joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ca60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44cbd8
movzx edx, byte [rax]
nop
test edx, edx
jne 0x44ca9c
test r8b, r8b
jne 0x44ca9c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x44caaf
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44cb98
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x44cb86
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x44cb7c
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x44cb03
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x44cb46
mov eax, 1
cmp rax, rbx
ja 0x44cb35
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.0045e380
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x44cb74
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x44cb3d
mov r8d, eax
mov eax, r10d
jmp 0x44cb08
mov rcx, rbx
call fcn.0045e2c0
xor eax, eax
mov rcx, rbx
call fcn.0045e2c0
mov eax, r8d
mov rcx, rbx
call fcn.0045e380
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44cbce
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x44cb91
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44cab5
mov eax, edx
mov rcx, rbx
call fcn.0045e2c0
xor eax, eax
mov rcx, rbx
nop dword [rax]
call fcn.0045e2c0
nop
int3
Function at 0x454020
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4540ea
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
lea rdx, [rsp + 0x18]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x28]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x38]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x48]
movups xmmword [rdx], xmm15
lea rdx, [0x00454120]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045ba80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.0045bbc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00454020

Function at 0x45a400
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov r13, 0
mov qword [rsp + 0x20], r13
mov byte [rsp + 0x17], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
nop
inc dword [rcx + 0x244]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
nop
mov rsi, rcx
mov qword [rdx + 0x138], rcx
mov rcx, qword [rsi + 0x30]
mov qword [rsi + 0xe8], rcx
lea rcx, fcn.0043f360
mov qword [rsp + 0x20], rcx
mov byte [rsp + 0x17], 1
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x18], rcx
mov rdx, qword [rsp + 0x38]
mov qword [rcx + 0x2e0], rdx
mov rdx, qword [rsp + 0x40]
mov qword [rcx + 0x2e8], rdx
lea rdx, [rsp + 0x48]
mov qword [rcx + 0x2f0], rdx
lea rbx, [rcx + 0x2e0]
mov rax, qword [0x00562f28]
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.004039e0
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x2f8]
mov rsi, qword [rcx + 0x300]
mov rcx, qword [rcx + 0x308]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], 0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.0043f360
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
Function at 0x45dd00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x402bef
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409260
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045bbc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402bc0
cmp byte [0x005b76f3], 0
je 0x45dd15
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45ace0
jmp 0x402bc0

Function at 0x45dd20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005b79a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005b76f3], 0
je 0x45dd55
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005b7c20]
aesenc xmm0, xmmword [0x005b7c30]
aesenc xmm0, xmmword [0x005b7c40]
movq rax, xmm0
ret
jmp 0x409460

Function at 0x45dd60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005b79a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005b76f3], 0
je 0x45dd96
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005b7c20]
aesenc xmm0, xmmword [0x005b7c30]
aesenc xmm0, xmmword [0x005b7c40]
movq rax, xmm0
ret
jmp 0x4094c0

Function at 0x45f6c0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005b7ba0]
mov qword [rsp + 8], rdx
lea r8d, [0x005b7708]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045dc60
add rsp, 0x30
ret

Function at 0x460580
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x50], rax
call fcn.0045a6e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x460620
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x68], rax
call fcn.0045a820
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret

Function at 0x4606e0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rax
call fcn.0045a960
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret

Function at 0x4607e0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0xc0
mov qword [rsp + 0xb8], rbp
lea rbp, [rsp + 0xb8]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x98], rax
nop
call fcn.0045aaa0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
add rsp, 0xc0
ret
Function at 0x1800010a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
xor r13d, r13d
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x88]
lea rbx, [rdi + 1]
mov eax, ebp
xor r9d, r9d
sub eax, edi
lea r11d, [rcx - 0x10]
add r11d, eax
je 0x1800011d1
lea r8, [rsp + 0x28]
mov r10, rbx
sub r8, rbx
nop word [rax + rax]
xor edx, edx
mov rax, r10
movzx ecx, byte [r8 + rax]
cmp byte [rax], cl
je 0x1800010f6
cmp cl, 0x3f
jne 0x18000117e
inc edx
inc rax
cmp edx, 8
jb 0x1800010e4
mov edi, r9d
add rdi, rbx
je 0x1800011d1
mov ecx, dword [rdi]
mov dword [rsp + 0x20], ecx
movzx eax, byte [rsp + 0x21]
movzx ebx, byte [rsp + 0x22]
shl eax, 0x10
shl ebx, 8
add ebx, eax
movzx eax, cl
shl eax, 0x18
add ebx, eax
shr ecx, 0x18
mov rax, qword [rsp + 0xa0]
add ebx, ecx
mov eax, dword [rax + 0x54]
cmp dword [rdi + 8], eax
jne 0x180001192
test r14, r14
jne 0x18000119b
mov r12d, dword [rdi + 0x10]
lea ecx, [r14 + 0x40]
mov rax, qword [rsp + 0x98]
lea r13, [rdi + 8]
add r12d, 0x10
mov edx, r12d
call qword [rax + 0x40]
mov r8d, ebx
lea rdx, [rdi + 8]
mov rcx, rax
mov r14, rax
call fcn.18000195f
add r15d, ebx
jmp 0x1800010af
inc r9d
inc r10
dec r8
cmp r9d, r11d
jb 0x1800010df
jmp 0x1800011d1
test r14, r14
je 0x1800010af
mov ecx, r15d
lea ebp, [rbx + r15]
add rcx, r14
lea rdx, [rdi + 8]
cmp ebp, r12d
ja 0x1800011c6
mov r8d, ebx
call fcn.18000195f
mov r15d, ebp
mov rbp, qword [rsp + 0x80]
jmp 0x1800010af
sub r12d, r15d
mov r8d, r12d
call fcn.18000195f
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test r14, r14
jne 0x1800011fc
xor al, al
add rsp, 0x60
pop r15
pop r14
pop r13
ret
mov eax, dword [r13 + 8]
lea rcx, [r14 + 0x10]
mov r8d, dword [r13 + 4]
test al, 3
je 0x180001215
nop dword [rax]
dec eax
test al, 3
jne 0x18000120f
test eax, eax
je 0x18000122e
lea edx, [rax - 1]
shr edx, 2
inc edx
xor dword [rcx], r8d
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x180001221
mov rax, qword [rsp + 0x90]
test r15d, r15d
mov qword [rax], r14
setne al
add rsp, 0x60
pop r15
pop r14
pop r13
ret
Function at 0x18000165f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x230
movsxd rax, dword [rcx + 0x3c]
mov r13, r8
mov r15d, edx
mov rbp, rcx
mov r9d, dword [rax + rcx + 0x88]
mov esi, dword [r9 + rcx + 0x20]
mov r14d, dword [r9 + rcx + 0x1c]
add rsi, rcx
mov edi, dword [r9 + rcx + 0x24]
add r14, rcx
add rdi, rcx
nop
mov ebx, dword [rsi]
lea rcx, [rsp + 0x20]
mov edx, 0x208
add rbx, rbp
call fcn.180001abf
mov rcx, rbx
call fcn.1800018df
test eax, eax
je 0x1800016f3
mov ecx, eax
lea r8, [rsp + 0x20]
lea rdx, [rcx + rbx]
lea r8, [r8 + rcx*2]
nop
movsx ecx, byte [rdx]
lea rdx, [rdx - 1]
mov word [r8], cx
lea r8, [r8 - 2]
add eax, 0xffffffff
jne 0x1800016df
mov ecx, eax
movsx eax, byte [rcx + rbx]
mov word [rsp + rcx*2 + 0x20], ax
lea rcx, [rsp + 0x20]
call fcn.18000191f
xor edx, edx
test eax, eax
je 0x180001736
mov r10d, dword [r13 + 0x28]
lea r8, [rsp + 0x20]
mov r9d, eax
nop dword [rax + rax]
mov ecx, r10d
lea r8, [r8 + 2]
imul ecx, edx
movzx edx, word [r8 - 2]
add edx, ecx
sub r9, 1
jne 0x18000171f
movzx eax, word [rdi]
mov eax, dword [r14 + rax*4]
add rax, rbp
cmp r15d, edx
je 0x180001752
add rsi, 4
add rdi, 2
jmp 0x1800016af
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x180005334
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov rax, qword gs:[0x60]
mov ebx, ecx
mov r11, qword [rax + 0x18]
add r11, 0x10
nop dword [rax + rax]

Function at 0x180006b10
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x3c]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180006b9d
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x3c], eax
jne 0x180006b9d
mov dword [rsp + 0x38], 0
jmp 0x180006b5c
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x38], eax
jge 0x180006b9d
movsxd rax, dword [rsp + 0x38]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + rax*8]
call sub.libglib_2.0_0.dll_g_utf16_to_utf8
movsxd rcx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x58]
mov qword [rdx + rcx*8], rax
jmp 0x180006b52
add rsp, 0x48
ret

Function at 0x1800081b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
mov ecx, dword [rcx]
mov dword [rax + 0x34], ecx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
mov ecx, dword [rcx + 0x34]
mov dword [rax + 0x30], ecx
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x20], 0
lea rcx, str.POSIXLY_CORRECT
call sub.MSVCR100.dll_getenv
test rax, rax
je 0x18000820e
mov dword [rsp + 0x20], 1
jmp 0x180008216
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x60]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x58]
mov dword [rcx + 0x2c], eax
mov rax, qword [rsp + 0x50]
movsx eax, byte [rax]
cmp eax, 0x2d
jne 0x180008252
mov rax, qword [rsp + 0x58]
mov dword [rax + 0x28], 2
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
jmp 0x18000829f
mov rax, qword [rsp + 0x50]
movsx eax, byte [rax]
cmp eax, 0x2b
jne 0x18000827a
mov rax, qword [rsp + 0x58]
mov dword [rax + 0x28], 0
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
jmp 0x18000829f
mov rax, qword [rsp + 0x58]
cmp dword [rax + 0x2c], 0
je 0x180008293
mov rax, qword [rsp + 0x58]
mov dword [rax + 0x28], 0
jmp 0x18000829f
mov rax, qword [rsp + 0x58]
mov dword [rax + 0x28], 1
mov rax, qword [rsp + 0x50]
add rsp, 0x38
ret
Function at 0x140002e43
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
jmp 0x140002e51
mov byte [rsp + 8], 0x25
mov byte [rsp + 9], 0x64
mov byte [rsp + 0xa], 0x2e
mov byte [rsp + 0xb], 0x25
mov byte [rsp + 0xc], 0x30
mov byte [rsp + 0xd], 0x32
mov byte [rsp + 0xe], 0x64
mov byte [rsp + 0xf], 0x2e
mov byte [rsp + 0x10], 0x25
mov byte [rsp + 0x11], 0x30
mov byte [rsp + 0x12], 0x32
mov byte [rsp + 0x13], 0x64
mov byte [rsp + 0x14], 0x20
mov byte [rsp + 0x15], 0x25
mov byte [rsp + 0x16], 0x30
mov byte [rsp + 0x17], 0x32
mov byte [rsp + 0x18], 0x64
mov byte [rsp + 0x19], 0x3a
mov byte [rsp + 0x1a], 0x25
mov byte [rsp + 0x1b], 0x30
mov byte [rsp + 0x1c], 0x32
mov byte [rsp + 0x1d], 0x64
mov byte [rsp + 0x1e], 0x3a
mov byte [rsp + 0x1f], 0x25
mov byte [rsp + 0x20], 0x30
mov byte [rsp + 0x21], 0x32
mov byte [rsp + 0x22], 0x64
mov byte [rsp + 0x23], 0x20
mov byte [rsp + 0x24], 0x5b
mov byte [rsp + 0x25], 0x25
mov byte [rsp + 0x26], 0x30
mov byte [rsp + 0x27], 0x38
mov byte [rsp + 0x28], 0x64
mov byte [rsp + 0x29], 0x5d
mov byte [rsp + 0x2a], 0x20
mov byte [rsp + 0x2b], 0x25
mov byte [rsp + 0x2c], 0x73
mov byte [rsp + 0x2d], 0xd
mov byte [rsp + 0x2e], 0xa
mov byte [rsp + 0x2f], 0
mov qword [rsp], 0
jmp 0x140002f31
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x28
jae 0x140002f5b
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x140002f26
mov rax, qword [rsp + 0x40]
jmp 0x140002f6a
add rsp, 0x38
ret

Function at 0x140007244
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x140007252
mov byte [rsp + 8], 0x4d
mov byte [rsp + 9], 0x65
mov byte [rsp + 0xa], 0x73
mov byte [rsp + 0xb], 0x73
mov byte [rsp + 0xc], 0x61
mov byte [rsp + 0xd], 0x67
mov byte [rsp + 0xe], 0x65
mov byte [rsp + 0xf], 0x42
mov byte [rsp + 0x10], 0x6f
mov byte [rsp + 0x11], 0x78
mov byte [rsp + 0x12], 0x41
mov byte [rsp + 0x13], 0
mov qword [rsp], 0
jmp 0x1400072a6
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xc
jae 0x1400072d0
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000729b
mov rax, qword [rsp + 0x30]
jmp 0x1400072df
add rsp, 0x28
ret
Function at 0x140007751
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x14000775f
mov byte [rsp + 8], 0x44
mov byte [rsp + 9], 0x62
mov byte [rsp + 0xa], 0x67
mov byte [rsp + 0xb], 0x42
mov byte [rsp + 0xc], 0x72
mov byte [rsp + 0xd], 0x65
mov byte [rsp + 0xe], 0x61
mov byte [rsp + 0xf], 0x6b
mov byte [rsp + 0x10], 0x50
mov byte [rsp + 0x11], 0x6f
mov byte [rsp + 0x12], 0x69
mov byte [rsp + 0x13], 0x6e
mov byte [rsp + 0x14], 0x74
mov byte [rsp + 0x15], 0
mov qword [rsp], 0
jmp 0x1400077bd
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe
jae 0x1400077e7
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x1400077b2
mov rax, qword [rsp + 0x30]
jmp 0x1400077f6
add rsp, 0x28
ret

Function at 0x140008035
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov dword [rsp + 4], 0
mov dword [rsp + 8], 0
mov dword [rsp + 0xc], 0
mov dword [rsp], 0
mov eax, dword [rsp + 0x40]
and eax, 0x20000000
test eax, eax
je 0x140008075
mov dword [rsp + 4], 1
mov eax, dword [rsp + 0x40]
and eax, 0x40000000
test eax, eax
je 0x14000808e
mov dword [rsp + 8], 1
mov eax, dword [rsp + 0x40]
and eax, 0x80000000
test eax, eax
je 0x1400080a7
mov dword [rsp + 0xc], 1
mov dword [rsp + 0x10], 1
mov dword [rsp + 0x14], 8
mov dword [rsp + 0x18], 2
mov dword [rsp + 0x1c], 4
mov dword [rsp + 0x20], 0x10
mov dword [rsp + 0x24], 0x80
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x2c], 0x40
movsxd rax, dword [rsp + 4]
imul rax, rax, 0x10
lea rax, [rsp + rax + 0x10]
movsxd rcx, dword [rsp + 8]
lea rax, [rax + rcx*8]
movsxd rcx, dword [rsp + 0xc]
mov eax, dword [rax + rcx*4]
mov dword [rsp], eax
mov eax, dword [rsp + 0x40]
and eax, 0x4000000
test eax, eax
je 0x140008124
mov eax, dword [rsp]
bts eax, 9
mov dword [rsp], eax
mov eax, dword [rsp]
add rsp, 0x38
ret

Function at 0x14000cd20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x14000cd2e
mov byte [rsp + 8], 0x4d
mov byte [rsp + 9], 0x65
mov byte [rsp + 0xa], 0x73
mov byte [rsp + 0xb], 0x73
mov byte [rsp + 0xc], 0x61
mov byte [rsp + 0xd], 0x67
mov byte [rsp + 0xe], 0x65
mov byte [rsp + 0xf], 0x42
mov byte [rsp + 0x10], 0x6f
mov byte [rsp + 0x11], 0x78
mov byte [rsp + 0x12], 0x57
mov byte [rsp + 0x13], 0
mov qword [rsp], 0
jmp 0x14000cd82
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xc
jae 0x14000cdac
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000cd77
mov rax, qword [rsp + 0x30]
jmp 0x14000cdbb
add rsp, 0x28
ret