joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003c5d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov byte [rbp - 0x3e], 0x52
mov byte [rbp - 0x3d], 0x65
mov byte [rbp - 0x3c], 0x67
mov byte [rbp - 0x3b], 0x4f
mov byte [rbp - 0x3a], 0x70
mov byte [rbp - 0x39], 0x65
mov byte [rbp - 0x38], 0x6e
mov byte [rbp - 0x37], 0x4b
mov byte [rbp - 0x36], 0x65
mov byte [rbp - 0x35], 0x79
mov byte [rbp - 0x34], 0x45
mov byte [rbp - 0x33], 0x78
mov byte [rbp - 0x32], 0x57
mov byte [rbp - 0x31], 0
mov word [rbp - 0x30], 0x41
mov word [rbp - 0x2e], 0x44
mov word [rbp - 0x2c], 0x56
mov word [rbp - 0x2a], 0x41
mov word [rbp - 0x28], 0x50
mov word [rbp - 0x26], 0x49
mov word [rbp - 0x24], 0x33
mov word [rbp - 0x22], 0x32
mov word [rbp - 0x20], 0x2e
mov word [rbp - 0x1e], 0x44
mov word [rbp - 0x1c], 0x4c
mov word [rbp - 0x1a], 0x4c
mov word [rbp - 0x18], 0
lea rdx, [rbp - 0x3e]
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14000178c
mov qword [rbp - 8], rax
mov byte [rbp - 0x6c], 0x52
mov byte [rbp - 0x6b], 0x65
mov byte [rbp - 0x6a], 0x67
mov byte [rbp - 0x69], 0x43
mov byte [rbp - 0x68], 0x6c
mov byte [rbp - 0x67], 0x6f
mov byte [rbp - 0x66], 0x73
mov byte [rbp - 0x65], 0x65
mov byte [rbp - 0x64], 0x4b
mov byte [rbp - 0x63], 0x65
mov byte [rbp - 0x62], 0x79
mov byte [rbp - 0x61], 0
mov word [rbp - 0x60], 0x41
mov word [rbp - 0x5e], 0x44
mov word [rbp - 0x5c], 0x56
mov word [rbp - 0x5a], 0x41
mov word [rbp - 0x58], 0x50
mov word [rbp - 0x56], 0x49
mov word [rbp - 0x54], 0x33
mov word [rbp - 0x52], 0x32
mov word [rbp - 0x50], 0x2e
mov word [rbp - 0x4e], 0x44
mov word [rbp - 0x4c], 0x4c
mov word [rbp - 0x4a], 0x4c
mov word [rbp - 0x48], 0
lea rdx, [rbp - 0x6c]
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.14000178c
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x78], 0
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x10]
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x20], rcx
mov r10, qword [rbp - 8]
mov r9d, 0x20019
mov r8d, 0
mov rcx, rax
call r10
test eax, eax
jne 0x140003de3
mov rax, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov eax, 1
jmp 0x140003de8
mov eax, 0
add rsp, 0xb0
pop rbp
ret
Function at 0x140007421
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov byte [rbp - 0x3c], 0x46
mov byte [rbp - 0x3b], 0x69
mov byte [rbp - 0x3a], 0x6e
mov byte [rbp - 0x39], 0x64
mov byte [rbp - 0x38], 0x57
mov byte [rbp - 0x37], 0x69
mov byte [rbp - 0x36], 0x6e
mov byte [rbp - 0x35], 0x64
mov byte [rbp - 0x34], 0x6f
mov byte [rbp - 0x33], 0x77
mov byte [rbp - 0x32], 0x57
mov byte [rbp - 0x31], 0
mov word [rbp - 0x30], 0x55
mov word [rbp - 0x2e], 0x53
mov word [rbp - 0x2c], 0x45
mov word [rbp - 0x2a], 0x52
mov word [rbp - 0x28], 0x33
mov word [rbp - 0x26], 0x32
mov word [rbp - 0x24], 0x2e
mov word [rbp - 0x22], 0x44
mov word [rbp - 0x20], 0x4c
mov word [rbp - 0x1e], 0x4c
mov word [rbp - 0x1c], 0
lea rdx, [rbp - 0x3c]
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.14000178c
mov qword [rbp - 8], rax
mov word [rbp - 0x70], 0x56
mov word [rbp - 0x6e], 0x42
mov word [rbp - 0x6c], 0x6f
mov word [rbp - 0x6a], 0x78
mov word [rbp - 0x68], 0x54
mov word [rbp - 0x66], 0x72
mov word [rbp - 0x64], 0x61
mov word [rbp - 0x62], 0x79
mov word [rbp - 0x60], 0x54
mov word [rbp - 0x5e], 0x6f
mov word [rbp - 0x5c], 0x6f
mov word [rbp - 0x5a], 0x6c
mov word [rbp - 0x58], 0x57
mov word [rbp - 0x56], 0x6e
mov word [rbp - 0x54], 0x64
mov word [rbp - 0x52], 0x43
mov word [rbp - 0x50], 0x6c
mov word [rbp - 0x4e], 0x61
mov word [rbp - 0x4c], 0x73
mov word [rbp - 0x4a], 0x73
mov word [rbp - 0x48], 0
lea rax, [rbp - 0x70]
mov r8, qword [rbp - 8]
mov edx, 0
mov rcx, rax
call r8
mov qword [rbp - 0x10], rax
mov word [rbp - 0x90], 0x56
mov word [rbp - 0x8e], 0x42
mov word [rbp - 0x8c], 0x6f
mov word [rbp - 0x8a], 0x78
mov word [rbp - 0x88], 0x54
mov word [rbp - 0x86], 0x72
mov word [rbp - 0x84], 0x61
mov word [rbp - 0x82], 0x79
mov word [rbp - 0x80], 0x54
mov word [rbp - 0x7e], 0x6f
mov word [rbp - 0x7c], 0x6f
mov word [rbp - 0x7a], 0x6c
mov word [rbp - 0x78], 0x57
mov word [rbp - 0x76], 0x6e
mov word [rbp - 0x74], 0x64
mov word [rbp - 0x72], 0
lea rax, [rbp - 0x90]
mov r8, qword [rbp - 8]
mov rdx, rax
mov ecx, 0
call r8
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x10], 0
jne 0x1400075e7
cmp qword [rbp - 0x18], 0
je 0x1400075ee
mov eax, 1
jmp 0x1400075f3
mov eax, 0
add rsp, 0xb0
pop rbp
ret
Function at 0x1400075fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x2e0
lea rbp, [rsp + 0x80]
mov byte [rbp + 0x220], 0x57
mov byte [rbp + 0x221], 0x4e
mov byte [rbp + 0x222], 0x65
mov byte [rbp + 0x223], 0x74
mov byte [rbp + 0x224], 0x47
mov byte [rbp + 0x225], 0x65
mov byte [rbp + 0x226], 0x74
mov byte [rbp + 0x227], 0x50
mov byte [rbp + 0x228], 0x72
mov byte [rbp + 0x229], 0x6f
mov byte [rbp + 0x22a], 0x76
mov byte [rbp + 0x22b], 0x69
mov byte [rbp + 0x22c], 0x64
mov byte [rbp + 0x22d], 0x65
mov byte [rbp + 0x22e], 0x72
mov byte [rbp + 0x22f], 0x4e
mov byte [rbp + 0x230], 0x61
mov byte [rbp + 0x231], 0x6d
mov byte [rbp + 0x232], 0x65
mov byte [rbp + 0x233], 0x57
mov byte [rbp + 0x234], 0
mov word [rbp + 0x240], 0x4d
mov word [rbp + 0x242], 0x50
mov word [rbp + 0x244], 0x52
mov word [rbp + 0x246], 0x2e
mov word [rbp + 0x248], 0x44
mov word [rbp + 0x24a], 0x4c
mov word [rbp + 0x24c], 0x4c
mov word [rbp + 0x24e], 0
lea rdx, [rbp + 0x220]
lea rax, [rbp + 0x240]
mov rcx, rax
call fcn.14000178c
mov qword [rbp + 0x258], rax
mov byte [rbp + 0x1f7], 0x53
mov byte [rbp + 0x1f8], 0x74
mov byte [rbp + 0x1f9], 0x72
mov byte [rbp + 0x1fa], 0x43
mov byte [rbp + 0x1fb], 0x6d
mov byte [rbp + 0x1fc], 0x70
mov byte [rbp + 0x1fd], 0x49
mov byte [rbp + 0x1fe], 0x57
mov byte [rbp + 0x1ff], 0
mov word [rbp + 0x200], 0x53
mov word [rbp + 0x202], 0x48
mov word [rbp + 0x204], 0x4c
mov word [rbp + 0x206], 0x57
mov word [rbp + 0x208], 0x41
mov word [rbp + 0x20a], 0x50
mov word [rbp + 0x20c], 0x49
mov word [rbp + 0x20e], 0x2e
mov word [rbp + 0x210], 0x44
mov word [rbp + 0x212], 0x4c
mov word [rbp + 0x214], 0x4c
mov word [rbp + 0x216], 0
lea rdx, [rbp + 0x1f7]
lea rax, [rbp + 0x200]
mov rcx, rax
call fcn.14000178c
mov qword [rbp + 0x250], rax
mov dword [rbp - 0x24], 0x104
lea rdx, [rbp - 0x24]
lea rax, [rbp - 0x20]
mov r9, qword [rbp + 0x258]
mov r8, rdx
mov rdx, rax
mov ecx, 0x250000
call r9
test eax, eax
jne 0x1400078b4
mov word [rbp - 0x60], 0x56
mov word [rbp - 0x5e], 0x69
mov word [rbp - 0x5c], 0x72
mov word [rbp - 0x5a], 0x74
mov word [rbp - 0x58], 0x75
mov word [rbp - 0x56], 0x61
mov word [rbp - 0x54], 0x6c
mov word [rbp - 0x52], 0x42
mov word [rbp - 0x50], 0x6f
mov word [rbp - 0x4e], 0x78
mov word [rbp - 0x4c], 0x20
mov word [rbp - 0x4a], 0x53
mov word [rbp - 0x48], 0x68
mov word [rbp - 0x46], 0x61
mov word [rbp - 0x44], 0x72
mov word [rbp - 0x42], 0x65
mov word [rbp - 0x40], 0x64
mov word [rbp - 0x3e], 0x20
mov word [rbp - 0x3c], 0x46
mov word [rbp - 0x3a], 0x6f
mov word [rbp - 0x38], 0x6c
mov word [rbp - 0x36], 0x64
mov word [rbp - 0x34], 0x65
mov word [rbp - 0x32], 0x72
mov word [rbp - 0x30], 0x73
mov word [rbp - 0x2e], 0
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x20]
mov r8, qword [rbp + 0x250]
mov rcx, rax
call r8
test eax, eax
jne 0x1400078b4
mov eax, 1
jmp 0x1400078b9
mov eax, 0
add rsp, 0x2e0
pop rbp
ret
Function at 0x1400078c2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov word [rbp - 0x40], 0x76
mov word [rbp - 0x3e], 0x62
mov word [rbp - 0x3c], 0x6f
mov word [rbp - 0x3a], 0x78
mov word [rbp - 0x38], 0x73
mov word [rbp - 0x36], 0x65
mov word [rbp - 0x34], 0x72
mov word [rbp - 0x32], 0x76
mov word [rbp - 0x30], 0x69
mov word [rbp - 0x2e], 0x63
mov word [rbp - 0x2c], 0x65
mov word [rbp - 0x2a], 0x2e
mov word [rbp - 0x28], 0x65
mov word [rbp - 0x26], 0x78
mov word [rbp - 0x24], 0x65
mov word [rbp - 0x22], 0
lea rax, [rbp - 0x40]
mov qword [rbp - 0x20], rax
mov word [rbp - 0x60], 0x76
mov word [rbp - 0x5e], 0x62
mov word [rbp - 0x5c], 0x6f
mov word [rbp - 0x5a], 0x78
mov word [rbp - 0x58], 0x74
mov word [rbp - 0x56], 0x72
mov word [rbp - 0x54], 0x61
mov word [rbp - 0x52], 0x79
mov word [rbp - 0x50], 0x2e
mov word [rbp - 0x4e], 0x65
mov word [rbp - 0x4c], 0x78
mov word [rbp - 0x4a], 0x65
mov word [rbp - 0x48], 0
lea rax, [rbp - 0x60]
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], 0
jmp 0x1400079b3
mov rax, qword [rbp - 8]
mov rax, qword [rbp + rax*8 - 0x20]
mov rcx, rax
call fcn.140003df1
test eax, eax
je 0x1400079ae
mov eax, 1
jmp 0x1400079bf
add qword [rbp - 8], 1
cmp qword [rbp - 8], 1
jbe 0x140007992
mov eax, 0
sub rsp, 0xffffffffffffff80
pop rbp
ret
Function at 0x14000895e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov word [rbp - 0x60], 0x53
mov word [rbp - 0x5e], 0x59
mov word [rbp - 0x5c], 0x53
mov word [rbp - 0x5a], 0x54
mov word [rbp - 0x58], 0x45
mov word [rbp - 0x56], 0x4d
mov word [rbp - 0x54], 0x5c
mov word [rbp - 0x52], 0x56
mov word [rbp - 0x50], 0x4d
mov word [rbp - 0x4e], 0x77
mov word [rbp - 0x4c], 0x61
mov word [rbp - 0x4a], 0x72
mov word [rbp - 0x48], 0x65
