joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c5430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140128010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0x1a
mov byte [rsp + 0x30], 0x18
mov byte [rsp + 0x31], 0xf2
mov byte [rsp + 0x32], 0x1a
mov byte [rsp + 0x33], 0xdd
mov byte [rsp + 0x34], 0xea
mov byte [rsp + 0x35], 0xdd
mov byte [rsp + 0x36], 0x24
mov byte [rsp + 0x37], 0x22
mov byte [rsp + 0x38], 0x2b
mov byte [rsp + 0x39], 0x22
mov byte [rsp + 0x3a], 0x2f
mov byte [rsp + 0x3b], 0x1e
mov byte [rsp + 0x3c], 0x31
mov byte [rsp + 0x3d], 0x22
mov byte [rsp + 0x3e], 0xdd
mov byte [rsp + 0x3f], 4
mov byte [rsp + 0x40], 0x2c
mov byte [rsp + 0x41], 0x29
mov byte [rsp + 0x42], 0x21
mov byte [rsp + 0x43], 0xdd
mov byte [rsp + 0x44], 0x20
mov byte [rsp + 0x45], 0x1e
mov byte [rsp + 0x46], 0x2f
mov byte [rsp + 0x47], 0x21
mov byte [rsp + 0x48], 0xc7
mov byte [rsp + 0x49], 0xbd
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1401b55cc], eax
jle 0x1400c5576
lea rcx, [0x1401b55cc]
call fcn.1400e6dfc
cmp dword [0x1401b55cc], 0xffffffff
jne 0x1400c5576
lea rax, [0x1401afc90]
mov byte [rax + 0x1a], 1
mov qword [rsp + 0x20], 0
jmp 0x1400c552d
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x1a
jae 0x1400c555e
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x1401afc90]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x1400c5520
lea rcx, [0x14011c180]
call fcn.1400e7454
lea rcx, [0x1401b55cc]
call fcn.1400e6d90
lea rax, [0x1401afc90]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400e6d70
add rsp, 0x68
ret
Function at 0x1400c6170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140128010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x28], 0x22
mov byte [rsp + 0x30], 0xd
mov byte [rsp + 0x31], 0x40
mov byte [rsp + 0x32], 0x40
mov byte [rsp + 0x33], 0x40
mov byte [rsp + 0x34], 0x40
mov byte [rsp + 0x35], 0x40
mov byte [rsp + 0x36], 0x40
mov byte [rsp + 0x37], 0x40
mov byte [rsp + 0x38], 0x40
mov byte [rsp + 0x39], 0x40
mov byte [rsp + 0x3a], 0x40
mov byte [rsp + 0x3b], 0x40
mov byte [rsp + 0x3c], 0x40
mov byte [rsp + 0x3d], 0x40
mov byte [rsp + 0x3e], 0x40
mov byte [rsp + 0x3f], 0x40
mov byte [rsp + 0x40], 0x40
mov byte [rsp + 0x41], 0x40
mov byte [rsp + 0x42], 0x40
mov byte [rsp + 0x43], 0x40
mov byte [rsp + 0x44], 0x40
mov byte [rsp + 0x45], 0x40
mov byte [rsp + 0x46], 0x40
mov byte [rsp + 0x47], 0x40
mov byte [rsp + 0x48], 0x40
mov byte [rsp + 0x49], 0x40
mov byte [rsp + 0x4a], 0x40
mov byte [rsp + 0x4b], 0x40
mov byte [rsp + 0x4c], 0x40
mov byte [rsp + 0x4d], 0x40
mov byte [rsp + 0x4e], 0x40
mov byte [rsp + 0x4f], 0xd
mov byte [rsp + 0x50], 0xd
mov byte [rsp + 0x51], 3
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1401b57a0], eax
jle 0x1400c62de
lea rcx, [0x1401b57a0]
call fcn.1400e6dfc
cmp dword [0x1401b57a0], 0xffffffff
jne 0x1400c62de
lea rax, [0x1401b41e8]
mov byte [rax + 0x22], 1
mov qword [rsp + 0x20], 0
jmp 0x1400c6295
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x22
jae 0x1400c62c6
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x1401b41e8]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x1400c6288
lea rcx, [0x14011be80]
call fcn.1400e7454
lea rcx, [0x1401b57a0]
call fcn.1400e6d90
lea rax, [0x1401b41e8]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e6d70
add rsp, 0x68
ret
Function at 0x1400c6300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140128010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], 0x2d
mov byte [rsp + 0x30], 0x3d
mov byte [rsp + 0x31], 0x70
mov byte [rsp + 0x32], 0x70
mov byte [rsp + 0x33], 0x70
mov byte [rsp + 0x34], 0x70
mov byte [rsp + 0x35], 0x70
mov byte [rsp + 0x36], 0x70
mov byte [rsp + 0x37], 0x70
mov byte [rsp + 0x38], 0x70
mov byte [rsp + 0x39], 0x70
mov byte [rsp + 0x3a], 0x70
mov byte [rsp + 0x3b], 0x70
mov byte [rsp + 0x3c], 0x70
mov byte [rsp + 0x3d], 0x70
mov byte [rsp + 0x3e], 0x70
mov byte [rsp + 0x3f], 0x70
mov byte [rsp + 0x40], 0x70
mov byte [rsp + 0x41], 0x70
mov byte [rsp + 0x42], 0x70
mov byte [rsp + 0x43], 0x70
mov byte [rsp + 0x44], 0x70
mov byte [rsp + 0x45], 0x70
mov byte [rsp + 0x46], 0x70
mov byte [rsp + 0x47], 0x70
mov byte [rsp + 0x48], 0x70
mov byte [rsp + 0x49], 0x70
mov byte [rsp + 0x4a], 0x70
mov byte [rsp + 0x4b], 0x70
mov byte [rsp + 0x4c], 0x70
mov byte [rsp + 0x4d], 0x70
mov byte [rsp + 0x4e], 0x70
mov byte [rsp + 0x4f], 0x3d
mov byte [rsp + 0x50], 0x8e
mov byte [rsp + 0x51], 0x89
mov byte [rsp + 0x52], 0x9c
mov byte [rsp + 0x53], 0xa6
mov byte [rsp + 0x54], 0x94
mov byte [rsp + 0x55], 0x53
mov byte [rsp + 0x56], 0x76
mov byte [rsp + 0x57], 0x94
mov byte [rsp + 0x58], 0xa5
mov byte [rsp + 0x59], 0x97
mov byte [rsp + 0x5a], 0x90
mov byte [rsp + 0x5b], 0x3d
mov byte [rsp + 0x5c], 0x33
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1401b174c], eax
jle 0x1400c64a5
lea rcx, [0x1401b174c]
call fcn.1400e6dfc
cmp dword [0x1401b174c], 0xffffffff
jne 0x1400c64a5
lea rax, [0x1401b01d8]
mov byte [rax + 0x2d], 1
mov qword [rsp + 0x20], 0
jmp 0x1400c645c
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x2d
jae 0x1400c648d
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x1401b01d8]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x1400c644f
lea rcx, [0x14011be40]
call fcn.1400e7454
lea rcx, [0x1401b174c]
call fcn.1400e6d90
lea rax, [0x1401b01d8]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400e6d70
add rsp, 0x78
ret
Function at 0x1400c7110
Capabilities:
Contain obfuscated stackstrings
Get process heap force flags

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140128010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x28], 0x32
mov byte [rsp + 0x30], 0xdf
mov byte [rsp + 0x31], 0x12
mov byte [rsp + 0x32], 0x12
mov byte [rsp + 0x33], 0x12
mov byte [rsp + 0x34], 0x12
mov byte [rsp + 0x35], 0x12
mov byte [rsp + 0x36], 0x12
mov byte [rsp + 0x37], 0x12
mov byte [rsp + 0x38], 0x12
mov byte [rsp + 0x39], 0x12
mov byte [rsp + 0x3a], 0x12
mov byte [rsp + 0x3b], 0x12
mov byte [rsp + 0x3c], 0x12
mov byte [rsp + 0x3d], 0x12
mov byte [rsp + 0x3e], 0x12
mov byte [rsp + 0x3f], 0x12
mov byte [rsp + 0x40], 0x12
mov byte [rsp + 0x41], 0x12
mov byte [rsp + 0x42], 0x12
mov byte [rsp + 0x43], 0x12
mov byte [rsp + 0x44], 0x12
mov byte [rsp + 0x45], 0x12
mov byte [rsp + 0x46], 0x12
mov byte [rsp + 0x47], 0x12
mov byte [rsp + 0x48], 0x12
mov byte [rsp + 0x49], 0x12
mov byte [rsp + 0x4a], 0x12
mov byte [rsp + 0x4b], 0x12
mov byte [rsp + 0x4c], 0x12
mov byte [rsp + 0x4d], 0x12
mov byte [rsp + 0x4e], 0x12
mov byte [rsp + 0x4f], 0xdf
mov byte [rsp + 0x50], 0x30
mov byte [rsp + 0x51], 0x22
mov byte [rsp + 0x52], 0x36
mov byte [rsp + 0x53], 0x49
mov byte [rsp + 0x54], 0x3a
mov byte [rsp + 0x55], 0x47
mov byte [rsp + 0x56], 0x18
mov byte [rsp + 0x57], 0x36
mov byte [rsp + 0x58], 0x47
mov byte [rsp + 0x59], 0x39
mov byte [rsp + 0x5a], 0xf5
mov byte [rsp + 0x5b], 0x18
mov byte [rsp + 0x5c], 0x36
mov byte [rsp + 0x5d], 0x47
mov byte [rsp + 0x5e], 0x39
mov byte [rsp + 0x5f], 0x32
mov byte [rsp + 0x60], 0xdf
mov byte [rsp + 0x61], 0xd5
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1401b2c74], eax
jle 0x1400c72ce
lea rcx, [0x1401b2c74]
call fcn.1400e6dfc
cmp dword [0x1401b2c74], 0xffffffff
jne 0x1400c72ce
lea rax, [0x1401b5308]
mov byte [rax + 0x32], 1
mov qword [rsp + 0x20], 0
jmp 0x1400c7285
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x32
jae 0x1400c72b6
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x1401b5308]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x1400c7278
lea rcx, [0x14011bb00]
call fcn.1400e7454
lea rcx, [0x1401b2c74]
call fcn.1400e6d90
lea rax, [0x1401b5308]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400e6d70
add rsp, 0x78
ret
Function at 0x1400c7f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140128010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], 0x30
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x31], 0x34
mov byte [rsp + 0x32], 0x34
mov byte [rsp + 0x33], 0x34
mov byte [rsp + 0x34], 0x34
mov byte [rsp + 0x35], 0x34
mov byte [rsp + 0x36], 0x34
mov byte [rsp + 0x37], 0x34
mov byte [rsp + 0x38], 0x34
mov byte [rsp + 0x39], 0x34
mov byte [rsp + 0x3a], 0x34
mov byte [rsp + 0x3b], 0x34
mov byte [rsp + 0x3c], 0x34
mov byte [rsp + 0x3d], 0x34
mov byte [rsp + 0x3e], 0x34
mov byte [rsp + 0x3f], 0x34
mov byte [rsp + 0x40], 0x34
mov byte [rsp + 0x41], 0x34
mov byte [rsp + 0x42], 0x34
mov byte [rsp + 0x43], 0x34
mov byte [rsp + 0x44], 0x34
mov byte [rsp + 0x45], 0x34
mov byte [rsp + 0x46], 0x34
mov byte [rsp + 0x47], 0x34
mov byte [rsp + 0x48], 0x34
mov byte [rsp + 0x49], 0x34
mov byte [rsp + 0x4a], 0x34
mov byte [rsp + 0x4b], 0x34
mov byte [rsp + 0x4c], 0x34
mov byte [rsp + 0x4d], 0x34
mov byte [rsp + 0x4e], 0x34
mov byte [rsp + 0x4f], 1
mov byte [rsp + 0x50], 0x52
mov byte [rsp + 0x51], 0x3a
mov byte [rsp + 0x52], 0x63
mov byte [rsp + 0x53], 0x58
mov byte [rsp + 0x54], 0x6a
mov byte [rsp + 0x55], 0x6a
mov byte [rsp + 0x56], 0x60
mov byte [rsp + 0x57], 0x5a
mov byte [rsp + 0x58], 0x17
mov byte [rsp + 0x59], 0x3a
mov byte [rsp + 0x5a], 0x58
mov byte [rsp + 0x5b], 0x69
mov byte [rsp + 0x5c], 0x5b
mov byte [rsp + 0x5d], 0x54
mov byte [rsp + 0x5e], 1
mov byte [rsp + 0x5f], 0xf7
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1401afa00], eax
jle 0x1400c80f4
lea rcx, [0x1401afa00]
call fcn.1400e6dfc
cmp dword [0x1401afa00], 0xffffffff
jne 0x1400c80f4
lea rax, [0x1401b4970]
mov byte [rax + 0x30], 1
mov qword [rsp + 0x20], 0
jmp 0x1400c80ab
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x30
jae 0x1400c80dc
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x1401b4970]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x1400c809e
lea rcx, [0x14011b7c0]
call fcn.1400e7454
lea rcx, [0x1401afa00]
call fcn.1400e6d90
lea rax, [0x1401b4970]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400e6d70
add rsp, 0x78
ret
Function at 0x1400c99e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140128010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x28], 0x22
mov byte [rsp + 0x30], 0xfb
mov byte [rsp + 0x31], 0x2e
mov byte [rsp + 0x32], 0x2e
mov byte [rsp + 0x33], 0x2e
mov byte [rsp + 0x34], 0x2e
mov byte [rsp + 0x35], 0x2e
mov byte [rsp + 0x36], 0x2e
mov byte [rsp + 0x37], 0x2e
mov byte [rsp + 0x38], 0x2e
mov byte [rsp + 0x39], 0x2e
mov byte [rsp + 0x3a], 0x2e
mov byte [rsp + 0x3b], 0x2e
mov byte [rsp + 0x3c], 0x2e
mov byte [rsp + 0x3d], 0x2e
mov byte [rsp + 0x3e], 0x2e
mov byte [rsp + 0x3f], 0x2e
mov byte [rsp + 0x40], 0x2e
mov byte [rsp + 0x41], 0x2e
mov byte [rsp + 0x42], 0x2e
mov byte [rsp + 0x43], 0x2e
mov byte [rsp + 0x44], 0x2e
mov byte [rsp + 0x45], 0x2e
mov byte [rsp + 0x46], 0x2e
mov byte [rsp + 0x47], 0x2e
mov byte [rsp + 0x48], 0x2e
mov byte [rsp + 0x49], 0x2e
mov byte [rsp + 0x4a], 0x2e
mov byte [rsp + 0x4b], 0x2e
mov byte [rsp + 0x4c], 0x2e
mov byte [rsp + 0x4d], 0x2e
mov byte [rsp + 0x4e], 0x2e
mov byte [rsp + 0x4f], 0xfb
mov byte [rsp + 0x50], 0xfb
mov byte [rsp + 0x51], 0xf1
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1401b16cc], eax
jle 0x1400c9b4e
lea rcx, [0x1401b16cc]
call fcn.1400e6dfc
cmp dword [0x1401b16cc], 0xffffffff
jne 0x1400c9b4e
lea rax, [0x1401add50]
mov byte [rax + 0x22], 1
mov qword [rsp + 0x20], 0
jmp 0x1400c9b05
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x22
jae 0x1400c9b36
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x1401add50]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x1400c9af8
lea rcx, [0x14011b180]
call fcn.1400e7454
lea rcx, [0x1401b16cc]
call fcn.1400e6d90
lea rax, [0x1401add50]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e6d70
add rsp, 0x68
ret
Function at 0x1400c9b70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [0x140128010]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x34], 0
jmp 0x1400c9bb6
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x50]
call fcn.14001e450
cqo
sub rax, rdx
sar rax, 1
movsxd rcx, dword [rsp + 0x34]
cmp rcx, rax
jge 0x1400c9c28
mov r8d, 0x23
mov edx, 3
mov ecx, 2
call qword [sym.imp.GDI32.dll_CreatePen]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x3c]
cmp dword [rsp + 0x34], eax
jne 0x1400c9c1b
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400c9c28
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x1400c9bac
mov rcx, qword [rsp + 0xa0]
call fcn.1400cad70
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0x38], 0
jmp 0x1400c9c54
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
add eax, 0xb
cmp dword [rsp + 0x38], eax
jge 0x1400c9d0e
mov eax, dword [rsp + 0x38]
cdq
and edx, 7
add eax, edx
and eax, 7
sub eax, edx
test eax, eax
jne 0x1400c9cfe
mov dword [rsp + 0x40], 1
mov rcx, qword [rsp + 0xa0]
call fcn.1400c9d40
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax]
test eax, eax
jne 0x1400c9cdb
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140020d90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0xa0]
mov byte [rax], 1
mov rcx, qword [rsp + 0xa0]
call fcn.1400cc9f0
mov byte [rsp + 0x30], al
movzx edx, byte [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
call fcn.1400d2170
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400c9c4a
xor eax, eax
cmp eax, 1
je 0x1400c9d29
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cmp eax, 0x34
jne 0x1400c9d22
jmp 0x1400c9d29
jmp 0x1400c9b98
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400e6d70
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x1400cdc90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140128010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], 0x2b
mov byte [rsp + 0x30], 0x5b
mov byte [rsp + 0x31], 0x9a
mov byte [rsp + 0x32], 0x9a
mov byte [rsp + 0x33], 0x9a
mov byte [rsp + 0x34], 0x9a
mov byte [rsp + 0x35], 0x9a
mov byte [rsp + 0x36], 0x5b
mov byte [rsp + 0x37], 0x9a
mov byte [rsp + 0x38], 0x5b
mov byte [rsp + 0x39], 0x5b
mov byte [rsp + 0x3a], 0x5b
mov byte [rsp + 0x3b], 0x5b
mov byte [rsp + 0x3c], 0x5b
mov byte [rsp + 0x3d], 0x5b
mov byte [rsp + 0x3e], 0x5b
mov byte [rsp + 0x3f], 0x5b
mov byte [rsp + 0x40], 0x9a
mov byte [rsp + 0x41], 0x5b
mov byte [rsp + 0x42], 0x5b
mov byte [rsp + 0x43], 0x5b
mov byte [rsp + 0x44], 0x5b
mov byte [rsp + 0x45], 0x5b
mov byte [rsp + 0x46], 0x5b
mov byte [rsp + 0x47], 0x5b
mov byte [rsp + 0x48], 0x9a
mov byte [rsp + 0x49], 0x9a
mov byte [rsp + 0x4a], 0x9a
mov byte [rsp + 0x4b], 0x9a
mov byte [rsp + 0x4c], 0x9a
mov byte [rsp + 0x4d], 0x9a
mov byte [rsp + 0x4e], 0x5b
mov byte [rsp + 0x4f], 0x5b
mov byte [rsp + 0x50], 0x5b
mov byte [rsp + 0x51], 0x5b
mov byte [rsp + 0x52], 0x5b
mov byte [rsp + 0x53], 0x5b
mov byte [rsp + 0x54], 0x5b
mov byte [rsp + 0x55], 0x9a
mov byte [rsp + 0x56], 0x5b
mov byte [rsp + 0x57], 0x5b
mov byte [rsp + 0x58], 0x5b
mov byte [rsp + 0x59], 0x45
mov byte [rsp + 0x5a], 0x3b
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1401b50c0], eax
jle 0x1400cde2b
lea rcx, [0x1401b50c0]
call fcn.1400e6dfc
cmp dword [0x1401b50c0], 0xffffffff
jne 0x1400cde2b
lea rax, [0x1401afa60]
mov byte [rax + 0x2b], 1
mov qword [rsp + 0x20], 0
jmp 0x1400cdde2
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x2b
jae 0x1400cde13
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x1401afa60]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x1400cddd5
lea rcx, [0x14011e3c0]
call fcn.1400e7454
lea rcx, [0x1401b50c0]
call fcn.1400e6d90
lea rax, [0x1401afa60]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400e6d70
add rsp, 0x78
ret
Function at 0x1400ce550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140128010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], 0x2d
mov byte [rsp + 0x30], 0xa5
mov byte [rsp + 0x31], 0xa8
mov byte [rsp + 0x32], 0xa8
mov byte [rsp + 0x33], 0xa8
mov byte [rsp + 0x34], 0xa8
mov byte [rsp + 0x35], 0x78
mov byte [rsp + 0x36], 0x69
mov byte [rsp + 0x37], 0xa5
mov byte [rsp + 0x38], 0xa8
mov byte [rsp + 0x39], 0xa8
mov byte [rsp + 0x3a], 0xa5
mov byte [rsp + 0x3b], 0xa8
mov byte [rsp + 0x3c], 0xa8
mov byte [rsp + 0x3d], 0x75
mov byte [rsp + 0x3e], 0xa8
mov byte [rsp + 0x3f], 0xc5
mov byte [rsp + 0x40], 0xa8
mov byte [rsp + 0x41], 0xc5
mov byte [rsp + 0x42], 0xa5
mov byte [rsp + 0x43], 0xa8
mov byte [rsp + 0x44], 0xa5
mov byte [rsp + 0x45], 0xa8
mov byte [rsp + 0x46], 0xa8
mov byte [rsp + 0x47], 0xa8
mov byte [rsp + 0x48], 0xa5
mov byte [rsp + 0x49], 0xa8
mov byte [rsp + 0x4a], 0xa8
mov byte [rsp + 0x4b], 0xa8
mov byte [rsp + 0x4c], 0xa8
mov byte [rsp + 0x4d], 0x78
mov byte [rsp + 0x4e], 0x69
mov byte [rsp + 0x4f], 0xa5
mov byte [rsp + 0x50], 0xa8
mov byte [rsp + 0x51], 0xa8
mov byte [rsp + 0x52], 0xa8
mov byte [rsp + 0x53], 0x78
mov byte [rsp + 0x54], 0x69
mov byte [rsp + 0x55], 0xa5
mov byte [rsp + 0x56], 0xa8
mov byte [rsp + 0x57], 0xa8
mov byte [rsp + 0x58], 0xc5
mov byte [rsp + 0x59], 0x53
mov byte [rsp + 0x5a], 0x53
mov byte [rsp + 0x5b], 0x53
mov byte [rsp + 0x5c], 0x49
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1401aece4], eax
jle 0x1400ce6f5
lea rcx, [0x1401aece4]
call fcn.1400e6dfc
cmp dword [0x1401aece4], 0xffffffff
jne 0x1400ce6f5
lea rax, [0x1401b2f58]
mov byte [rax + 0x2d], 1
mov qword [rsp + 0x20], 0
jmp 0x1400ce6ac
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x2d
jae 0x1400ce6dd
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x1401b2f58]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x1400ce69f
lea rcx, [0x14011e280]
call fcn.1400e7454
lea rcx, [0x1401aece4]
call fcn.1400e6d90
lea rax, [0x1401b2f58]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400e6d70
add rsp, 0x78
ret
Function at 0x1400ce820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x140128010]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x28], 0x3b
mov byte [rsp + 0x30], 0x40
mov byte [rsp + 0x31], 0x40
mov byte [rsp + 0x32], 0x40
mov byte [rsp + 0x33], 0x40
mov byte [rsp + 0x34], 0x40
mov byte [rsp + 0x35], 0x40
mov byte [rsp + 0x36], 1
mov byte [rsp + 0x37], 0x40
mov byte [rsp + 0x38], 1
mov byte [rsp + 0x39], 1
mov byte [rsp + 0x3a], 1
mov byte [rsp + 0x3b], 1
mov byte [rsp + 0x3c], 1
mov byte [rsp + 0x3d], 1
mov byte [rsp + 0x3e], 1
mov byte [rsp + 0x3f], 1
mov byte [rsp + 0x40], 1
mov byte [rsp + 0x41], 1
mov byte [rsp + 0x42], 0x40
mov byte [rsp + 0x43], 0x40
mov byte [rsp + 0x44], 0x40
mov byte [rsp + 0x45], 0x40
mov byte [rsp + 0x46], 0x40
mov byte [rsp + 0x47], 0x40
mov byte [rsp + 0x48], 1
mov byte [rsp + 0x49], 0x40
mov byte [rsp + 0x4a], 1
mov byte [rsp + 0x4b], 0x40
mov byte [rsp + 0x4c], 1
mov byte [rsp + 0x4d], 1
mov byte [rsp + 0x4e], 1
mov byte [rsp + 0x4f], 1
mov byte [rsp + 0x50], 1
mov byte [rsp + 0x51], 1
mov byte [rsp + 0x52], 1
mov byte [rsp + 0x53], 1
mov byte [rsp + 0x54], 1
mov byte [rsp + 0x55], 1
mov byte [rsp + 0x56], 1
mov byte [rsp + 0x57], 1
mov byte [rsp + 0x58], 0x40
mov byte [rsp + 0x59], 0x40
mov byte [rsp + 0x5a], 0x40
mov byte [rsp + 0x5b], 0x40
mov byte [rsp + 0x5c], 0x40
mov byte [rsp + 0x5d], 0x40
mov byte [rsp + 0x5e], 1
mov byte [rsp + 0x5f], 1
mov byte [rsp + 0x60], 1
mov byte [rsp + 0x61], 1
mov byte [rsp + 0x62], 1
mov byte [rsp + 0x63], 1
mov byte [rsp + 0x64], 1
mov byte [rsp + 0x65], 0x40
mov byte [rsp + 0x66], 1
mov byte [rsp + 0x67], 1
mov byte [rsp + 0x68], 1
mov byte [rsp + 0x69], 0xeb
mov byte [rsp + 0x6a], 0xe1
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1401b4d8c], eax
jle 0x1400cea0e
lea rcx, [0x1401b4d8c]
call fcn.1400e6dfc
cmp dword [0x1401b4d8c], 0xffffffff
jne 0x1400cea0e
lea rax, [0x1401aee50]
mov byte [rax + 0x3b], 1
mov qword [rsp + 0x20], 0
jmp 0x1400ce9c5
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x3b
jae 0x1400ce9f6
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x1401aee50]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x1400ce9b8
lea rcx, [0x14011e200]
call fcn.1400e7454
lea rcx, [0x1401b4d8c]
call fcn.1400e6d90
lea rax, [0x1401aee50]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400e6d70
add rsp, 0x88
ret