joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140037860
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x50
mov dword [rax - 0x2c], 0x160011
lea rcx, [rsp + 0x2c]
mov dword [rax - 0x28], 0x5001e
mov dword [rax - 0x24], 0x20000d
mov dword [rax - 0x20], 0x80008
mov dword [rax - 0x1c], 0x150073
mov eax, 0x6a
mov word [rsp + 0x40], ax
call fcn.14000b840
mov rsi, qword [rax]
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1400378dc
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
call fcn.14000e188
test rax, rax
jne 0x14003794c
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1400378c3
xor eax, eax
lea rcx, [rsp + 0x20]
mov qword [0x1400a58c8], rax
mov dword [rsp + 0x20], 0x270034
mov dword [rsp + 0x24], 0x270028
mov dword [rsp + 0x28], 0x6c0024
call fcn.14000b630
mov rsi, qword [rax]
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14003793c
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
call fcn.14000e188
test rax, rax
jne 0x14003793c
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140037923
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rax, qword [rbx + 0x20]
jmp 0x1400378de
Function at 0x1400021f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0xa8
mov word [rsp + 0x20], 0x3f
mov word [rsp + 0x22], 0x35
mov word [rsp + 0x24], 0x48
mov word [rsp + 0x26], 0x4a
mov word [rsp + 0x28], 0x4c
mov word [rsp + 0x2a], 0x56
mov word [rsp + 0x2c], 0x57
mov word [rsp + 0x2e], 0x55
mov word [rsp + 0x30], 0x5c
mov word [rsp + 0x32], 0x3f
mov word [rsp + 0x34], 0x30
mov word [rsp + 0x36], 0x44
mov word [rsp + 0x38], 0x46
mov word [rsp + 0x3a], 0x4b
mov word [rsp + 0x3c], 0x4c
mov word [rsp + 0x3e], 0x51
mov word [rsp + 0x40], 0x48
mov word [rsp + 0x42], 0x3f
mov word [rsp + 0x44], 0x36
mov word [rsp + 0x46], 0x3c
mov word [rsp + 0x48], 0x36
mov word [rsp + 0x4a], 0x37
mov word [rsp + 0x4c], 0x28
mov word [rsp + 0x4e], 0x30
mov word [rsp + 0x50], 0x3f
mov word [rsp + 0x52], 0x26
mov word [rsp + 0x54], 0x58
mov word [rsp + 0x56], 0x55
mov word [rsp + 0x58], 0x55
mov word [rsp + 0x5a], 0x48
mov word [rsp + 0x5c], 0x51
mov word [rsp + 0x5e], 0x57
mov word [rsp + 0x60], 0x26
mov word [rsp + 0x62], 0x52
mov word [rsp + 0x64], 0x51
mov word [rsp + 0x66], 0x57
mov word [rsp + 0x68], 0x55
mov word [rsp + 0x6a], 0x52
mov word [rsp + 0x6c], 0x4f
mov word [rsp + 0x6e], 0x36
mov word [rsp + 0x70], 0x48
mov word [rsp + 0x72], 0x57
mov word [rsp + 0x74], 0x3f
mov word [rsp + 0x76], 0x36
mov word [rsp + 0x78], 0x48
mov word [rsp + 0x7a], 0x55
mov word [rsp + 0x7c], 0x59
mov word [rsp + 0x7e], 0x4c
mov word [rsp + 0x80], 0x46
mov word [rsp + 0x82], 0x48
mov word [rsp + 0x84], 0x56
mov word [rsp + 0x86], 0x3f
mov word [rsp + 0x88], 0x38
mov word [rsp + 0x8a], 0x56
mov word [rsp + 0x8c], 0x52
mov word [rsp + 0x8e], 0x36
mov word [rsp + 0x90], 0x59
mov word [rsp + 0x92], 0x46
mov word [rsp + 0x94], 0xe3
cmp byte [0x14059eb48], 0
jne 0x1400023f7
mov byte [0x14059ebd6], 1
mov eax, 0
lea rcx, [0x14059eb60]
movzx edx, word [rsp + rax*2 + 0x20]
mov word [rcx + rax*2], dx
add rax, 1
cmp rax, 0x3b
jne 0x1400023d1
mov byte [0x14059eb48], 1
lea rcx, [0x14000161f]
call fcn.1400014f0
lea rax, [0x14059eb60]
add rsp, 0xa8
ret
Function at 0x140002406
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0xa8
mov word [rsp + 0x20], 0x79
mov word [rsp + 0x22], 0x6f
mov word [rsp + 0x24], 0x82
mov word [rsp + 0x26], 0x84
mov word [rsp + 0x28], 0x86
mov word [rsp + 0x2a], 0x90
mov word [rsp + 0x2c], 0x91
mov word [rsp + 0x2e], 0x8f
mov word [rsp + 0x30], 0x96
mov word [rsp + 0x32], 0x79
mov word [rsp + 0x34], 0x6a
mov word [rsp + 0x36], 0x7e
mov word [rsp + 0x38], pe_nt_image_headers64
mov word [rsp + 0x3a], 0x85
mov word [rsp + 0x3c], 0x86
mov word [rsp + 0x3e], 0x8b
mov word [rsp + 0x40], 0x82
mov word [rsp + 0x42], 0x79
mov word [rsp + 0x44], 0x70
mov word [rsp + 0x46], 0x76
mov word [rsp + 0x48], 0x70
mov word [rsp + 0x4a], 0x71
mov word [rsp + 0x4c], 0x62
mov word [rsp + 0x4e], 0x6a
mov word [rsp + 0x50], 0x79
mov word [rsp + 0x52], 0x60
mov word [rsp + 0x54], 0x92
mov word [rsp + 0x56], 0x8f
mov word [rsp + 0x58], 0x8f
mov word [rsp + 0x5a], 0x82
mov word [rsp + 0x5c], 0x8b
mov word [rsp + 0x5e], 0x91
mov word [rsp + 0x60], 0x60
mov word [rsp + 0x62], 0x8c
mov word [rsp + 0x64], 0x8b
mov word [rsp + 0x66], 0x91
mov word [rsp + 0x68], 0x8f
mov word [rsp + 0x6a], 0x8c
mov word [rsp + 0x6c], 0x89
mov word [rsp + 0x6e], 0x70
mov word [rsp + 0x70], 0x82
mov word [rsp + 0x72], 0x91
mov word [rsp + 0x74], 0x79
mov word [rsp + 0x76], 0x70
mov word [rsp + 0x78], 0x82
mov word [rsp + 0x7a], 0x8f
mov word [rsp + 0x7c], 0x93
mov word [rsp + 0x7e], 0x86
mov word [rsp + pe_nt_image_headers64], 0x80
mov word [rsp + 0x82], 0x82
mov word [rsp + 0x84], 0x90
mov word [rsp + 0x86], 0x79
mov word [rsp + 0x88], 0x94
mov word [rsp + 0x8a], 0x92
mov word [rsp + 0x8c], 0x7e
mov word [rsp + 0x8e], 0x92
mov word [rsp + 0x90], 0x90
mov word [rsp + 0x92], 0x82
mov word [rsp + 0x94], 0x8f
mov word [rsp + 0x96], 0x93
mov word [rsp + 0x98], 0x1d
cmp byte [0x14059e9a0], 0
jne 0x140002621
mov byte [0x14059ea3a], 1
mov eax, 0
lea rcx, [0x14059e9c0]
movzx edx, word [rsp + rax*2 + 0x20]
mov word [rcx + rax*2], dx
add rax, 1
cmp rax, 0x3d
jne 0x1400025fb
mov byte [0x14059e9a0], 1
lea rcx, [0x14000168a]
call fcn.1400014f0
lea rax, [0x14059e9c0]
add rsp, 0xa8
ret

Function at 0x14000283c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x67
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x64
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059e680], 0
jne 0x1400028cc
mov byte [0x14059e69f], 1
mov eax, 0
lea rcx, [0x14059e690]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x1400028a7
mov byte [0x14059e680], 1
lea rcx, [0x140001775]
call fcn.1400014f0
lea rax, [0x14059e690]
add rsp, 0x38
ret
Function at 0x1400028d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x64
mov byte [rsp + 0x23], 0x54
mov byte [rsp + 0x24], 0x52
mov byte [rsp + 0x25], 0x5f
mov byte [rsp + 0x26], 0x58
mov byte [rsp + 0x27], 0x66
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x55
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059e628], 0
jne 0x140002968
mov byte [0x14059e63f], 1
mov eax, 0
lea rcx, [0x14059e630]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002943
mov byte [0x14059e628], 1
lea rcx, [0x1400017bd]
call fcn.1400014f0
lea rax, [0x14059e630]
add rsp, 0x38
ret

Function at 0x140002974
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x61
mov byte [rsp + 0x23], 0x54
mov byte [rsp + 0x24], 0x61
mov byte [rsp + 0x25], 0x63
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x65
mov byte [rsp + 0x28], 0x56
mov byte [rsp + 0x29], 0x54
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059e5a8], 0
jne 0x140002a04
mov byte [0x14059e5bf], 1
mov eax, 0
lea rcx, [0x14059e5b0]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x1400029df
mov byte [0x14059e5a8], 1
lea rcx, [0x14000181d]
call fcn.1400014f0
lea rax, [0x14059e5b0]
add rsp, 0x38
ret

Function at 0x140002a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x66
mov byte [rsp + 0x23], 0x64
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x5f
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x63
mov byte [rsp + 0x28], 0x65
mov byte [rsp + 0x29], 0x60
mov byte [rsp + 0x2a], 0x5f
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059e4e8], 0
jne 0x140002aa0
mov byte [0x14059e4ff], 1
mov eax, 0
lea rcx, [0x14059e4f0]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002a7b
mov byte [0x14059e4e8], 1
lea rcx, [0x1400018ad]
call fcn.1400014f0
lea rax, [0x14059e4f0]
add rsp, 0x38
ret
Function at 0x140002aac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x64
mov byte [rsp + 0x23], 0x66
mov byte [rsp + 0x24], 0x63
mov byte [rsp + 0x25], 0x57
mov byte [rsp + 0x26], 0x64
mov byte [rsp + 0x27], 0x59
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x5c
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059e3f8], 0
jne 0x140002b3c
mov byte [0x14059e40f], 1
mov eax, 0
lea rcx, [0x14059e400]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002b17
mov byte [0x14059e3f8], 1
lea rcx, [0x14000196d]
call fcn.1400014f0
lea rax, [0x14059e400]
add rsp, 0x38
ret

Function at 0x140002b48
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x67
mov byte [rsp + 0x28], 0x5a
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x52
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059e3a0], 0
jne 0x140002bd8
mov byte [0x14059e3bf], 1
mov eax, 0
lea rcx, [0x14059e3b0]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002bb3
mov byte [0x14059e3a0], 1
lea rcx, [0x1400019b5]
call fcn.1400014f0
lea rax, [0x14059e3b0]
add rsp, 0x38
ret

Function at 0x140002be4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x5c
mov byte [rsp + 0x23], 0x52
mov byte [rsp + 0x24], 0x64
mov byte [rsp + 0x25], 0x61
mov byte [rsp + 0x26], 0x56
mov byte [rsp + 0x27], 0x63
mov byte [rsp + 0x28], 0x64
mov byte [rsp + 0x29], 0x5c
mov byte [rsp + 0x2a], 0x6a
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059e2d8], 0
jne 0x140002c74
mov byte [0x14059e2ef], 1
mov eax, 0
lea rcx, [0x14059e2e0]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002c4f
mov byte [0x14059e2d8], 1
lea rcx, [0x140001a5d]
call fcn.1400014f0
lea rax, [0x14059e2e0]
add rsp, 0x38
ret
Function at 0x140002c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x67
mov byte [rsp + 0x28], 0x5a
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x52
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059e120], 0
jne 0x140002d10
mov byte [0x14059e13f], 1
mov eax, 0
lea rcx, [0x14059e130]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002ceb
mov byte [0x14059e120], 1
lea rcx, [0x140001bad]
call fcn.1400014f0
lea rax, [0x14059e130]
add rsp, 0x38
ret

Function at 0x140002d1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x53
mov byte [rsp + 0x23], 0x66
mov byte [rsp + 0x24], 0x5d
mov byte [rsp + 0x25], 0x5d
mov byte [rsp + 0x26], 0x58
mov byte [rsp + 0x27], 0x66
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x55
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059e0c0], 0
jne 0x140002dac
mov byte [0x14059e0df], 1
mov eax, 0
lea rcx, [0x14059e0d0]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002d87
mov byte [0x14059e0c0], 1
lea rcx, [0x140001bf5]
call fcn.1400014f0
lea rax, [0x14059e0d0]
add rsp, 0x38
ret

Function at 0x140002db8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x55
mov byte [rsp + 0x27], 0x63
mov byte [rsp + 0x28], 0x68
mov byte [rsp + 0x29], 0x56
mov byte [rsp + 0x2a], 0x53
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059e068], 0
jne 0x140002e48
mov byte [0x14059e07f], 1
mov eax, 0
lea rcx, [0x14059e070]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002e23
mov byte [0x14059e068], 1
lea rcx, [0x140001c3d]
call fcn.1400014f0
lea rax, [0x14059e070]
add rsp, 0x38
ret
Function at 0x140002e54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x6b
mov byte [rsp + 0x23], 0x60
mov byte [rsp + 0x24], 0x5f
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x5d
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x5e
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059df58], 0
jne 0x140002ee4
mov byte [0x14059df6f], 1
mov eax, 0
lea rcx, [0x14059df60]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002ebf
mov byte [0x14059df58], 1
lea rcx, [0x140001d15]
call fcn.1400014f0
lea rax, [0x14059df60]
add rsp, 0x38
ret

Function at 0x140002ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x23], 0x11
mov byte [rsp + 0x24], 0x65
mov byte [rsp + 0x25], 0x60
mov byte [rsp + 0x26], 0x65
mov byte [rsp + 0x27], 0x52
mov byte [rsp + 0x28], 0x5d
mov byte [rsp + 0x29], 0x52
mov byte [rsp + 0x2a], 0x67
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059e668], 0
jne 0x140002f76
mov byte [0x14059e67d], 1
mov eax, 0
lea rcx, [0x14059e670]
movzx edx, byte [rsp + rax + 0x23]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xd
jne 0x140002f51
mov byte [0x14059e668], 1
lea rcx, [0x14000178d]
call fcn.1400014f0
lea rax, [0x14059e670]
add rsp, 0x38
ret

Function at 0x140002f82
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x23], 0x11
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x68
mov byte [rsp + 0x26], 0x68
mov byte [rsp + 0x27], 0x1f
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x67
mov byte [rsp + 0x2a], 0x58
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059e498], 0
jne 0x140003008
mov byte [0x14059e4ad], 1
mov eax, 0
lea rcx, [0x14059e4a0]
movzx edx, byte [rsp + rax + 0x23]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xd
jne 0x140002fe3
mov byte [0x14059e498], 1
lea rcx, [0x1400018f5]
call fcn.1400014f0
lea rax, [0x14059e4a0]
add rsp, 0x38
ret

Function at 0x140003014
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x23], 0x11
mov byte [rsp + 0x24], 0x55
mov byte [rsp + 0x25], 0x61
mov byte [rsp + 0x26], 0x53
mov byte [rsp + 0x27], 0x60
mov byte [rsp + 0x28], 0x5d
mov byte [rsp + 0x29], 0x67
mov byte [rsp + 0x2a], 0x68
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x5f
mov byte [rsp + 0x2d], 0x56
mov byte [rsp + 0x2e], 0x65
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059e258], 0
jne 0x14000309a
mov byte [0x14059e26d], 1
mov eax, 0
lea rcx, [0x14059e260]
movzx edx, byte [rsp + rax + 0x23]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xd
jne 0x140003075
mov byte [0x14059e258], 1
lea rcx, [0x140001abd]
call fcn.1400014f0
lea rax, [0x14059e260]
add rsp, 0x38
ret
Function at 0x1400030a6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x23], 0x11
mov byte [rsp + 0x24], 0x52
mov byte [rsp + 0x25], 0x55
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x68
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x56
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059e178], 0
jne 0x14000312c
mov byte [0x14059e18d], 1
mov eax, 0
lea rcx, [0x14059e180]
movzx edx, byte [rsp + rax + 0x23]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xd
jne 0x140003107
mov byte [0x14059e178], 1
lea rcx, [0x140001b65]
call fcn.1400014f0
lea rax, [0x14059e180]
add rsp, 0x38
ret

Function at 0x140003138
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x65
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x65
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x5d
mov byte [rsp + 0x2a], 0x52
mov byte [rsp + 0x2b], 0x67
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x14059e640], 0
jne 0x1400031d2
mov byte [0x14059e661], 1
mov eax, 0
lea rcx, [0x14059e650]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x1400031ad
mov byte [0x14059e640], 1
lea rcx, [0x1400017a5]
call fcn.1400014f0
lea rax, [0x14059e650]
add rsp, 0x48
ret

Function at 0x1400031de
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x53
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x65
mov byte [rsp + 0x24], 0x55
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x57
mov byte [rsp + 0x27], 0x56
mov byte [rsp + 0x28], 0x5f
mov byte [rsp + 0x29], 0x55
mov byte [rsp + 0x2a], 0x56
mov byte [rsp + 0x2b], 0x63
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x14059e528], 0
jne 0x140003278
mov byte [0x14059e541], 1
mov eax, 0
lea rcx, [0x14059e530]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140003253
mov byte [0x14059e528], 1
lea rcx, [0x14000187d]
call fcn.1400014f0
lea rax, [0x14059e530]
add rsp, 0x48
ret
Function at 0x140003284
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x55
mov byte [rsp + 0x26], 0x61
mov byte [rsp + 0x27], 0x53
mov byte [rsp + 0x28], 0x60
mov byte [rsp + 0x29], 0x5d
mov byte [rsp + 0x2a], 0x67
mov byte [rsp + 0x2b], 0x68
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x5f
mov byte [rsp + 0x2e], 0x56
mov byte [rsp + 0x2f], 0x65
mov byte [rsp + 0x30], 0xf1
cmp byte [0x14059e230], 0
jne 0x14000331e
mov byte [0x14059e251], 1
mov eax, 0
lea rcx, [0x14059e240]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x1400032f9
mov byte [0x14059e230], 1
lea rcx, [0x140001ad5]
call fcn.1400014f0
lea rax, [0x14059e240]
add rsp, 0x48
ret

Function at 0x14000332a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x59
mov byte [rsp + 0x22], 0x60
mov byte [rsp + 0x23], 0x5e
mov byte [rsp + 0x24], 0x56
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x64
mov byte [rsp + 0x27], 0x60
mov byte [rsp + 0x28], 0x61
mov byte [rsp + 0x29], 0x59
mov byte [rsp + 0x2a], 0x60
mov byte [rsp + 0x2b], 0x64
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x14059e1d8], 0
jne 0x1400033c4
mov byte [0x14059e1f1], 1
mov eax, 0
lea rcx, [0x14059e1e0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x14000339f
mov byte [0x14059e1d8], 1
lea rcx, [0x140001b1d]
call fcn.1400014f0
lea rax, [0x14059e1e0]
add rsp, 0x48
ret

Function at 0x1400033d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x52
mov byte [rsp + 0x26], 0x55
mov byte [rsp + 0x27], 0x52
mov byte [rsp + 0x28], 0x68
mov byte [rsp + 0x29], 0x52
mov byte [rsp + 0x2a], 0x63
mov byte [rsp + 0x2b], 0x56
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x14059e190], 0
jne 0x14000346a
mov byte [0x14059e1b1], 1
mov eax, 0
lea rcx, [0x14059e1a0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140003445
mov byte [0x14059e190], 1
lea rcx, [0x140001b4d]
call fcn.1400014f0
lea rax, [0x14059e1a0]
add rsp, 0x48
ret