mov word [rbp - 0x46], 0x2c
mov word [rbp - 0x44], 0x20
mov word [rbp - 0x42], 0x49
mov word [rbp - 0x40], 0x6e
mov word [rbp - 0x3e], 0x63
mov word [rbp - 0x3c], 0x2e
mov word [rbp - 0x3a], 0x5c
mov word [rbp - 0x38], 0x56
mov word [rbp - 0x36], 0x4d
mov word [rbp - 0x34], 0x77
mov word [rbp - 0x32], 0x61
mov word [rbp - 0x30], 0x72
mov word [rbp - 0x2e], 0x65
mov word [rbp - 0x2c], 0x20
mov word [rbp - 0x2a], 0x54
mov word [rbp - 0x28], 0x6f
mov word [rbp - 0x26], 0x6f
mov word [rbp - 0x24], 0x6c
mov word [rbp - 0x22], 0x73
mov word [rbp - 0x20], 0
lea rax, [rbp - 0x60]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0
jmp 0x140008a66
mov rax, qword [rbp - 8]
mov rax, qword [rbp + rax*8 - 0x10]
mov rdx, rax
mov rcx, 0xffffffff80000002
call fcn.140003c5d
test eax, eax
je 0x140008a61
mov eax, 1
jmp 0x140008a72
add qword [rbp - 8], 1
cmp qword [rbp - 8], 0
je 0x140008a3e
mov eax, 0
sub rsp, 0xffffffffffffff80
pop rbp
ret
Function at 0x140009b18
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x4d0
lea rbp, [rsp + 0x80]
mov byte [rbp + 0x400], 0x53
mov byte [rbp + 0x401], 0x48
mov byte [rbp + 0x402], 0x47
mov byte [rbp + 0x403], 0x65
mov byte [rbp + 0x404], 0x74
mov byte [rbp + 0x405], 0x53
mov byte [rbp + 0x406], 0x70
mov byte [rbp + 0x407], 0x65
mov byte [rbp + 0x408], 0x63
mov byte [rbp + 0x409], 0x69
mov byte [rbp + 0x40a], 0x61
mov byte [rbp + 0x40b], 0x6c
mov byte [rbp + 0x40c], 0x46
mov byte [rbp + 0x40d], 0x6f
mov byte [rbp + 0x40e], 0x6c
mov byte [rbp + 0x40f], 0x64
mov byte [rbp + 0x410], 0x65
mov byte [rbp + 0x411], 0x72
mov byte [rbp + 0x412], 0x50
mov byte [rbp + 0x413], 0x61
mov byte [rbp + 0x414], 0x74
mov byte [rbp + 0x415], 0x68
mov byte [rbp + 0x416], 0x57
mov byte [rbp + 0x417], 0
mov word [rbp + 0x420], 0x53
mov word [rbp + 0x422], 0x48
mov word [rbp + 0x424], 0x45
mov word [rbp + 0x426], 0x4c
mov word [rbp + 0x428], 0x4c
mov word [rbp + 0x42a], 0x33
mov word [rbp + 0x42c], 0x32
mov word [rbp + 0x42e], 0x2e
mov word [rbp + 0x430], 0x44
mov word [rbp + 0x432], 0x4c
mov word [rbp + 0x434], 0x4c
mov word [rbp + 0x436], 0
lea rdx, [rbp + 0x400]
lea rax, [rbp + 0x420]
mov rcx, rax
call fcn.14000178c
mov qword [rbp + 0x448], rax
mov byte [rbp + 0x3d3], 0x50
mov byte [rbp + 0x3d4], 0x61
mov byte [rbp + 0x3d5], 0x74
mov byte [rbp + 0x3d6], 0x68
mov byte [rbp + 0x3d7], 0x43
mov byte [rbp + 0x3d8], 0x6f
mov byte [rbp + 0x3d9], 0x6d
mov byte [rbp + 0x3da], 0x62
mov byte [rbp + 0x3db], 0x69
mov byte [rbp + 0x3dc], 0x6e
mov byte [rbp + 0x3dd], 0x65
mov byte [rbp + 0x3de], 0x57
mov byte [rbp + 0x3df], 0
mov word [rbp + 0x3e0], 0x53
mov word [rbp + 0x3e2], 0x48
mov word [rbp + 0x3e4], 0x4c
mov word [rbp + 0x3e6], 0x57
mov word [rbp + 0x3e8], 0x41
mov word [rbp + 0x3ea], 0x50
mov word [rbp + 0x3ec], 0x49
mov word [rbp + 0x3ee], 0x2e
mov word [rbp + 0x3f0], 0x44
mov word [rbp + 0x3f2], 0x4c
mov word [rbp + 0x3f4], 0x4c
mov word [rbp + 0x3f6], 0
lea rdx, [rbp + 0x3d3]
lea rax, [rbp + 0x3e0]
mov rcx, rax
call fcn.14000178c
mov qword [rbp + 0x440], rax
lea rax, [rbp + 0x1c0]
mov r10, qword [rbp + 0x448]
mov r9d, 0
mov r8d, 0x26
mov rdx, rax
mov ecx, 0
call r10
mov word [rbp - 0x60], 0x56
mov word [rbp - 0x5e], 0x4d
mov word [rbp - 0x5c], 0x57
mov word [rbp - 0x5a], 0x61
mov word [rbp - 0x58], 0x72
mov word [rbp - 0x56], 0x65
mov word [rbp - 0x54], 0x5c
mov word [rbp - 0x52], 0
lea rcx, [rbp - 0x60]
lea rdx, [rbp + 0x1c0]
lea rax, [rbp - 0x50]
mov r9, qword [rbp + 0x440]
mov r8, rcx
mov rcx, rax
call r9
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.14000369c
test eax, eax
je 0x140009dc8
mov eax, 1
jmp 0x140009dcd
mov eax, 0
add rsp, 0x4d0
pop rbp
ret
Function at 0x140009dd6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x110
lea rbp, [rsp + 0x80]
mov byte [rbp + 0x44], 0x43
mov byte [rbp + 0x45], 0x72
mov byte [rbp + 0x46], 0x65
mov byte [rbp + 0x47], 0x61
mov byte [rbp + 0x48], 0x74
mov byte [rbp + 0x49], 0x65
mov byte [rbp + 0x4a], 0x46
mov byte [rbp + 0x4b], 0x69
mov byte [rbp + 0x4c], 0x6c
mov byte [rbp + 0x4d], 0x65
mov byte [rbp + 0x4e], 0x57
mov byte [rbp + 0x4f], 0
mov word [rbp + 0x50], 0x4b
mov word [rbp + 0x52], 0x45
mov word [rbp + 0x54], 0x52
mov word [rbp + 0x56], 0x4e
mov word [rbp + 0x58], 0x45
mov word [rbp + 0x5a], 0x4c
mov word [rbp + 0x5c], 0x33
mov word [rbp + 0x5e], 0x32
mov word [rbp + 0x60], 0x2e
mov word [rbp + 0x62], 0x44
mov word [rbp + 0x64], 0x4c
mov word [rbp + 0x66], 0x4c
mov word [rbp + 0x68], 0
lea rdx, [rbp + 0x44]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.14000178c
mov qword [rbp + 0x80], rax
mov byte [rbp + 0x14], 0x43
mov byte [rbp + 0x15], 0x6c
mov byte [rbp + 0x16], 0x6f
mov byte [rbp + 0x17], 0x73
mov byte [rbp + 0x18], 0x65
mov byte [rbp + 0x19], 0x48
mov byte [rbp + 0x1a], 0x61
mov byte [rbp + 0x1b], 0x6e
mov byte [rbp + 0x1c], 0x64
mov byte [rbp + 0x1d], 0x6c
mov byte [rbp + 0x1e], 0x65
mov byte [rbp + 0x1f], 0
mov word [rbp + 0x20], 0x4b
mov word [rbp + 0x22], 0x45
mov word [rbp + 0x24], 0x52
mov word [rbp + 0x26], 0x4e
mov word [rbp + 0x28], 0x45
mov word [rbp + 0x2a], 0x4c
mov word [rbp + 0x2c], 0x33
mov word [rbp + 0x2e], 0x32
mov word [rbp + 0x30], 0x2e
mov word [rbp + 0x32], 0x44
mov word [rbp + 0x34], 0x4c
mov word [rbp + 0x36], 0x4c
mov word [rbp + 0x38], 0
lea rdx, [rbp + 0x14]
lea rax, [rbp + 0x20]
mov rcx, rax
call fcn.14000178c
mov qword [rbp + 0x78], rax
mov word [rbp - 0x20], 0x5c
mov word [rbp - 0x1e], 0x5c
mov word [rbp - 0x1c], 0x2e
mov word [rbp - 0x1a], 0x5c
mov word [rbp - 0x18], 0x48
mov word [rbp - 0x16], 0x47
mov word [rbp - 0x14], 0x46
mov word [rbp - 0x12], 0x53
mov word [rbp - 0x10], 0
lea rax, [rbp - 0x20]
mov qword [rbp], rax
mov word [rbp - 0x40], 0x5c
mov word [rbp - 0x3e], 0x5c
mov word [rbp - 0x3c], 0x2e
mov word [rbp - 0x3a], 0x5c
mov word [rbp - 0x38], 0x76
mov word [rbp - 0x36], 0x6d
mov word [rbp - 0x34], 0x63
mov word [rbp - 0x32], 0x69
mov word [rbp - 0x30], 0
lea rax, [rbp - 0x40]
mov qword [rbp + 8], rax
mov qword [rbp + 0x88], 0
jmp 0x14000a000
mov rax, qword [rbp + 0x88]
mov rax, qword [rbp + rax*8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r10, qword [rbp + 0x80]
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
call r10
mov qword [rbp + 0x70], rax
cmp qword [rbp + 0x70], 0xffffffffffffffff
je 0x140009ff8
mov rax, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x78]
mov rcx, rax
call rdx
mov eax, 1
jmp 0x14000a00f
add qword [rbp + 0x88], 1
cmp qword [rbp + 0x88], 1
jbe 0x140009f96
mov eax, 0
add rsp, 0x110
pop rbp
ret
Function at 0x14000a018
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x100
lea rbp, [rsp + 0x80]
mov word [rbp + 0x30], 0x76
mov word [rbp + 0x32], 0x6d
mov word [rbp + 0x34], 0x74
mov word [rbp + 0x36], 0x6f
mov word [rbp + 0x38], 0x6f
mov word [rbp + 0x3a], 0x6c
mov word [rbp + 0x3c], 0x73
mov word [rbp + 0x3e], 0x64
mov word [rbp + 0x40], 0x2e
mov word [rbp + 0x42], 0x65
mov word [rbp + 0x44], 0x78
mov word [rbp + 0x46], 0x65
mov word [rbp + 0x48], 0
lea rax, [rbp + 0x30]
mov qword [rbp + 0x50], rax
mov word [rbp + 0x10], 0x76
mov word [rbp + 0x12], 0x6d
mov word [rbp + 0x14], 0x77
mov word [rbp + 0x16], 0x61
mov word [rbp + 0x18], 0x72
mov word [rbp + 0x1a], 0x65
mov word [rbp + 0x1c], 0x74
mov word [rbp + 0x1e], 0x72
mov word [rbp + 0x20], 0x61
mov word [rbp + 0x22], 0x79
mov word [rbp + 0x24], 0x2e
mov word [rbp + 0x26], 0x65
mov word [rbp + 0x28], 0x78
mov word [rbp + 0x2a], 0x65
mov word [rbp + 0x2c], 0
lea rax, [rbp + 0x10]
mov qword [rbp + 0x58], rax
mov word [rbp - 0x10], 0x76
mov word [rbp - 0xe], 0x6d
mov word [rbp - 0xc], 0x77
mov word [rbp - 0xa], 0x61
mov word [rbp - 8], 0x72
mov word [rbp - 6], 0x65
mov word [rbp - 4], 0x75
mov word [rbp - 2], 0x73
mov word [rbp], 0x65
mov word [rbp + 2], 0x72
mov word [rbp + 4], 0x2e
mov word [rbp + 6], 0x65
mov word [rbp + 8], 0x78
mov word [rbp + 0xa], 0x65
mov word [rbp + 0xc], 0
lea rax, [rbp - 0x10]
mov qword [rbp + 0x60], rax
mov word [rbp - 0x40], 0x56
mov word [rbp - 0x3e], 0x47
mov word [rbp - 0x3c], 0x41
mov word [rbp - 0x3a], 0x75
mov word [rbp - 0x38], 0x74
mov word [rbp - 0x36], 0x68
mov word [rbp - 0x34], 0x53
mov word [rbp - 0x32], 0x65
mov word [rbp - 0x30], 0x72
mov word [rbp - 0x2e], 0x76
mov word [rbp - 0x2c], 0x69
mov word [rbp - 0x2a], 0x63
mov word [rbp - 0x28], 0x65
mov word [rbp - 0x26], 0x2e
mov word [rbp - 0x24], 0x65
mov word [rbp - 0x22], 0x78
mov word [rbp - 0x20], 0x65
mov word [rbp - 0x1e], 0
lea rax, [rbp - 0x40]
mov qword [rbp + 0x68], rax
mov word [rbp - 0x60], 0x76
mov word [rbp - 0x5e], 0x6d
mov word [rbp - 0x5c], 0x61
mov word [rbp - 0x5a], 0x63
mov word [rbp - 0x58], 0x74
mov word [rbp - 0x56], 0x68
mov word [rbp - 0x54], 0x6c
mov word [rbp - 0x52], 0x70
mov word [rbp - 0x50], 0x2e
mov word [rbp - 0x4e], 0x65
mov word [rbp - 0x4c], 0x78
mov word [rbp - 0x4a], 0x65
mov word [rbp - 0x48], 0
lea rax, [rbp - 0x60]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], 0
jmp 0x14000a237
mov rax, qword [rbp + 0x78]
mov rax, qword [rbp + rax*8 + 0x50]
mov rcx, rax
call fcn.140003df1
test eax, eax
je 0x14000a232
mov eax, 1
jmp 0x14000a243
add qword [rbp + 0x78], 1
cmp qword [rbp + 0x78], 4
jbe 0x14000a216
mov eax, 0
add rsp, 0x100
pop rbp
ret
Function at 0x14000a5d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call fcn.14000b3d0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop dword [rax]

Function at 0x14000a640
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140010094]
mov rbx, rcx
test esi, esi
jle 0x14000a770
mov rax, qword [0x140010098]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000a68b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14000a715
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14000a670
mov rcx, rbx
call fcn.14000b0b0
mov rdi, rax
test rax, rax
je 0x14000a792
mov rax, qword [0x140010098]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14000b1f0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140010098]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000a777
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14000a70e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x14000a720
add dword [0x140010094], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140010098]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000a70e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000a5d0
nop dword [rax]
xor esi, esi
jmp 0x14000a698
mov rax, qword [0x140010098]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14000a5d0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.14000a5d0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x14000ad20
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140010100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400100e0]
test rbx, rbx
je 0x14000ad7c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x14000ad73
test eax, eax
jne 0x14000ad73
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000ad58
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x14000b0b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000d3c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14000b0d0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14000b0d8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000b0d0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000b12d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000b124
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000b0d0
add rax, 0x28
cmp rax, r9
jne 0x14000b110
xor eax, eax
ret

Function at 0x14000b130
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000d3c0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000b14f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14000b158
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000b14f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14000b1f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000d3c0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000b20f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14000b218
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret