joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008ac4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov esi, edx
mov word [rbp - 0x21], 0x5332
mov edi, ecx
mov dword [rbp - 0x1b], 0x746f68
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x30], 0x61657243
mov dword [rbp - 0x2c], 0x6f546574
mov dword [rbp - 0x26], 0x706c6568
mov word [rbp - 0x28], 0x6c6f
mov dword [rbp - 0x1f], 0x7370616e
mov byte [rbp - 0x22], 0x33
call fcn.14001c974
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008b3c
mov edx, esi
mov ecx, edi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140008d08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov esi, ecx
mov ebx, 1
call fcn.140008864
mov rdi, rax
test rax, rax
je 0x140008d9c
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x19], 0x49736569
mov rcx, rax
mov dword [rbp - 0x14], 0x416c6341
mov word [rbp - 0x1f], 0x7465
mov word [rbp - 0x1c], 0x746e
mov byte [rbp - 0x20], 0x53
mov byte [rbp - 0x15], 0x6e
mov byte [rbp - 0x10], 0
mov byte [rbp - 0x1a], 0x72
mov byte [rbp - 0x1d], 0x45
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008d94
mov r9, r12
mov r8, r15
mov rdx, r14
mov ecx, esi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000987c
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002d370
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140008dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, qword [rbp + 0x60]
xor ebx, ebx
mov byte [rbp - 0x17], bl
mov r15, r9
mov r14d, r8d
mov dword [rbp - 0x1e], 0x46657469
mov rsi, rdx
mov word [rbp - 0x19], 0x656c
mov rdi, rcx
mov word [rbp - 0x20], 0x7257
mov byte [rbp - 0x1a], 0x69
call fcn.14001c974
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008e38
mov r9, r15
mov qword [rsp + 0x20], r12
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140008ee8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 8], rax
mov esi, edx
mov dword [rbp - 0x16], 0x6d756c6f
mov rdi, rcx
mov word [rbp - 0x1d], 0x4664
or rbx, 0xffffffffffffffff
mov word [rbp - 0x20], 0x6946
mov dword [rbp - 0x1b], 0x74737269
mov word [rbp - 0x12], 0x5765
mov byte [rbp - 0x1e], 0x6e
mov byte [rbp - 0x10], 0
mov byte [rbp - 0x17], 0x56
call fcn.14001c974
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008f5b
mov edx, esi
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140008f80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
mov edi, 1
call fcn.140008864
mov rbx, rax
test rax, rax
je 0x14000900b
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1a], 0x4b6e
mov rcx, rax
mov word [rbp - 0x1d], 0x704f
mov word [rbp - 0x17], 0x4179
mov word [rbp - 0x20], 0x6552
mov byte [rbp - 0x1e], 0x67
mov byte [rbp - 0x15], 0
mov byte [rbp - 0x1b], 0x65
mov byte [rbp - 0x18], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140009003
mov r8, r15
mov rdx, r14
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call fcn.14000987c
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140009034
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x18], rax
xor ebx, ebx
mov dword [rbp - 0x27], 0x75747269
mov byte [rbp - 0x1c], bl
mov r15d, r9d
mov r14d, r8d
mov byte [rbp - 0x28], 0x56
mov rsi, rdx
mov dword [rbp - 0x23], 0x6c416c61
mov rdi, rcx
mov word [rbp - 0x1e], 0x636f
mov byte [rbp - 0x1f], 0x6c
call fcn.14001c974
mov rcx, rax
lea rdx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400090a7
mov r9d, r15d
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.14002d370
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000917c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, qword [rbp + 0x70]
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
call fcn.140008864
mov rdi, rax
test rax, rax
je 0x14000921e
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x1e], 0x6e656b6f
mov rcx, rax
mov dword [rbp - 0x27], 0x696c7075
mov dword [rbp - 0x23], 0x65746163
mov word [rbp - 0x19], 0x78
mov byte [rbp - 0x1f], 0x54
mov byte [rbp - 0x1a], 0x45
mov byte [rbp - 0x28], 0x44
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140009216
mov eax, dword [rbp + 0x68]
mov r9d, r12d
mov qword [rsp + 0x28], r13
mov r8, r15
mov edx, r14d
mov dword [rsp + 0x20], eax
mov rcx, rsi
call r10
mov ebx, eax
mov rcx, rdi
call fcn.14000987c
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140009244
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
call fcn.140021d8c
mov rbx, rax
test rax, rax
je 0x1400092b5
lea rdx, [rbp - 0x20]
mov word [rbp - 0x18], 0x466d
mov rcx, rax
mov dword [rbp - 0x20], 0x61546f43
mov dword [rbp - 0x16], 0x656572
mov word [rbp - 0x1b], 0x4d6b
mov byte [rbp - 0x19], 0x65
mov byte [rbp - 0x1c], 0x73
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400092ad
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.14000987c
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1400092d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.1400cfa80
mov rdi, rax
test rax, rax
je 0x14000935c
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x15], 0x416575
mov rcx, rax
mov dword [rbp - 0x20], 0x51726556
mov dword [rbp - 0x1a], 0x61567972
mov word [rbp - 0x1c], 0x6575
mov byte [rbp - 0x16], 0x6c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140009354
mov r9, r12
mov r8, r15
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000987c
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140009380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x88
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov rax, qword [rbp + 0x87]
mov r12, r9
mov r13, qword [rbp + 0x7f]
mov r15d, r8d
mov qword [rbp - 0x29], rax
mov r14, rdx
mov rax, qword [rbp + 0x8f]
mov rsi, rcx
mov qword [rbp - 0x31], rax
mov edi, 1
call fcn.140008864
mov rbx, rax
test rax, rax
je 0x140009455
lea rdx, [rbp - 0x21]
mov dword [rbp - 0x16], 0x41784579
mov rcx, rax
mov dword [rbp - 0x1a], 0x654b6574
mov dword [rbp - 0x1f], 0x65724367
mov word [rbp - 0x21], 0x6552
mov byte [rbp - 0x1b], 0x61
mov byte [rbp - 0x12], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000944d
mov rax, qword [rbp - 0x31]
mov r9, r12
mov qword [rsp + 0x40], rax
mov r8d, r15d
mov rax, qword [rbp - 0x29]
mov rdx, r14
mov qword [rsp + 0x38], rax
mov rcx, rsi
mov eax, dword [rbp + 0x77]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x6f]
mov dword [rsp + 0x20], eax
call r10
mov edi, eax
mov rcx, rbx
call fcn.14000987c
mov eax, edi
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.14002d370
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140009520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.140008864
mov rdi, rax
test rax, rax
je 0x1400095bc
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1a], 0x5374
mov rcx, rax
mov dword [rbp - 0x14], 0x69727453
mov word [rbp - 0xb], 0x41
mov word [rbp - 0x1f], 0x6e6f
mov dword [rbp - 0x10], 0x6953676e
mov byte [rbp - 0xc], 0x64
mov word [rbp - 0x17], 0x5464
mov word [rbp - 0x1c], 0x7265
mov byte [rbp - 0x15], 0x6f
mov byte [rbp - 0x20], 0x43
mov byte [rbp - 0x1d], 0x76
mov byte [rbp - 0x18], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400095b4
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000987c
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret

Function at 0x140009804
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov dword [rbp - 0x17], 0x746e75
mov dword [rbp - 0x1e], 0x63695474
mov word [rbp - 0x19], 0x6f43
mov word [rbp - 0x20], 0x6547
mov byte [rbp - 0x1a], 0x6b
call fcn.14001c974
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000985a
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000a060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
call section..text
xor r10d, r10d
test eax, eax
js 0x14000a28f
mov ecx, dword [rbx + 0xf0]
lea eax, [rcx*4]
movsxd r9, eax
test eax, eax
jle 0x14000a0ec
lea rdx, [rbx + 8]
lea rdx, [rdx + r9*4]
lea r8, [rbx + 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov eax, dword [rdx - 8]
sub r9, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
lea r8, [r8 + 0x10]
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
lea rdx, [rdx - 0x10]
mov ecx, dword [r8 - 0xc]
mov dword [r8 - 0xc], eax
mov dword [rdx + 0x14], ecx
cmp r10, r9
jl 0x14000a09d
mov ecx, dword [rbx + 0xf0]
mov r11d, 1
cmp ecx, r11d
jle 0x14000a28d
lea r10, [rbx + 2]
lea rdi, [0x140000000]
lea r10, [r10 + 0x10]
inc r11d
mov r8d, dword [r10 - 2]
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0xd5600]
movzx eax, byte [r10 - 1]
mov r9d, dword [rdi + rdx*4 + 0xd5a00]
movzx ecx, byte [rdi + rax*4 + 0xd5600]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0xd6200]
movzx ecx, byte [rdi + rax*4 + 0xd5600]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0xd6600]
movzx ecx, byte [rdi + rax*4 + 0xd5600]
xor r9d, dword [rdi + rcx*4 + 0xd5e00]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0xd5600]
movzx eax, byte [r10 + 3]
mov r8d, dword [rdi + rdx*4 + 0xd5a00]
movzx ecx, byte [rdi + rax*4 + 0xd5600]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0xd6200]
movzx ecx, byte [rdi + rax*4 + 0xd5600]
movzx eax, r9b
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0xd5e00]
movzx ecx, byte [rdi + rax*4 + 0xd5600]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0xd6600]
movzx edx, byte [rdi + rax*4 + 0xd5600]
movzx eax, byte [r10 + 7]
mov dword [r10 + 2], r8d
mov r8d, dword [rdi + rdx*4 + 0xd5a00]
movzx ecx, byte [rdi + rax*4 + 0xd5600]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0xd6200]
movzx ecx, byte [rdi + rax*4 + 0xd5600]
movzx eax, r9b
mov r9d, dword [r10 + 0xa]
xor r8d, dword [rdi + rcx*4 + 0xd5e00]
movzx ecx, byte [rdi + rax*4 + 0xd5600]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0xd6600]
movzx edx, byte [rdi + rax*4 + 0xd5600]
movzx eax, byte [r10 + 0xb]
mov dword [r10 + 6], r8d
mov r8d, dword [rdi + rdx*4 + 0xd5a00]
movzx ecx, byte [rdi + rax*4 + 0xd5600]
movzx eax, byte [r10 + 0xc]
xor r8d, dword [rdi + rcx*4 + 0xd6200]
movzx ecx, byte [rdi + rax*4 + 0xd5600]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0xd5e00]
movzx ecx, byte [rdi + rax*4 + 0xd5600]
xor r8d, dword [rdi + rcx*4 + 0xd6600]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x14000a106
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000a64c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov ecx, 0x2710
mov dword [0x1400feb38], 1
call fcn.14001d610
call fcn.140017b30
mov word [rsp + 0x43], 0x6c
mov dword [rsp + 0x3a], 0x6c656e72
mov dword [rsp + 0x3e], 0x642e3233
mov word [rsp + 0x38], 0x656b
mov byte [rsp + 0x42], 0x6c
call fcn.140016b90
call fcn.140001ffc
mov rax, qword [0x1400f8090]
lea rdi, [0x1400f8080]
or rbx, 0xffffffffffffffff
cmp eax, ebx
jge 0x14000a70a
cmp rax, rbx
jb 0x14000a6f2
cmp qword [0x1400f8098], 0x10
mov rax, rdi
mov qword [0x1400f8090], rbx
cmovae rax, qword [0x1400f8080]
mov byte [rax - 1], 0
jmp 0x14000a703
not rax
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call fcn.140029ab4
mov rax, qword [0x1400f8090]
cmp qword [0x1400f8098], 0x10
mov rax, rdi
cmovae rax, qword [0x1400f8080]
mov rcx, rax
call fcn.14000a8a0
mov r8, qword [0x1400f8098]
mov rax, rdi
mov rcx, qword [0x1400f8080]
cmp r8, 0x10
jb 0x14000a748
mov rax, rcx
test rcx, rcx
jne 0x14000a748
xor ebx, ebx
jmp 0x14000a751
inc rbx
cmp byte [rax + rbx], 0
jne 0x14000a748
mov rax, qword [0x1400f8090]
movsxd rdx, ebx
cmp rdx, rax
ja 0x14000a775
cmp r8, 0x10
mov qword [0x1400f8090], rdx
cmovae rdi, rcx
mov byte [rdi + rdx], 0
jmp 0x14000a783
sub rdx, rax
xor r8d, r8d
mov rcx, rdi
call fcn.140029ab4
and dword [rsp + 0x30], 0
lea rcx, [rsp + 0x60]
mov ebx, 0x104
xor edx, edx
mov r8d, ebx
call fcn.14002f900
mov r8d, ebx
lea rdx, [rsp + 0x60]
xor ecx, ecx
call fcn.1400d0618
test eax, eax
je 0x14000a7cc
and dword [rsp + 0x20], 0
lea rdx, [rsp + 0x60]
mov r9d, 0x20
lea rcx, [rsp + 0x30]
xor r8d, r8d
call fcn.1400395d0
and dword [rsp + 0x34], 0
lea rcx, [rsp + 0x38]
xor ebx, ebx
mov word [rsp + 0x51], 0x6165
mov word [rsp + 0x4e], 0x6854
mov dword [rsp + 0x49], 0x74616572
mov word [rsp + 0x53], 0x64
mov byte [rsp + 0x48], 0x43
mov byte [rsp + 0x50], 0x72
mov byte [rsp + 0x4d], 0x65
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400feaf0], rax
test rax, rax
je 0x14000a878
cmp qword [0x1400feb40], 0
jne 0x14000a873
lea rcx, [rsp + 0x34]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea r8, [0x1400ca248]
and dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
call rax
mov qword [0x1400feb40], rax
test rax, rax
jne 0x14000a873
mov ecx, 0xbb8
call fcn.14001d610
inc ebx
cmp ebx, 3
jge 0x14000a873
mov rax, qword [0x1400feaf0]
jmp 0x14000a824
mov eax, 1
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14002d370
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140012400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp + 0x37], rax
lea rsi, [rcx + 0x50]
mov qword [rbp - 0x59], rdx
movups xmm0, xmmword [rsi]
mov rdi, rdx
mov rbx, rcx
movups xmm1, xmmword [rsi + 0x10]
mov word [rbp - 0x31], 0x3130
movups xmmword [rbp - 0x51], xmm0
mov word [rbp - 0x22], 0x66
movups xmmword [rbp - 0x41], xmm1
mov dword [rbp - 0x2e], 0x36353433
mov dword [rbp - 0x27], 0x64636261
mov byte [rbp - 0x23], 0x65
mov word [rbp - 0x2a], 0x3837
mov byte [rbp - 0x2f], 0x32
mov byte [rbp - 0x28], 0x39
call fcn.14001419c
xor ecx, ecx
lea r8, [rbp - 0x51]
sub r8, rbx
lea r9d, [rcx + 8]
lea r10d, [rcx + 0xf]
mov edx, dword [rsi]
mov eax, edx
shr rax, 0x1c
mov al, byte [rbp + rax - 0x31]
mov byte [rbp + rcx - 0x19], al
mov eax, edx
shr rax, 0x18
and rax, r10
mov al, byte [rbp + rax - 0x31]
mov byte [rbp + rcx - 0x18], al
mov eax, edx
shr rax, 0x14
and rax, r10
mov al, byte [rbp + rax - 0x31]
mov byte [rbp + rcx - 0x17], al
mov eax, edx
shr rax, 0x10
and rax, r10
mov al, byte [rbp + rax - 0x31]
mov byte [rbp + rcx - 0x16], al
mov eax, edx
shr rax, 0xc
and rax, r10
mov al, byte [rbp + rax - 0x31]
mov byte [rbp + rcx - 0x15], al
mov eax, edx
shr rax, 8
and rax, r10
mov al, byte [rbp + rax - 0x31]
mov byte [rbp + rcx - 0x14], al
mov eax, edx
shr rax, 4
and rdx, r10
and rax, r10
mov al, byte [rbp + rax - 0x31]
mov byte [rbp + rcx - 0x13], al
mov al, byte [rbp + rdx - 0x31]
mov byte [rbp + rcx - 0x12], al
add rcx, 8
mov eax, dword [r8 + rsi - 0x50]
mov dword [rsi], eax
lea rsi, [rsi + 4]
sub r9, 1
jne 0x140012481
cmp rcx, 0x41
jae 0x140012594
and qword [rdi], r9
lea rax, [rbp - 0x19]
and qword [rdi + 0x10], r9
mov qword [rdi + 0x18], r10
or rbx, 0xffffffffffffffff
mov byte [rbp + rcx - 0x19], r9b
mov byte [rdi], r9b
inc rbx
cmp byte [rax + rbx], 0
jne 0x14001253c
mov rcx, rdi
cmp rbx, r10
ja 0x140012563
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rbp - 0x19]
call fcn.14002e1f0
mov byte [rdi + rbx], 0
jmp 0x140012572
lea r9, [rbp - 0x19]
xor r8d, r8d
mov rdx, rbx
call fcn.140022af8
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
call fcn.14002d14c
int3
Function at 0x14001434c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov word [rbp - 0x27], 0x6c6c
xor ebx, ebx
mov dword [rbp - 0x30], 0x72657355
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x25], bl
mov r15d, r8d
mov dword [rbp - 0x2c], 0x2e766e65
mov r14, rdx
mov byte [rbp - 0x28], 0x64
call fcn.14001dc38
mov rdi, rax
test rax, rax
je 0x140014403
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1e], 0x65746165
mov rcx, rax
mov dword [rbp - 0x10], 0x6f6c4274
mov word [rbp - 0x15], 0x6e6f
mov word [rbp - 0x12], 0x6e65
mov word [rbp - 0xc], 0x6b63
mov byte [rbp - 0x13], 0x6d
mov dword [rbp - 0x19], 0x7269766e
mov word [rbp - 0x20], 0x7243
mov byte [rbp - 0x1a], 0x45
mov byte [rbp - 0xa], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400143fb
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000987c
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001442c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x70]
mov r12, r9
mov r13, qword [rbp + 0x68]
mov r15, r8
mov qword [rbp - 0x28], rax
mov r14, rdx
mov rsi, rcx
mov edi, 1
call fcn.140021d30
mov rbx, rax
test rax, rax
je 0x1400144d8
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1d], 0x7465
mov rcx, rax
mov word [rbp - 0x1a], 0x6c61
mov word [rbp - 0x17], 0x4165
mov word [rbp - 0x1f], 0x4748
mov byte [rbp - 0x15], 0
mov byte [rbp - 0x1b], 0x56
mov byte [rbp - 0x20], 0x53
mov byte [rbp - 0x18], 0x75
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400144d0
mov rcx, qword [rbp - 0x28]
mov r9, r12
mov qword [rsp + 0x28], rcx
mov r8, r15
mov rcx, rsi
mov qword [rsp + 0x20], r13
mov rdx, r14
call rax
mov edi, eax
mov rcx, rbx
call fcn.14000987c
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140014500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov word [rbp - 0x13], 0x70
mov dword [rbp - 0x1c], 0x65636f72
mov dword [rbp - 0x18], 0x65487373
mov dword [rbp - 0x20], 0x50746547
mov byte [rbp - 0x14], 0x61
call fcn.14001c974
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014558
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret