ax
mov byte [rbp - 0x49], al
mov dword [rbp - 0x54], 0x2743264a
mov byte [rbp - 0x50], 0x27
mov qword [rbp - 0x48], 0x313c
call fcn.140075cd0
jmp 0x140080420
xor eax, eax
mov dword [rbp - 0x58], 0x3c4f2662
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x4e], eax
mov word [rbp - 0x4a], ax
mov dword [rbp - 0x54], 0x36533f5d
mov word [rbp - 0x50], 0x5252
mov qword [rbp - 0x48], 0x647c
call fcn.140075d40
mov rcx, rax
call fcn.14005d3b0
call fcn.1400155d0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14008fda0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x1400831c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [rdx]
mov rbx, rcx
xor ecx, ecx
mov rdi, rdx
cmp cx, word [rax]
jne 0x1400832a0
xor eax, eax
mov dword [rbp - 0x38], 0x3e593662
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x2f], eax
lea rcx, [rbp - 0x38]
mov word [rbp - 0x2b], ax
mov byte [rbp - 0x29], al
mov dword [rbp - 0x34], 0x23503559
mov byte [rbp - 0x30], 0x23
mov qword [rbp - 0x28], 0x3942
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x20], 0
call fcn.140053a50
lea rdx, [rbx + 0x38]
lea rcx, [rbx + 0x28]
call fcn.140081d60
test al, al
je 0x140083262
mov byte [0x1402609d4], 1
movzx eax, byte [rbx + 0x30]
lea rdx, [rbp - 0x38]
lea rcx, str.b0Q8V4___fa
mov byte [rbp - 0x40], al
call fcn.140076040
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.14004e740
cmp byte [0x14025d3d0], 0
jne 0x1400832a0
movzx ecx, byte [rbp - 0x40]
mov byte [rbx + 0x30], cl
test al, al
je 0x1400832a0
mov byte [0x1402609d4], 1
mov rax, qword [rdi]
lea rsi, [rbx + 8]
mov ecx, 1
cmp cx, word [rax]
jne 0x140083317
xor eax, eax
mov dword [rbp - 0x38], 0x3e593662
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x2f], eax
lea rcx, [rbp - 0x38]
mov word [rbp - 0x2b], ax
mov byte [rbp - 0x29], al
mov dword [rbp - 0x34], 0x23503559
mov byte [rbp - 0x30], 0x23
mov qword [rbp - 0x28], 0x3942
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x20], 0
call fcn.140053a50
lea rcx, [rsi + 0x14]
mov qword [rbp - 0x20], rsi
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x20]
call fcn.140084140
mov rax, qword [rdi]
mov ecx, 2
cmp cx, word [rax]
jne 0x14008338a
xor eax, eax
mov dword [rbp - 0x38], 0x3e593662
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x2f], eax
lea rcx, [rbp - 0x38]
mov word [rbp - 0x2b], ax
mov byte [rbp - 0x29], al
mov dword [rbp - 0x34], 0x23503559
mov byte [rbp - 0x30], 0x23
mov qword [rbp - 0x28], 0x3942
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x20], 0
call fcn.140053a50
lea rcx, [rbx + 1]
mov qword [rbp - 0x20], rbx
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x20]
call fcn.140086e00
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14008fda0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140084550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x18]
sub rsp, 0x110
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp - 0x40], rax
mov rax, qword [rdx]
mov qword [r11 + 8], rbx
mov rbx, rdx
mov qword [r11 + 0x10], rdi
mov rdi, rcx
xor ecx, ecx
cmp cx, word [rax]
jne 0x1400845ce
xor eax, eax
mov dword [rsp + 0x30], 0x295d2d62
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x39], eax
lea rcx, [rsp + 0x30]
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
mov dword [rsp + 0x34], 0x32412f40
mov byte [rsp + 0x38], 0x32
mov qword [rsp + 0x40], 0x31b6
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
mov rax, qword [rbx]
add rdi, 0x28
mov ecx, 1
cmp cx, word [rax]
jne 0x140084760
movaps xmmword [rsp + 0x100], xmm6
lea rdx, [rsp + 0x60]
xor eax, eax
movaps xmmword [rsp + 0xf0], xmm7
movaps xmmword [rsp + 0xe0], xmm8
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0xd0], xmm9
mov dword [rsp + 0x30], 0x295d2d62
mov dword [rsp + 0x34], 0x32412f40
mov byte [rsp + 0x38], 0x32
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
mov qword [rsp + 0x40], 0x31b6
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
lea rcx, [rsp + 0x24]
mov qword [rsp + 0x24], 0
xorps xmm9, xmm9
call fcn.140053a50
lea rdx, [rbp - 0x70]
lea rcx, str.b_N_M_LlD_W_D
call fcn.14008bc50
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x48], 0x34344762
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x50], 0x72
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
movups xmm8, xmmword [rax + 0x20]
call fcn.14008acc0
lea rdx, [rsp + 0x60]
movaps xmmword [rsp + 0x60], xmm6
mov rcx, rax
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rbp - 0x80], xmm8
call fcn.14005d3b0
movss xmm1, dword [0x14025db7c]
lea rdx, [rsp + 0x48]
mov ecx, dword [0x14025db80]
movaps xmm0, xmm1
mulss xmm1, dword [0x1402509d4]
mov r8b, 1
mov r9d, dword [0x14025db84]
mulss xmm0, xmm9
lea eax, [rcx + 1]
mov byte [rsp + 0x20], 0
movss dword [rsp + 0x4c], xmm1
mov dword [0x14025db80], eax
movss dword [rsp + 0x48], xmm0
call fcn.140009210
lea rax, [rsp + 0x20]
mov qword [rsp + 0x60], rdi
lea r8, [rsp + 0x21]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.1400851c0
call fcn.1400155d0
cmp byte [rsp + 0x20], 0
movaps xmm9, xmmword [rsp + 0xd0]
movaps xmm8, xmmword [rsp + 0xe0]
movaps xmm7, xmmword [rsp + 0xf0]
movaps xmm6, xmmword [rsp + 0x100]
je 0x140084760
mov byte [0x1402609d4], 1
mov rax, qword [rbx]
mov ecx, 2
mov rdi, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x120]
cmp cx, word [rax]
jne 0x1400847c6
xor eax, eax
mov dword [rsp + 0x60], 0x295d2d62
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x69], eax
lea rcx, [rsp + 0x60]
mov word [rsp + 0x6d], ax
mov byte [rsp + 0x6f], al
mov dword [rsp + 0x64], 0x32412f40
mov byte [rsp + 0x68], 0x32
mov qword [rsp + 0x70], 0x31b6
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
mov rcx, qword [rbp - 0x40]
xor rcx, rsp
call fcn.14008fda0
add rsp, 0x110
pop rbp
ret
Function at 0x140084a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [rcx]
mov rbx, r8
movzx ecx, word [rax]
cmp rdx, rcx
jne 0x140084b8d
xor eax, eax
mov dword [rbp - 0x38], 0x3e593662
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x2f], eax
lea rcx, [rbp - 0x38]
mov word [rbp - 0x2b], ax
mov byte [rbp - 0x29], al
mov dword [rbp - 0x34], 0x23503559
mov byte [rbp - 0x30], 0x23
mov qword [rbp - 0x28], 0x3942
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x20], 0
call fcn.140053a50
lea rdx, [rbx + 0x20]
mov rcx, rbx
call fcn.140081d60
test al, al
je 0x140084a95
mov byte [0x1402609d4], 1
movzx eax, byte [rbx + 0x1b]
lea rdx, [rbp - 0x38]
lea rcx, str.b_M_G__fm
mov byte [rbp - 0x40], al
call fcn.140075dc0
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.14004e740
cmp byte [0x14025d3d0], 0
jne 0x140084ad3
movzx ecx, byte [rbp - 0x40]
mov byte [rbx + 0x1b], cl
test al, al
je 0x140084ad3
mov byte [0x1402609d4], 1
movzx eax, byte [rbx + 0x1a]
lea rdx, [rbp - 0x38]
lea rcx, str.b1F___
mov byte [rbp - 0x40], al
call fcn.140075f10
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.14004e740
cmp byte [0x14025d3d0], 0
jne 0x140084b11
movzx ecx, byte [rbp - 0x40]
mov byte [rbx + 0x1a], cl
test al, al
je 0x140084b11
mov byte [0x1402609d4], 1
movzx eax, byte [rbx + 0x19]
lea rdx, [rbp - 0x38]
lea rcx, str.b__
mov byte [rbp - 0x40], al
call fcn.140075d40
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.14004e740
cmp byte [0x14025d3d0], 0
jne 0x140084b4f
movzx ecx, byte [rbp - 0x40]
mov byte [rbx + 0x19], cl
test al, al
je 0x140084b4f
mov byte [0x1402609d4], 1
movzx eax, byte [rbx + 0x18]
lea rdx, [rbp - 0x38]
lea rcx, str.b1T8__JU0
mov byte [rbp - 0x40], al
call fcn.1400760f0
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.14004e740
cmp byte [0x14025d3d0], 0
jne 0x140084b8d
movzx ecx, byte [rbp - 0x40]
mov byte [rbx + 0x18], cl
test al, al
je 0x140084b8d
mov byte [0x1402609d4], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14008fda0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1400857f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14025dcd8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov rdi, rdx
add rcx, 0x180
cmp byte [0x14025d3d4], 0
jne 0x14008583e
mov qword [rbp - 0x20], rcx
lea r8, [rbp - 0x40]
add rcx, 8
lea rdx, [rbp - 0x20]
call fcn.1400887d0
mov esi, 1
lea r8, [rbx + 0x130]
mov edx, esi
mov rcx, rdi
call fcn.140087510
xor r14d, r14d
cmp byte [0x14025d3d4], 2
jne 0x140085960
cmp r14w, word [rbx + 0xd8]
jne 0x1400858ae
xor eax, eax
mov dword [rbp - 0x38], 0x295d2d62
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x2f], eax
lea rcx, [rbp - 0x38]
mov word [rbp - 0x2b], ax
mov byte [rbp - 0x29], al
mov dword [rbp - 0x34], 0x32412f40
mov byte [rbp - 0x30], 0x32
mov qword [rbp - 0x28], 0x31b6
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
lea rdi, [rbx + 0xe8]
cmp si, word [rbx + 0xd8]
jne 0x140085912
xor eax, eax
mov dword [rbp - 0x38], 0x295d2d62
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x2f], eax
lea rcx, [rbp - 0x38]
mov word [rbp - 0x2b], ax
mov byte [rbp - 0x29], al
mov dword [rbp - 0x34], 0x32412f40
mov byte [rbp - 0x30], 0x32
mov qword [rbp - 0x28], 0x31b6
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
lea r8, [rbp - 0x40]
mov qword [rbp - 0x20], rdi
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140084bb0
mov eax, 2
cmp ax, word [rbx + 0xd8]
jne 0x140085960
xor eax, eax
mov dword [rbp - 0x38], 0x295d2d62
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x2f], eax
lea rcx, [rbp - 0x38]
mov word [rbp - 0x2b], ax
mov byte [rbp - 0x29], al
mov dword [rbp - 0x34], 0x32412f40
mov byte [rbp - 0x30], 0x32
mov qword [rbp - 0x28], 0x31b6
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
cmp byte [0x14025d3d4], 3
lea rcx, [rbx + 0x58]
jne 0x140085982
mov qword [rbp - 0x20], rcx
lea r8, [rbp - 0x40]
add rcx, 8
lea rdx, [rbp - 0x20]
call fcn.140086be0
cmp byte [0x14025d3d4], 4
lea rcx, [rbx + 8]
jne 0x1400859a4
mov qword [rbp - 0x20], rcx
lea r8, [rbp - 0x40]
add rcx, 8
lea rdx, [rbp - 0x20]
call fcn.140084550
cmp byte [0x14025d3d4], 5
jne 0x1400859f3
cmp r14w, word [rbx]
jne 0x1400859f3
xor eax, eax
mov dword [rbp - 0x38], 0x295d2d62
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x2f], eax
lea rcx, [rbp - 0x38]
mov word [rbp - 0x2b], ax
mov byte [rbp - 0x29], al
mov dword [rbp - 0x34], 0x32412f40
mov byte [rbp - 0x30], 0x32
mov qword [rbp - 0x28], 0x31b6
call fcn.140075cd0
mov rcx, rax
call fcn.14005d3b0
call fcn.140058f10
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14008fda0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret