joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400235f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x140023687
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1a], 0x7265
mov rcx, rax
mov word [rbp - 0xd], 0x6170
mov dword [rbp - 0x12], 0x69446c72
mov dword [rbp - 0xb], 0x65686374
mov byte [rbp - 0xe], 0x73
mov word [rbp - 7], 0x4172
mov word [rbp - 0x17], 0x6369
mov dword [rbp - 0x1e], 0x53747261
mov word [rbp - 0x14], 0x7443
mov word [rbp - 0x20], 0x7453
mov byte [rbp - 0x15], 0x65
mov byte [rbp - 0x18], 0x76
mov byte [rbp - 5], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002367e
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1400236a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, rdx
mov r15, rcx
mov edi, 1
call fcn.1400219e4
mov rbx, rax
test rax, rax
je 0x140023748
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x51676552
mov rcx, rax
mov word [rbp - 0x19], 0x5679
mov word [rbp - 0x13], 0x7845
mov word [rbp - 0x16], 0x756c
mov word [rbp - 0x11], 0x41
mov byte [rbp - 0x17], 0x61
mov word [rbp - 0x1c], 0x6575
mov byte [rbp - 0x1a], 0x72
mov byte [rbp - 0x14], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14002373f
mov rax, qword [rbp + 0x48]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rax, qword [rbp + 0x40]
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], rax
call r10
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140023764
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov edi, r8d
mov dword [rbp - 9], 0x73736563
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x10], 0x6e65704f
mov word [rbp - 0xb], 0x6f72
mov byte [rbp - 5], 0
mov byte [rbp - 0xc], 0x50
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400237bf
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call rax
mov rbx, rax
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret
Function at 0x1400237d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov edi, r9d
mov esi, r8d
mov r14, rdx
mov r15, rcx
call fcn.1400219e4
mov rbx, rax
test rax, rax
je 0x140023872
lea rdx, [rbp - 0x20]
mov dword [rbp - 0xd], 0x68746957
mov rcx, rax
mov dword [rbp - 0x1f], 0x646c6975
mov dword [rbp - 0x16], 0x41746963
mov dword [rbp - 7], 0x41656d
mov dword [rbp - 0x12], 0x73656363
mov byte [rbp - 0x20], 0x42
mov dword [rbp - 0x1b], 0x6c707845
mov word [rbp - 9], 0x614e
mov byte [rbp - 0x17], 0x69
mov byte [rbp - 0xe], 0x73
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023869
and dword [rsp + 0x20], 0
mov r9d, edi
mov r8d, esi
mov rdx, r14
mov rcx, r15
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14002388c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15, rdx
mov ebx, 1
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x140023911
lea rdx, [rbp - 0x20]
mov word [rbp - 0x20], 0x6553
mov rcx, rax
mov dword [rbp - 0x1d], 0x72746e45
mov dword [rbp - 0x15], 0x6c63416e
mov dword [rbp - 0x19], 0x49736569
mov byte [rbp - 0x1e], 0x74
mov word [rbp - 0x11], 0x41
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023908
mov r9, rsi
mov r8, r14
mov rdx, r15
mov ecx, ebx
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x14002392c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x1400239c2
lea rdx, [rbp - 0x20]
mov dword [rbp - 7], 0x726f74
mov rcx, rax
mov dword [rbp - 0x20], 0x74696e49
mov word [rbp - 0x1b], 0x6c61
mov dword [rbp - 0x18], 0x6553657a
mov word [rbp - 0xe], 0x6544
mov word [rbp - 0x11], 0x7469
mov word [rbp - 0x14], 0x7563
mov dword [rbp - 0xb], 0x70697263
mov byte [rbp - 0x12], 0x72
mov byte [rbp - 0xf], 0x79
mov byte [rbp - 0xc], 0x73
mov byte [rbp - 0x19], 0x69
mov byte [rbp - 0x1c], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400239b9
lea edx, [rbx + 1]
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x140023a2c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rcx
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x140023ab8
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x72756365
mov rcx, rax
mov dword [rbp - 0x18], 0x44797469
mov dword [rbp - 0xb], 0x6c636144
mov dword [rbp - 0x14], 0x72637365
mov dword [rbp - 0x10], 0x6f747069
mov dword [rbp - 0x20], 0x53746553
mov byte [rbp - 7], bl
mov byte [rbp - 0xc], 0x72
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023aaf
xor r9d, r9d
lea edx, [rbx + 1]
mov r8, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140023ad4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14d, edx
mov r15, rcx
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x140023b5a
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x14], 0x6e656b6f
mov rcx, rax
mov word [rbp - 0x18], 0x7365
mov dword [rbp - 0x20], 0x6e65704f
mov byte [rbp - 0x10], bl
mov word [rbp - 0x1b], 0x6f72
mov word [rbp - 0x16], 0x5473
mov byte [rbp - 0x1c], 0x50
mov byte [rbp - 0x19], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023b51
mov r8, rsi
mov edx, r14d
mov rcx, r15
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x140023b78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rdx
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x140023bf8
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x67656c69
mov rcx, rax
mov dword [rbp - 0xe], 0x416575
mov dword [rbp - 0x12], 0x6c615665
mov dword [rbp - 0x1e], 0x70756b6f
mov dword [rbp - 0x1a], 0x76697250
mov word [rbp - 0x20], 0x6f4c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023bef
mov r8, rsi
mov rdx, r14
xor ecx, ecx
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x140023c14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rsi, r8
mov r14, rcx
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x140023cb6
lea rdx, [rbp - 0x20]
mov word [rbp - 0xd], 0x7365
mov rcx, rax
mov word [rbp - 0x18], 0x656b
mov word [rbp - 0x15], 0x7250
mov word [rbp - 0x1a], 0x6f54
mov dword [rbp - 0x12], 0x656c6976
mov dword [rbp - 0x1f], 0x73756a64
mov byte [rbp - 0xe], 0x67
mov byte [rbp - 0x1b], 0x74
mov byte [rbp - 0x20], 0x41
mov byte [rbp - 0xb], bl
mov byte [rbp - 0x13], 0x69
mov byte [rbp - 0x16], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023cad
mov qword [rsp + 0x28], rbx
lea r9d, [rbx + 0x10]
mov r8, rsi
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x140023cd4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rcx
mov edi, 1
call fcn.1400219e4
mov rbx, rax
test rax, rax
je 0x140023d64
lea rdx, [rbp - 0x20]
mov word [rbp - 0x14], 0x7275
mov rcx, rax
mov word [rbp - 0x1f], 0x6765
mov dword [rbp - 0x1a], 0x5379654b
mov word [rbp - 0x11], 0x7974
mov word [rbp - 0x1c], 0x7465
mov word [rbp - 0x16], 0x6365
mov byte [rbp - 0x1d], 0x53
mov byte [rbp - 0x12], 0x69
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0xf], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023d5b
mov r8, rsi
lea edx, [rdi + 3]
mov rcx, r14
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140023d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x17], 0x6f725074
mov dword [rbp - 0x20], 0x43746547
mov dword [rbp - 0x13], 0x73736563
mov word [rbp - 0x1c], 0x7275
mov word [rbp - 0x19], 0x6e65
mov byte [rbp - 0x1a], 0x72
mov byte [rbp - 0xf], 0
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023dd6
call rax
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140023de4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x140023e6f
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x10], 0x69536f54
mov rcx, rax
mov dword [rbp - 0x1e], 0x7265766e
mov word [rbp - 0xb], 0x41
mov word [rbp - 0x20], 0x6f43
mov dword [rbp - 0x15], 0x6953676e
mov word [rbp - 0x17], 0x6972
mov word [rbp - 0x1a], 0x5374
mov byte [rbp - 0x18], 0x74
mov byte [rbp - 0x11], 0x64
mov byte [rbp - 0xc], 0x64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023e66
mov rdx, rsi
lea rcx, [0x14017f4f8]
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x140023e88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x140023f25
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1b], 0x69727563
mov rcx, rax
mov word [rbp - 9], 0x6c63
mov dword [rbp - 0x20], 0x53746547
mov dword [rbp - 0x13], 0x69726373
mov dword [rbp - 0x17], 0x65447974
mov dword [rbp - 0xe], 0x44726f74
mov byte [rbp - 0x1c], 0x65
mov byte [rbp - 7], bl
mov byte [rbp - 0xa], 0x61
mov byte [rbp - 0xf], 0x70
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023f1c
mov r9, rsi
mov r8, r14
mov rdx, r15
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x140023f48
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rcx
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x140023fda
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1b], 0x63697672
mov rcx, rax
mov word [rbp - 0x20], 0x6553
mov word [rbp - 0x12], 0x7463
mov dword [rbp - 0x16], 0x656a624f
mov dword [rbp - 0xb], 0x797469
mov dword [rbp - 0xf], 0x72756365
mov word [rbp - 0x1d], 0x6553
mov byte [rbp - 0x17], 0x65
mov byte [rbp - 0x1e], 0x74
mov byte [rbp - 0x10], 0x53
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023fd1
mov r8, rsi
lea edx, [rbx + 4]
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x140023ff8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov edi, 1
call fcn.1400219e4
mov rbx, rax
test rax, rax
je 0x140024073
lea rdx, [rbp - 0x10]
mov word [rbp - 0xc], 0x6570
mov rcx, rax
mov dword [rbp - 9], 0x4179654b
mov dword [rbp - 0x10], 0x4f676552
mov byte [rbp - 0xa], 0x6e
mov byte [rbp - 5], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002406a
mov r8, rsi
mov rdx, r14
mov rcx, 0xffffffff80000002
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret

Function at 0x140024090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rsi, r9
mov r14, r8
mov r15, rdx
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x140024134
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x6e756f63
mov rcx, rax
mov dword [rbp - 0x13], 0x41646953
mov dword [rbp - 0x1e], 0x70756b6f
mov byte [rbp - 0xf], bl
mov word [rbp - 0x20], 0x6f4c
mov word [rbp - 0x1a], 0x6341
mov byte [rbp - 0x14], 0x74
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14002412b
mov rax, qword [rbp + 0x50]
mov r9, rsi
mov qword [rsp + 0x30], rax
mov r8, r14
mov rax, qword [rbp + 0x48]
mov rdx, r15
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140024150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15, rcx
mov edi, 1
call fcn.1400219e4
mov rbx, rax
test rax, rax
je 0x1400241da
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x13], 0x79746972
mov rcx, rax
mov dword [rbp - 0x1d], 0x4b746547
mov dword [rbp - 0x17], 0x75636553
mov word [rbp - 0x19], 0x7965
mov word [rbp - 0x20], 0x6552
mov byte [rbp - 0xf], 0
mov byte [rbp - 0x1e], 0x67
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400241d1
mov r9, rsi
lea edx, [rdi + 3]
mov r8, r14
mov rcx, r15
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x1400241f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x140024268
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x72655365
mov rcx, rax
mov dword [rbp - 0x18], 0x65636976
mov dword [rbp - 0x14], 0x646e6148
mov word [rbp - 0x10], 0x656c
mov dword [rbp - 0x20], 0x736f6c43
mov byte [rbp - 0xe], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002425f
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x140024280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x1400242ed
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xa], 0x616e614d
mov rcx, rax
mov dword [rbp - 0xe], 0x43536e65
mov word [rbp - 0x10], 0x704f
mov word [rbp - 3], 0x41
mov word [rbp - 6], 0x6567
mov byte [rbp - 4], 0x72
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400242e4
xor edx, edx
lea r8d, [rbx + 1]
xor ecx, ecx
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x140024300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x140024381
lea rdx, [rbp - 0x10]
mov word [rbp - 0xf], 0x6570
mov rcx, rax
mov word [rbp - 0xc], 0x6553
mov dword [rbp - 9], 0x65636976
mov byte [rbp - 0xa], 0x72
mov word [rbp - 5], 0x41
mov byte [rbp - 0x10], 0x4f
mov byte [rbp - 0xd], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140024378
mov r8d, 0x60000
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x1400243a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov word [rbp - 0xe], 0x7472
mov byte [rbp - 4], bl
mov rdi, rdx
mov dword [rbp - 8], 0x636f6c6c
mov word [rbp - 0xb], 0x6c61
mov word [rbp - 0x10], 0x6956
mov byte [rbp - 9], 0x41
mov byte [rbp - 0xc], 0x75
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140024406
lea r9d, [rbx + 4]
mov r8d, 0x1000
mov rdx, rdi
xor ecx, ecx
call rax
mov rbx, rax
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x14002441c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov word [rbp - 0xd], 0x7574
mov byte [rbp - 2], bl
mov rdi, r8
mov rsi, rdx
mov word [rbp - 0x10], 0x6956
mov r14, rcx
mov dword [rbp - 6], 0x7845636f
mov word [rbp - 0xb], 0x6c61
mov word [rbp - 8], 0x6c6c
mov byte [rbp - 9], 0x41
mov byte [rbp - 0xe], 0x72
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400244a2
mov eax, dword [rbp + 0x30]
mov r9d, 0x3000
mov r8, rdi
mov dword [rsp + 0x20], eax
mov rdx, rsi
mov rcx, r14
call r10
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140024928
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov esi, r9d
mov r14, r8
mov r15, rcx
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x1400249ce
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x72657551
mov rcx, rax
mov dword [rbp - 0xc], 0x69727563
mov dword [rbp - 0x18], 0x65636976
mov dword [rbp - 0x1c], 0x72655379
mov dword [rbp - 0x13], 0x63656a62
mov word [rbp - 7], 0x79
mov word [rbp - 0xf], 0x5374
mov byte [rbp - 0x14], 0x4f
mov byte [rbp - 0xd], 0x65
mov byte [rbp - 8], 0x74
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400249c5
mov rax, qword [rbp + 0x40]
lea edx, [rbx + 4]
mov r9d, esi
mov qword [rsp + 0x20], rax
mov r8, r14
mov rcx, r15
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret