joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003c7c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x5a
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x11
mov byte [rsp + 0x25], 0x57
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x57
mov byte [rsp + 0x28], 0x44
mov byte [rsp + 0x29], 0x4f
mov byte [rsp + 0x2a], 0x44
mov byte [rsp + 0x2b], 0x47
mov byte [rsp + 0x2c], 0x45
mov byte [rsp + 0x2d], 0x4f
mov byte [rsp + 0x2e], 0x52
mov byte [rsp + 0x2f], 0x46
mov byte [rsp + 0x30], 0x4e
mov byte [rsp + 0x31], 0x11
mov byte [rsp + 0x32], 0x46
mov byte [rsp + 0x33], 0x52
mov byte [rsp + 0x34], 0x50
mov byte [rsp + 0x35], 0xe3
cmp byte [0x1409f2710], 0
jne 0x140003d2f
mov byte [0x1409f2736], 1
mov eax, 0
lea rcx, [0x1409f2720]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x16
jne 0x140003d0a
mov byte [0x1409f2710], 1
lea rcx, [0x140001805]
call fcn.1400014f0
lea rax, [0x1409f2720]
add rsp, 0x48
ret

Function at 0x140003d3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x5a
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x11
mov byte [rsp + 0x25], 0x50
mov byte [rsp + 0x26], 0x44
mov byte [rsp + 0x27], 0x4f
mov byte [rsp + 0x28], 0x5a
mov byte [rsp + 0x29], 0x44
mov byte [rsp + 0x2a], 0x55
mov byte [rsp + 0x2b], 0x48
mov byte [rsp + 0x2c], 0x45
mov byte [rsp + 0x2d], 0x5c
mov byte [rsp + 0x2e], 0x57
mov byte [rsp + 0x2f], 0x48
mov byte [rsp + 0x30], 0x56
mov byte [rsp + 0x31], 0x11
mov byte [rsp + 0x32], 0x46
mov byte [rsp + 0x33], 0x52
mov byte [rsp + 0x34], 0x50
mov byte [rsp + 0x35], 0xe3
cmp byte [0x1409f25a8], 0
jne 0x140003def
mov byte [0x1409f25c6], 1
mov eax, 0
lea rcx, [0x1409f25b0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x16
jne 0x140003dca
mov byte [0x1409f25a8], 1
lea rcx, [0x140001925]
call fcn.1400014f0
lea rax, [0x1409f25b0]
add rsp, 0x48
ret

Function at 0x140003dfc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x5a
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x11
mov byte [rsp + 0x25], 0x50
mov byte [rsp + 0x26], 0x46
mov byte [rsp + 0x27], 0x44
mov byte [rsp + 0x28], 0x49
mov byte [rsp + 0x29], 0x48
mov byte [rsp + 0x2a], 0x48
mov byte [rsp + 0x2b], 0x11
mov byte [rsp + 0x2c], 0x46
mov byte [rsp + 0x2d], 0x52
mov byte [rsp + 0x2e], 0x50
mov byte [rsp + 0x2f], 0xe3
cmp byte [0x1409f2698], 0
jne 0x140003e91
mov byte [0x1409f26b0], 1
mov eax, 0
lea rcx, [0x1409f26a0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x140003e6c
mov byte [0x1409f2698], 1
lea rcx, [0x140001865]
call fcn.1400014f0
lea rax, [0x1409f26a0]
add rsp, 0x38
ret
Function at 0x140003e9e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x5a
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x11
mov byte [rsp + 0x25], 0x51
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x55
mov byte [rsp + 0x28], 0x57
mov byte [rsp + 0x29], 0x52
mov byte [rsp + 0x2a], 0x51
mov byte [rsp + 0x2b], 0x11
mov byte [rsp + 0x2c], 0x46
mov byte [rsp + 0x2d], 0x52
mov byte [rsp + 0x2e], 0x50
mov byte [rsp + 0x2f], 0xe3
cmp byte [0x1409f24b0], 0
jne 0x140003f33
mov byte [0x1409f24d0], 1
mov eax, 0
lea rcx, [0x1409f24c0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x140003f0e
mov byte [0x1409f24b0], 1
lea rcx, [0x1400019e5]
call fcn.1400014f0
lea rax, [0x1409f24c0]
add rsp, 0x38
ret

Function at 0x140003f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x5a
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x11
mov byte [rsp + 0x25], 0x5d
mov byte [rsp + 0x26], 0x4c
mov byte [rsp + 0x27], 0x4f
mov byte [rsp + 0x28], 0x4f
mov byte [rsp + 0x29], 0x5c
mov byte [rsp + 0x2a], 0x44
mov byte [rsp + 0x2b], 0x11
mov byte [rsp + 0x2c], 0x46
mov byte [rsp + 0x2d], 0x52
mov byte [rsp + 0x2e], 0x50
mov byte [rsp + 0x2f], 0xe3
cmp byte [0x1409f2440], 0
jne 0x140003fd5
mov byte [0x1409f2460], 1
mov eax, 0
lea rcx, [0x1409f2450]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x140003fb0
mov byte [0x1409f2440], 1
lea rcx, [0x140001a45]
call fcn.1400014f0
lea rax, [0x1409f2450]
add rsp, 0x38
ret

Function at 0x140003fe2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x5a
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x11
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x53
mov byte [rsp + 0x28], 0x4b
mov byte [rsp + 0x29], 0x52
mov byte [rsp + 0x2a], 0x56
mov byte [rsp + 0x2b], 0x11
mov byte [rsp + 0x2c], 0x46
mov byte [rsp + 0x2d], 0x52
mov byte [rsp + 0x2e], 0x50
mov byte [rsp + 0x2f], 0xe3
cmp byte [0x1409f2348], 0
jne 0x140004077
mov byte [0x1409f2360], 1
mov eax, 0
lea rcx, [0x1409f2350]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x140004052
mov byte [0x1409f2348], 1
lea rcx, [0x140001b05]
call fcn.1400014f0
lea rax, [0x1409f2350]
add rsp, 0x38
ret
Function at 0x140004084
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x5a
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x11
mov byte [rsp + 0x25], 0x44
mov byte [rsp + 0x26], 0x4b
mov byte [rsp + 0x27], 0x51
mov byte [rsp + 0x28], 0x4f
mov byte [rsp + 0x29], 0x44
mov byte [rsp + 0x2a], 0x45
mov byte [rsp + 0x2b], 0x11
mov byte [rsp + 0x2c], 0x46
mov byte [rsp + 0x2d], 0x52
mov byte [rsp + 0x2e], 0x50
mov byte [rsp + 0x2f], 0xe3
cmp byte [0x1409f22a8], 0
jne 0x140004119
mov byte [0x1409f22c0], 1
mov eax, 0
lea rcx, [0x1409f22b0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x1400040f4
mov byte [0x1409f22a8], 1
lea rcx, [0x140001b7d]
call fcn.1400014f0
lea rax, [0x1409f22b0]
add rsp, 0x38
ret

Function at 0x140004126
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x5a
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x11
mov byte [rsp + 0x25], 0x46
mov byte [rsp + 0x26], 0x4f
mov byte [rsp + 0x27], 0x44
mov byte [rsp + 0x28], 0x50
mov byte [rsp + 0x29], 0x44
mov byte [rsp + 0x2a], 0x59
mov byte [rsp + 0x2b], 0x11
mov byte [rsp + 0x2c], 0x51
mov byte [rsp + 0x2d], 0x48
mov byte [rsp + 0x2e], 0x57
mov byte [rsp + 0x2f], 0xe3
cmp byte [0x1409f21d0], 0
jne 0x1400041bb
mov byte [0x1409f21f0], 1
mov eax, 0
lea rcx, [0x1409f21e0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x140004196
mov byte [0x1409f21d0], 1
lea rcx, [0x140001c25]
call fcn.1400014f0
lea rax, [0x1409f21e0]
add rsp, 0x38
ret

Function at 0x1400041c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x57
mov byte [rsp + 0x22], 0x55
mov byte [rsp + 0x23], 0x48
mov byte [rsp + 0x24], 0x51
mov byte [rsp + 0x25], 0x47
mov byte [rsp + 0x26], 0x50
mov byte [rsp + 0x27], 0x4c
mov byte [rsp + 0x28], 0x46
mov byte [rsp + 0x29], 0x55
mov byte [rsp + 0x2a], 0x52
mov byte [rsp + 0x2b], 0x11
mov byte [rsp + 0x2c], 0x46
mov byte [rsp + 0x2d], 0x52
mov byte [rsp + 0x2e], 0x50
mov byte [rsp + 0x2f], 0xe3
cmp byte [0x1409f2068], 0
jne 0x14000425d
mov byte [0x1409f2080], 1
mov eax, 0
lea rcx, [0x1409f2070]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x140004238
mov byte [0x1409f2068], 1
lea rcx, [0x140001d45]
call fcn.1400014f0
lea rax, [0x1409f2070]
add rsp, 0x38
ret
Function at 0x14000426a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x59
mov byte [rsp + 0x22], 0x4c
mov byte [rsp + 0x23], 0x55
mov byte [rsp + 0x24], 0x58
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x57
mov byte [rsp + 0x27], 0x52
mov byte [rsp + 0x28], 0x57
mov byte [rsp + 0x29], 0x44
mov byte [rsp + 0x2a], 0x4f
mov byte [rsp + 0x2b], 0x11
mov byte [rsp + 0x2c], 0x46
mov byte [rsp + 0x2d], 0x52
mov byte [rsp + 0x2e], 0x50
mov byte [rsp + 0x2f], 0xe3
cmp byte [0x1409f1fe8], 0
jne 0x1400042ff
mov byte [0x1409f2000], 1
mov eax, 0
lea rcx, [0x1409f1ff0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x1400042da
mov byte [0x1409f1fe8], 1
lea rcx, [0x140001da5]
call fcn.1400014f0
lea rax, [0x1409f1ff0]
add rsp, 0x38
ret

Function at 0x14000430c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x5a
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x11
mov byte [rsp + 0x25], 0x45
mov byte [rsp + 0x26], 0x4c
mov byte [rsp + 0x27], 0x57
mov byte [rsp + 0x28], 0x47
mov byte [rsp + 0x29], 0x48
mov byte [rsp + 0x2a], 0x49
mov byte [rsp + 0x2b], 0x48
mov byte [rsp + 0x2c], 0x51
mov byte [rsp + 0x2d], 0x47
mov byte [rsp + 0x2e], 0x48
mov byte [rsp + 0x2f], 0x55
mov byte [rsp + 0x30], 0x11
mov byte [rsp + 0x31], 0x46
mov byte [rsp + 0x32], 0x52
mov byte [rsp + 0x33], 0x50
mov byte [rsp + 0x34], 0xe3
cmp byte [0x1409f2650], 0
jne 0x1400043ba
mov byte [0x1409f2675], 1
mov eax, 0
lea rcx, [0x1409f2660]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x15
jne 0x140004395
mov byte [0x1409f2650], 1
lea rcx, [0x140001895]
call fcn.1400014f0
lea rax, [0x1409f2660]
add rsp, 0x48
ret

Function at 0x1400043c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x5a
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x11
mov byte [rsp + 0x25], 0x4b
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x50
mov byte [rsp + 0x28], 0x48
mov byte [rsp + 0x29], 0x11
mov byte [rsp + 0x2a], 0x56
mov byte [rsp + 0x2b], 0x52
mov byte [rsp + 0x2c], 0x53
mov byte [rsp + 0x2d], 0x4b
mov byte [rsp + 0x2e], 0x52
mov byte [rsp + 0x2f], 0x56
mov byte [rsp + 0x30], 0x11
mov byte [rsp + 0x31], 0x46
mov byte [rsp + 0x32], 0x52
mov byte [rsp + 0x33], 0x50
mov byte [rsp + 0x34], 0xe3
cmp byte [0x1409f2308], 0
jne 0x140004474
mov byte [0x1409f2325], 1
mov eax, 0
lea rcx, [0x1409f2310]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x15
jne 0x14000444f
mov byte [0x1409f2308], 1
lea rcx, [0x140001b35]
call fcn.1400014f0
lea rax, [0x1409f2310]
add rsp, 0x48
ret
Function at 0x140004480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x5a
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x11
mov byte [rsp + 0x25], 0x53
mov byte [rsp + 0x26], 0x44
mov byte [rsp + 0x27], 0x51
mov byte [rsp + 0x28], 0x47
mov byte [rsp + 0x29], 0x44
mov byte [rsp + 0x2a], 0x56
mov byte [rsp + 0x2b], 0x48
mov byte [rsp + 0x2c], 0x46
mov byte [rsp + 0x2d], 0x58
mov byte [rsp + 0x2e], 0x55
mov byte [rsp + 0x2f], 0x4c
mov byte [rsp + 0x30], 0x57
mov byte [rsp + 0x31], 0x5c
mov byte [rsp + 0x32], 0x11
mov byte [rsp + 0x33], 0x46
mov byte [rsp + 0x34], 0x52
mov byte [rsp + 0x35], 0x50
mov byte [rsp + 0x36], 0xe3
cmp byte [0x1409f2560], 0
jne 0x140004538
mov byte [0x1409f2587], 1
mov eax, 0
lea rcx, [0x1409f2570]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x17
jne 0x140004513
mov byte [0x1409f2560], 1
lea rcx, [0x140001955]
call fcn.1400014f0
lea rax, [0x1409f2570]
add rsp, 0x48
ret

Function at 0x140004544
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x5a
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x11
mov byte [rsp + 0x25], 0x58
mov byte [rsp + 0x26], 0x56
mov byte [rsp + 0x27], 0x44
mov byte [rsp + 0x28], 0x11
mov byte [rsp + 0x29], 0x4e
mov byte [rsp + 0x2a], 0x44
mov byte [rsp + 0x2b], 0x56
mov byte [rsp + 0x2c], 0x53
mov byte [rsp + 0x2d], 0x48
mov byte [rsp + 0x2e], 0x55
mov byte [rsp + 0x2f], 0x56
mov byte [rsp + 0x30], 0x4e
mov byte [rsp + 0x31], 0x5c
mov byte [rsp + 0x32], 0x11
mov byte [rsp + 0x33], 0x46
mov byte [rsp + 0x34], 0x52
mov byte [rsp + 0x35], 0x50
mov byte [rsp + 0x36], 0xe3
cmp byte [0x1409f23c0], 0
jne 0x1400045fc
mov byte [0x1409f23e7], 1
mov eax, 0
lea rcx, [0x1409f23d0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x17
jne 0x1400045d7
mov byte [0x1409f23c0], 1
lea rcx, [0x140001aa5]
call fcn.1400014f0
lea rax, [0x1409f23d0]
add rsp, 0x48
ret

Function at 0x140004608
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x5a
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x11
mov byte [rsp + 0x25], 0x53
mov byte [rsp + 0x26], 0x44
mov byte [rsp + 0x27], 0x51
mov byte [rsp + 0x28], 0x47
mov byte [rsp + 0x29], 0x44
mov byte [rsp + 0x2a], 0x56
mov byte [rsp + 0x2b], 0x48
mov byte [rsp + 0x2c], 0x46
mov byte [rsp + 0x2d], 0x58
mov byte [rsp + 0x2e], 0x55
mov byte [rsp + 0x2f], 0x4c
mov byte [rsp + 0x30], 0x57
mov byte [rsp + 0x31], 0x5c
mov byte [rsp + 0x32], 0x11
mov byte [rsp + 0x33], 0x46
mov byte [rsp + 0x34], 0x52
mov byte [rsp + 0x35], 0x50
mov byte [rsp + 0x36], 0xe3
cmp byte [0x1409f2108], 0
jne 0x1400046c0
mov byte [0x1409f2127], 1
mov eax, 0
lea rcx, [0x1409f2110]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x17
jne 0x14000469b
mov byte [0x1409f2108], 1
lea rcx, [0x140001ccd]
call fcn.1400014f0
lea rax, [0x1409f2110]
add rsp, 0x48
ret
Function at 0x1400046cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x22], 3
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x5a
mov byte [rsp + 0x25], 0x5a
mov byte [rsp + 0x26], 0x11
mov byte [rsp + 0x27], 0x48
mov byte [rsp + 0x28], 0x56
mov byte [rsp + 0x29], 0x48
mov byte [rsp + 0x2a], 0x57
mov byte [rsp + 0x2b], 0x11
mov byte [rsp + 0x2c], 0x46
mov byte [rsp + 0x2d], 0x52
mov byte [rsp + 0x2e], 0x50
mov byte [rsp + 0x2f], 0xe3
cmp byte [0x1409f2480], 0
jne 0x140004757
mov byte [0x1409f2496], 1
mov eax, 0
lea rcx, [0x1409f2488]
movzx edx, byte [rsp + rax + 0x22]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xe
jne 0x140004732
mov byte [0x1409f2480], 1
lea rcx, [0x140001a15]
call fcn.1400014f0
lea rax, [0x1409f2488]
add rsp, 0x38
ret

Function at 0x140004764
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x22], 3
mov byte [rsp + 0x23], 0x48
mov byte [rsp + 0x24], 0x50
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x4c
mov byte [rsp + 0x27], 0x56
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x49
mov byte [rsp + 0x2a], 0x57
mov byte [rsp + 0x2b], 0x11
mov byte [rsp + 0x2c], 0x46
mov byte [rsp + 0x2d], 0x52
mov byte [rsp + 0x2e], 0x50
mov byte [rsp + 0x2f], 0xe3
cmp byte [0x1409f2188], 0
jne 0x1400047ef
mov byte [0x1409f219e], 1
mov eax, 0
lea rcx, [0x1409f2190]
movzx edx, byte [rsp + rax + 0x22]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xe
jne 0x1400047ca
mov byte [0x1409f2188], 1
lea rcx, [0x140001c6d]
call fcn.1400014f0
lea rax, [0x1409f2190]
add rsp, 0x38
ret

Function at 0x1400047fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x22], 3
mov byte [rsp + 0x23], 0x49
mov byte [rsp + 0x24], 0x10
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x48
mov byte [rsp + 0x27], 0x46
mov byte [rsp + 0x28], 0x58
mov byte [rsp + 0x29], 0x55
mov byte [rsp + 0x2a], 0x48
mov byte [rsp + 0x2b], 0x11
mov byte [rsp + 0x2c], 0x46
mov byte [rsp + 0x2d], 0x52
mov byte [rsp + 0x2e], 0x50
mov byte [rsp + 0x2f], 0xe3
cmp byte [0x1409f2128], 0
jne 0x140004887
mov byte [0x1409f213e], 1
mov eax, 0
lea rcx, [0x1409f2130]
movzx edx, byte [rsp + rax + 0x22]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xe
jne 0x140004862
mov byte [0x1409f2128], 1
lea rcx, [0x140001cb5]
call fcn.1400014f0
lea rax, [0x1409f2130]
add rsp, 0x38
ret

Function at 0x140004894
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x22], 3
mov byte [rsp + 0x23], 0x46
mov byte [rsp + 0x24], 0x46
mov byte [rsp + 0x25], 0x4f
mov byte [rsp + 0x26], 0x48
mov byte [rsp + 0x27], 0x44
mov byte [rsp + 0x28], 0x51
mov byte [rsp + 0x29], 0x48
mov byte [rsp + 0x2a], 0x55
mov byte [rsp + 0x2b], 0x11
mov byte [rsp + 0x2c], 0x46
mov byte [rsp + 0x2d], 0x52
mov byte [rsp + 0x2e], 0x50
mov byte [rsp + 0x2f], 0xe3
cmp byte [0x1409f2028], 0
jne 0x14000491f
mov byte [0x1409f203e], 1
mov eax, 0
lea rcx, [0x1409f2030]
movzx edx, byte [rsp + rax + 0x22]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xe
jne 0x1400048fa
mov byte [0x1409f2028], 1
lea rcx, [0x140001d75]
call fcn.1400014f0
lea rax, [0x1409f2030]
add rsp, 0x38
ret
Function at 0x14000492c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x5a
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x11
mov byte [rsp + 0x25], 0x57
mov byte [rsp + 0x26], 0x55
mov byte [rsp + 0x27], 0x48
mov byte [rsp + 0x28], 0x51
mov byte [rsp + 0x29], 0x47
mov byte [rsp + 0x2a], 0x50
mov byte [rsp + 0x2b], 0x4c
mov byte [rsp + 0x2c], 0x46
mov byte [rsp + 0x2d], 0x55
mov byte [rsp + 0x2e], 0x52
mov byte [rsp + 0x2f], 0x11
mov byte [rsp + 0x30], 0x46
mov byte [rsp + 0x31], 0x52
mov byte [rsp + 0x32], 0x50
mov byte [rsp + 0x33], 0xe3
cmp byte [0x1409f2088], 0
jne 0x1400049d5
mov byte [0x1409f20a4], 1
mov eax, 0
lea rcx, [0x1409f2090]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x14
jne 0x1400049b0
mov byte [0x1409f2088], 1
lea rcx, [0x140001d2d]
call fcn.1400014f0
lea rax, [0x1409f2090]
add rsp, 0x48
ret

Function at 0x1400049e2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 3
mov byte [rsp + 0x21], 0x5a
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x11
mov byte [rsp + 0x25], 0x59
mov byte [rsp + 0x26], 0x4c
mov byte [rsp + 0x27], 0x55
mov byte [rsp + 0x28], 0x58
mov byte [rsp + 0x29], 0x56
mov byte [rsp + 0x2a], 0x57
mov byte [rsp + 0x2b], 0x52
mov byte [rsp + 0x2c], 0x57
mov byte [rsp + 0x2d], 0x44
mov byte [rsp + 0x2e], 0x4f
mov byte [rsp + 0x2f], 0x11
mov byte [rsp + 0x30], 0x46
mov byte [rsp + 0x31], 0x52
mov byte [rsp + 0x32], 0x50
mov byte [rsp + 0x33], 0xe3
cmp byte [0x1409f2008], 0
jne 0x140004a8b
mov byte [0x1409f2024], 1
mov eax, 0
lea rcx, [0x1409f2010]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x14
jne 0x140004a66
mov byte [0x1409f2008], 1
lea rcx, [0x140001d8d]
call fcn.1400014f0
lea rax, [0x1409f2010]
add rsp, 0x48
ret
Function at 0x140004dff
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r12, rcx
test edx, edx
je 0x140004f73
mov r13d, edx
mov edi, 0
lea r14, [0x140001530]
lea rbx, [0x1409f3061]
jmp 0x140004e65
mov byte [0x1409f3061], 0
mov edx, esi
sar edx, 0x1f
shr edx, 0x1b
lea eax, [rsi + rdx]
and eax, 0x1f
sub eax, edx
cdqe
lea rdx, [0x1409f3040]
xor bpl, byte [rdx + rax]
mov byte [r12 + rdi], bpl
add rdi, 1
cmp r13, rdi
je 0x140004f73
mov esi, edi
movzx ebp, byte [r12 + rdi]
mov byte [rsp + 0x20], 0x7d
mov byte [rsp + 0x21], 0x7b
mov byte [rsp + 0x22], 0x75
mov byte [rsp + 0x23], 0x7b
mov byte [rsp + 0x24], 0x82
mov byte [rsp + 0x25], 0x7e
mov byte [rsp + 0x26], 0x81
mov byte [rsp + 0x27], 0x7a
mov byte [rsp + 0x28], 0x83
mov byte [rsp + 0x29], 0x79
mov byte [rsp + 0x2a], 0x74
mov byte [rsp + 0x2b], 0x74
mov byte [rsp + 0x2c], 0x85
mov byte [rsp + 0x2d], 0x7e
mov byte [rsp + 0x2e], 0x8c
mov byte [rsp + 0x2f], 0x78
mov byte [rsp + 0x30], 0x8a
mov byte [rsp + 0x31], 0x7c
mov byte [rsp + 0x32], 0x76
mov byte [rsp + 0x33], 0x87
mov byte [rsp + 0x34], 0x77
mov byte [rsp + 0x35], 0x7e
mov byte [rsp + 0x36], 0x88
mov byte [rsp + 0x37], 0x75
mov byte [rsp + 0x38], 0x79
mov byte [rsp + 0x39], 0x7a
mov byte [rsp + 0x3a], 0x77
mov byte [rsp + 0x3b], 0x7b
mov byte [rsp + 0x3c], 0x82
mov byte [rsp + 0x3d], 0x87
mov byte [rsp + 0x3e], 0x78
mov byte [rsp + 0x3f], 0x75
mov byte [rsp + 0x40], 0x13
cmp byte [0x1409f3020], 0
jne 0x140004f4e
mov byte [0x1409f3061], 1
mov eax, 0
lea rcx, [0x1409f3040]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x21
jne 0x140004f2d
mov byte [0x1409f3020], 1
mov rcx, r14
call fcn.1400014f0
cmp byte [0x1409f3061], 0
je 0x140004e37
lea rax, [0x1409f3040]
sub byte [rax], 0x13
add rax, 1
cmp rbx, rax
jne 0x140004f62
jmp 0x140004e30
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14000a930
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x14000a960
mov eax, 0
cmp word [rcx], 0x5a4d
jne 0x14000a95f
mov eax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x14000a965
cdqe
add rax, rcx
cmp dword [rax], 0x4550
mov edx, 0
cmovne rax, rdx
ret
mov rax, rcx
jmp 0x14000a95f
mov eax, 0
jmp 0x14000a95f

Function at 0x14000afe0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.14000af90
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400151c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1409eb6f0]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14001522f
mov rcx, r9
call fcn.140015090
test eax, eax
je 0x14001522f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x14001522d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140015224
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x14001522f
add rdx, 0x28
cmp rdx, r9
jne 0x140015210
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret