joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400203e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, rdx
mov rsi, rcx
mov ebx, 0xe
lea rdx, [0x1400753b8]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140020450
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x1400204a1
mov dword [rsp + 0x33], 0x536f5464
mov word [rsp + 0x30], 0x7555
mov dword [rsp + 0x37], 0x6e697274
mov byte [rsp + 0x32], 0x69
mov word [rsp + 0x3c], 0x41
mov byte [rsp + 0x3b], 0x67
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x140020499
mov rdx, rbp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400204d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
mov ebx, 0xe
lea rdx, [0x1400753b8]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14002053d
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x140020590
mov word [rsp + 0x35], 0x6972
mov dword [rsp + 0x38], 0x65724667
mov word [rsp + 0x3d], 0x41
mov dword [rsp + 0x31], 0x74536370
mov byte [rsp + 0x30], 0x52
mov byte [rsp + 0x3c], 0x65
mov byte [rsp + 0x37], 0x6e
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x140020588
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400205c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xb8
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 9], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov rsi, rcx
mov r13, qword [rbp + 0x6f]
mov rax, qword [rbp + 0x87]
mov qword [rbp - 0x31], rax
mov rax, qword [rbp + 0x8f]
mov qword [rbp - 0x39], rax
mov rax, qword [rbp + 0x97]
mov qword [rbp - 0x41], rax
mov rax, qword [rbp + 0x9f]
mov qword [rbp - 0x49], rax
xor ebx, ebx
lea rdx, [0x140075378]
lea rcx, [rbp - 0x51]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140020668
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14002070a
mov dword [rbp - 0x20], 0x74616572
mov dword [rbp - 0x1b], 0x636f7250
mov dword [rbp - 0x13], 0x65735573
mov word [rbp - 0x16], 0x7373
mov byte [rbp - 0x21], 0x43
mov word [rbp - 0xe], 0x41
mov byte [rbp - 0xf], 0x72
mov byte [rbp - 0x14], 0x41
mov byte [rbp - 0x1c], 0x65
mov byte [rbp - 0x17], 0x65
lea rdx, [rbp - 0x21]
mov rcx, rdi
call fcn.140025420
mov r10, rax
test rax, rax
je 0x140020702
mov rax, qword [rbp - 0x49]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp - 0x41]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp - 0x39]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x31]
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0x7f]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x77]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
mov r9, r12
mov r8, r15
mov rdx, r14
mov rcx, rsi
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140020740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075378]
lea rcx, [rbp - 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400207af
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x140020810
mov word [rbp - 0x1d], 0x6576
mov dword [rbp - 0xe], 0x41646953
mov dword [rbp - 0x12], 0x6f546469
mov word [rbp - 0x20], 0x6f43
mov dword [rbp - 0x16], 0x53676e69
mov word [rbp - 0x1b], 0x7472
mov word [rbp - 0x18], 0x7274
mov byte [rbp - 0x1e], 0x6e
mov byte [rbp - 0xa], 0
mov byte [rbp - 0x19], 0x53
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x140020808
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003ff20
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140020840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, r9
mov r15d, r8d
mov r14d, edx
mov rsi, rcx
mov r13, qword [rbp + 0x68]
xor ebx, ebx
lea rdx, [0x1400753d0]
lea rcx, [rbp - 0x38]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400208b7
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14002091a
mov dword [rbp - 0x28], 0x45535457
mov word [rbp - 0x14], 0x41
mov dword [rbp - 0x1d], 0x73655365
mov word [rbp - 0x1f], 0x7461
mov dword [rbp - 0x24], 0x656d756e
mov dword [rbp - 0x19], 0x6e6f6973
mov byte [rbp - 0x20], 0x72
mov byte [rbp - 0x15], 0x73
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x140020912
mov qword [rsp + 0x20], r13
mov r9, r12
mov r8d, r15d
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140020940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
lea rdx, [0x1400753d0]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rbx, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400209a3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rbx, rbx
je 0x1400209ef
mov dword [rsp + 0x35], 0x654d6565
mov dword [rsp + 0x3a], 0x79726f
mov word [rsp + 0x33], 0x7246
mov byte [rsp + 0x39], 0x6d
mov word [rsp + 0x30], 0x5457
mov byte [rsp + 0x32], 0x53
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140025420
test rax, rax
je 0x1400209e7
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400255d0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140020a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, r9
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
mov r15d, dword [rsp + 0xc0]
mov r12, qword [rsp + 0xc8]
mov dword [rsp + 0x43], 0x54657461
mov word [rsp + 0x41], 0x6572
mov dword [rsp + 0x47], 0x61657268
mov byte [rsp + 0x40], 0x43
mov word [rsp + 0x4b], 0x64
lea rdx, [0x1400753f0]
lea rcx, [rsp + 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025500
mov rbx, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140020ab3
mov rcx, qword [rdx]
mov r10, qword [rcx]
call qword [r10 + 8]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140025420
test rax, rax
je 0x140020add
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r15d
mov r9, r14
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call rax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140020d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075410]
lea rcx, [rbp - 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140020d6e
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x140020dc9
mov word [rbp - 0xb], 0x6b63
mov dword [rbp - 0x10], 0x6c42746e
mov dword [rbp - 0x1e], 0x6f727473
mov word [rbp - 0x20], 0x6544
mov byte [rbp - 9], 0
mov dword [rbp - 0x14], 0x656d6e6f
mov dword [rbp - 0x18], 0x7269766e
mov byte [rbp - 0xc], 0x6f
mov word [rbp - 0x1a], 0x4579
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x140020dc1
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x140020e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x39], 0x65707954
mov word [rsp + 0x33], 0x6942
mov word [rsp + 0x3d], 0x41
mov word [rsp + 0x30], 0x6547
mov dword [rsp + 0x35], 0x7972616e
mov byte [rsp + 0x32], 0x74
lea rdx, [0x1400753f0]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025500
mov rsi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140020e95
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140025420
test rax, rax
je 0x140020eaf
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140021080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
lea rdx, [0x140075430]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rbx, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400210e3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rbx, rbx
je 0x140021129
mov dword [rsp + 0x30], 0x61546f43
mov dword [rsp + 0x35], 0x6d654d6b
mov dword [rsp + 0x3a], 0x656572
mov byte [rsp + 0x34], 0x73
mov byte [rsp + 0x39], 0x46
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140025420
test rax, rax
je 0x140021121
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400255d0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140021250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
mov ebx, 0x80004005
lea rdx, [0x140075430]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400212bd
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x140021306
mov dword [rsp + 0x39], 0x646975
mov dword [rsp + 0x35], 0x47657461
mov word [rsp + 0x33], 0x6572
mov word [rsp + 0x30], 0x6f43
mov byte [rsp + 0x32], 0x43
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x1400212fe
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140021440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15d, r9d
mov r14, r8
mov rbp, rdx
mov rsi, rcx
mov r12d, dword [rsp + 0xd0]
mov r13, qword [rsp + 0xd8]
xor ebx, ebx
lea rdx, [0x140075358]
lea rcx, [rsp + 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400214c4
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14002152c
mov dword [rsp + 0x43], 0x656e7265
mov dword [rsp + 0x48], 0x6e65704f
mov word [rsp + 0x40], 0x6e49
mov dword [rsp + 0x4c], 0x416c7255
mov byte [rsp + 0x47], 0x74
mov byte [rsp + 0x42], 0x74
mov byte [rsp + 0x50], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x140021524
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r12d
mov r9d, r15d
mov r8, r14
mov rdx, rbp
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400255d0
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140021560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, r9
mov ebp, r8d
mov esi, edx
mov rdi, rcx
mov r15d, dword [rsp + 0xe0]
mov r12d, dword [rsp + 0xe8]
mov r13, qword [rsp + 0xf0]
mov word [rsp + 0x59], 0x4165
mov byte [rsp + 0x5b], 0
mov dword [rsp + 0x54], 0x69466574
mov dword [rsp + 0x50], 0x61657243
mov byte [rsp + 0x58], 0x6c
lea rdx, [0x1400753f0]
lea rcx, [rsp + 0x40]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025500
mov rbx, rax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14002160a
mov rcx, qword [rdx]
mov r10, qword [rcx]
call qword [r10 + 8]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140025420
test rax, rax
je 0x14002163a
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r15d
mov r9, r14
mov r8d, ebp
mov edx, esi
mov rcx, rdi
call rax
jmp 0x14002163e
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140021670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r15d, r9d
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
mov r12, qword [rsp + 0xc0]
mov ebx, 1
lea rdx, [0x140075378]
lea rcx, [rsp + 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, ebx
jg 0x1400216ec
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x140021748
mov dword [rsp + 0x44], 0x4b6e6570
mov dword [rsp + 0x4a], 0x417845
mov word [rsp + 0x41], 0x6765
mov byte [rsp + 0x40], 0x52
mov word [rsp + 0x48], 0x7965
mov byte [rsp + 0x43], 0x4f
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x140021740
mov qword [rsp + 0x20], r12
mov r9d, r15d
mov r8d, r14d
mov rdx, rbp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140021770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15, r9
mov r14, r8
mov rbp, rdx
mov rsi, rcx
mov r12, qword [rsp + 0xd0]
mov r13, qword [rsp + 0xd8]
mov ebx, 1
lea rdx, [0x140075378]
lea rcx, [rsp + 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, ebx
jg 0x1400217f6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14002185d
mov word [rsp + 0x4a], 0x756c
mov dword [rsp + 0x4d], 0x417845
mov dword [rsp + 0x41], 0x75516765
mov dword [rsp + 0x45], 0x56797265
mov byte [rsp + 0x4c], 0x65
mov byte [rsp + 0x40], 0x52
mov byte [rsp + 0x49], 0x61
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x140021855
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r9, r15
mov r8, r14
mov rdx, rbp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140021890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x88
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov r15, r9
mov r14d, r8d
mov rsi, rdx
mov rdi, rcx
mov r12, qword [rbp + 0x6f]
mov r13, qword [rbp + 0x77]
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x24], 0x656d756c
mov dword [rbp - 0x20], 0x6f666e49
mov dword [rbp - 0x29], 0x56746547
mov dword [rbp - 0x1a], 0x6f697461
mov word [rbp - 0x15], 0x57
mov byte [rbp - 0x25], 0x6f
mov byte [rbp - 0x16], 0x6e
mov word [rbp - 0x1c], 0x6d72
lea rdx, [0x1400753f0]
lea rcx, [rbp - 0x41]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025500
mov rbx, rax
mov rdx, qword [rbp - 0x41]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140021946
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.140025420
mov r10, rax
test rax, rax
je 0x140021986
mov eax, dword [rbp + 0x87]
mov dword [rsp + 0x38], eax
mov rax, qword [rbp - 0x39]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r9, r15
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call r10
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400219b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075378]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140021a1b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x140021a7b
mov word [rsp + 0x3c], 0x4172
mov dword [rsp + 0x32], 0x43536e65
mov word [rsp + 0x39], 0x6761
mov word [rsp + 0x36], 0x614d
mov byte [rsp + 0x38], 0x6e
mov byte [rsp + 0x3e], 0
mov word [rsp + 0x30], 0x704f
mov byte [rsp + 0x3b], 0x65
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x140021a73
mov r8d, r14d
mov rdx, rbp
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400255d0
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140021aa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12d, r9d
mov r15d, r8d
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075448]
lea rcx, [rbp - 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140021b11
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x140021b70
mov dword [rbp - 0x17], 0x466c6169
mov dword [rbp - 0xc], 0x576874
mov dword [rbp - 0x11], 0x50726564
mov dword [rbp - 0x1b], 0x63657053
mov dword [rbp - 0x20], 0x65474853
mov byte [rbp - 0x1c], 0x74
mov word [rbp - 0x13], 0x6c6f
mov byte [rbp - 0xd], 0x61
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x140021b68
mov r9d, r12d
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140021ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, r9
mov r15, r8
mov r14d, edx
mov rsi, rcx
mov ebx, 0x80004005
lea rdx, [0x140075448]
lea rcx, [rbp - 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140021c14
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x140021c75
mov dword [rbp - 0x1d], 0x6e4b7465
mov dword [rbp - 0x12], 0x61507265
mov word [rbp - 0xd], 0x68
mov dword [rbp - 0x18], 0x6f466e77
mov word [rbp - 0x20], 0x4853
mov byte [rbp - 0x19], 0x6f
mov byte [rbp - 0xe], 0x74
mov byte [rbp - 0x1e], 0x47
mov word [rbp - 0x14], 0x646c
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x140021c6d
mov r9, r12
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret