joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12d, r9d
mov r15d, r8d
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.1400cfa20
mov rdi, rax
test rax, rax
je 0x140022007
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1a], 0x69636570
mov rcx, rax
mov word [rbp - 0x1c], 0x5374
mov word [rbp - 0x1f], 0x4748
mov word [rbp - 0x10], 0x7265
mov byte [rbp - 0x20], 0x53
mov dword [rbp - 0x16], 0x6f466c61
mov word [rbp - 0xd], 0x7461
mov word [rbp - 0xa], 0x57
mov word [rbp - 0x12], 0x646c
mov byte [rbp - 0xb], 0x68
mov byte [rbp - 0x1d], 0x65
mov byte [rbp - 0xe], 0x50
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140021fff
mov r9d, r12d
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000987c
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002d370
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14002202c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, r8
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
call fcn.140008864
mov rdi, rax
test rax, rax
je 0x1400220c6
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x53746553
mov rcx, rax
mov word [rbp - 0x1c], 0x6972
mov word [rbp - 0x27], 0x4f65
mov dword [rbp - 0x21], 0x63655374
mov word [rbp - 0x19], 0x79
mov dword [rbp - 0x2c], 0x69767265
mov dword [rbp - 0x25], 0x63656a62
mov byte [rbp - 0x1a], 0x74
mov byte [rbp - 0x1d], 0x75
mov byte [rbp - 0x28], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400220be
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000987c
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400220f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, r8
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
call fcn.140008864
mov rdi, rax
test rax, rax
je 0x14002217b
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x14], 0x6e656b6f
mov rcx, rax
mov word [rbp - 0x1c], 0x7250
mov word [rbp - 0x19], 0x6563
mov dword [rbp - 0x20], 0x6e65704f
mov word [rbp - 0x16], 0x5473
mov byte [rbp - 0x1a], 0x6f
mov byte [rbp - 0x10], bl
mov byte [rbp - 0x17], 0x73
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140022173
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000987c
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400221a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov dword [rbp - 0x20], 0x46746547
mov rdi, rcx
mov word [rbp - 0x16], 0x65
or ebx, 0xffffffff
mov word [rbp - 0x1c], 0x6c69
mov word [rbp - 0x19], 0x6953
mov byte [rbp - 0x1a], 0x65
mov byte [rbp - 0x17], 0x7a
call fcn.14001c974
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002220c
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400222b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x70]
mov r12, r9
mov r13, qword [rbp + 0x68]
mov r15, r8
mov qword [rbp - 0x38], rax
mov r14, rdx
mov rsi, rcx
mov edi, 1
call fcn.140008864
mov rbx, rax
test rax, rax
je 0x140022367
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x2a], 0x61567972
mov rcx, rax
mov word [rbp - 0x22], 0x4178
mov word [rbp - 0x2c], 0x6575
mov word [rbp - 0x2f], 0x6765
mov word [rbp - 0x25], 0x6575
mov byte [rbp - 0x20], 0
mov byte [rbp - 0x30], 0x52
mov byte [rbp - 0x23], 0x45
mov byte [rbp - 0x2d], 0x51
mov byte [rbp - 0x26], 0x6c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002235f
mov rcx, qword [rbp - 0x38]
mov r9, r12
mov qword [rsp + 0x28], rcx
mov r8, r15
mov rcx, rsi
mov qword [rsp + 0x20], r13
mov rdx, r14
call rax
mov edi, eax
mov rcx, rbx
call fcn.14000987c
mov eax, edi
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.14002d370
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14002238c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov word [rsp + 0x28], 0x65
mov dword [rsp + 0x21], 0x6c61636f
mov word [rsp + 0x25], 0x7246
mov byte [rsp + 0x20], 0x4c
mov byte [rsp + 0x27], 0x65
call fcn.14001c974
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400223e4
mov rcx, rbx
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14002d370
add rsp, 0x40
pop rbx
ret
Function at 0x140022400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xa8
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x87]
mov r12, r9
mov r13, qword [rbp + 0x6f]
mov r15, r8
mov qword [rbp - 0x29], rax
mov r14, rdx
mov rax, qword [rbp + 0x8f]
mov rsi, rcx
mov qword [rbp - 0x31], rax
xor ebx, ebx
mov rax, qword [rbp + 0x97]
mov qword [rbp - 0x39], rax
mov rax, qword [rbp + 0x9f]
mov qword [rbp - 0x41], rax
call fcn.140008864
mov rdi, rax
test rax, rax
je 0x140022509
lea rdx, [rbp - 0x21]
mov dword [rbp - 0x20], 0x74616572
mov rcx, rax
mov dword [rbp - 0x15], 0x55734173
mov dword [rbp - 0x1a], 0x65636f72
mov dword [rbp - 0x10], 0x417265
mov byte [rbp - 0x21], 0x43
mov word [rbp - 0x1c], 0x5065
mov byte [rbp - 0x16], 0x73
mov byte [rbp - 0x11], 0x73
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140022501
mov rax, qword [rbp - 0x41]
mov r9, r12
mov qword [rsp + 0x50], rax
mov r8, r15
mov rax, qword [rbp - 0x39]
mov rdx, r14
mov qword [rsp + 0x48], rax
mov rcx, rsi
mov rax, qword [rbp - 0x31]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x29]
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0x7f]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x77]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
call r10
mov ebx, eax
mov rcx, rdi
call fcn.14000987c
mov eax, ebx
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14002d370
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140022534
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r13, qword [rbp + 0x68]
mov r12d, r9d
mov r15d, r8d
mov r14, rdx
mov rsi, rcx
mov edi, 1
call fcn.140008864
mov rbx, rax
test rax, rax
je 0x1400225c9
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x28], 0x4f676552
mov rcx, rax
mov word [rbp - 0x24], 0x6570
mov dword [rbp - 0x21], 0x4579654b
mov word [rbp - 0x1c], 0x57
mov byte [rbp - 0x22], 0x6e
mov byte [rbp - 0x1d], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400225c1
mov r9d, r12d
mov qword [rsp + 0x20], r13
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call fcn.14000987c
mov eax, edi
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.14002d370
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400225f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.1400cfa80
mov rdi, rax
test rax, rax
je 0x140022684
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x6e6f6973
mov rcx, rax
mov word [rbp - 0xa], 0x41
mov dword [rbp - 0x1f], 0x69467465
mov dword [rbp - 0x1a], 0x72655665
mov dword [rbp - 0xf], 0x7a69536f
mov word [rbp - 0x11], 0x666e
mov byte [rbp - 0x12], 0x49
mov byte [rbp - 0x1b], 0x6c
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0xb], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002267c
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000987c
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret

Function at 0x1400226ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, r9
mov r15, r8
mov r14d, edx
mov rsi, rcx
mov ebx, 0x80004005
call fcn.1400cfa20
mov rdi, rax
test rax, rax
je 0x140022747
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x6f466e77
mov rcx, rax
mov dword [rbp - 0x1d], 0x6e4b7465
mov byte [rbp - 0x19], 0x6f
mov dword [rbp - 0x12], 0x61507265
mov word [rbp - 0x1f], 0x4748
mov word [rbp - 0xe], 0x6874
mov word [rbp - 0x14], 0x646c
mov byte [rbp - 0x20], 0x53
mov byte [rbp - 0xc], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002273f
mov r9, r12
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.14000987c
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002d370
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14002276c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov dword [rbp - 0x20], 0x4c746547
mov byte [rbp - 0x14], bl
mov dword [rbp - 0x1b], 0x72457473
mov word [rbp - 0x16], 0x726f
mov byte [rbp - 0x17], 0x72
mov byte [rbp - 0x1c], 0x61
call fcn.14001c974
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400227c3
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140023e68
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rdi, r8
xor edx, edx
mov rbx, r9
mov rsi, rcx
lea r8d, [rdx + 0x5c]
call fcn.14002f900
mov r8, rbx
mov dword [rsi], 0x67452301
mov rdx, rdi
mov dword [rsi + 4], 0xefcdab89
mov rcx, rsi
mov dword [rsi + 8], 0x98badcfe
mov dword [rsi + 0xc], 0x10325476
call fcn.140024804
xor edx, edx
lea rbx, [rsi + 0x5c]
mov rcx, rbx
lea r8d, [rdx + 0x40]
call fcn.14002f900
mov rdx, rsi
mov rcx, rbx
call fcn.14002467c
xor eax, eax
mov qword [r14 + 0x18], 0xf
mov qword [r14], rax
mov r9, rbx
mov qword [r14 + 0x10], rax
mov r8b, al
mov rcx, r14
mov byte [r14], al
lea edx, [rax + 0x10]
call fcn.140022af8
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140024434
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, r9
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov qword [rbp - 0x58], rdx
mov rbx, qword [rbp + 0x58]
mov qword [rbp - 0x58], rbx
xor edx, edx
lea r8d, [rdx + 0x5c]
call fcn.14002f900
mov dword [rdi], 0x67452301
mov dword [rdi + 4], 0xefcdab89
mov dword [rdi + 8], 0x98badcfe
mov dword [rdi + 0xc], 0x10325476
mov r8, r15
mov rdx, r14
mov rcx, rdi
call fcn.140024804
mov r8, qword [rbx + 0x10]
test r8, r8
je 0x1400244bc
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400244b4
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.140024804
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.1400243c8
nop
xor edx, edx
lea r8d, [rdx + 0x5c]
mov rcx, rdi
call fcn.14002f900
mov dword [rdi], 0x67452301
mov dword [rdi + 4], 0xefcdab89
mov dword [rdi + 8], 0x98badcfe
mov dword [rdi + 0xc], 0x10325476
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov r8d, 0x10
mov rcx, rdi
call fcn.140024804
mov r8, r15
mov rdx, r14
mov rcx, rdi
call fcn.140024804
mov r8, qword [rbx + 0x10]
test r8, r8
je 0x14002453a
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140024532
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.140024804
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.1400243c8
nop
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae r8, qword [rbp - 0x50]
mov r9, qword [rbp - 0x40]
xor edx, edx
mov rcx, rax
call fcn.140025844
and qword [rsi], 0
and qword [rsi + 0x10], 0
and qword [rsi + 0x18], 0
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsi + 0x10], xmm1
and qword [rax + 0x10], 0
mov r14d, 0xf
mov qword [rax + 0x18], r14
mov byte [rax], 0
mov edi, 0x1000
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400245cd
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, rdi
jb 0x1400245c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024674
call fcn.14002d3d4
and qword [rbp - 0x20], 0
mov qword [rbp - 0x18], r14
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14002460e
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, rdi
jb 0x140024608
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024668
call fcn.14002d3d4
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140024640
inc rdx
mov rcx, qword [rbx]
cmp rdx, rdi
jb 0x14002463b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002466e
mov rcx, r8
call fcn.14002d3d4
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], r14
mov byte [rbx], 0
mov rax, rsi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140033a5c
nop
call fcn.140033a5c
nop
call fcn.140033a5c
int3
Function at 0x1400249c8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140024a37
cmp byte [rcx + 0x71], 0
je 0x140024a37
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140024a8b
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140024a51
sub eax, 1
je 0x140024a55
cmp eax, 2
jne 0x140024a8b
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140024a82
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140034bbc
cmp rdi, rax
jne 0x140024a8b
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140024a39
xor al, al
jmp 0x140024a39
Function at 0x1400266e8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x140026721
xor eax, eax
jmp 0x140026843
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x14002675b
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x14002675b
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x140026843
cmp qword [rbx + 0x80], 0
je 0x140026841
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140026796
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400267b9
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call fcn.1400342a0
cmp eax, edi
cmovne edi, esi
jmp 0x140026841
lea r8, [rbp - 0x38]
mov byte [rbp - 0x40], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x3f]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x40]
call qword [rax + 0x38]
test eax, eax
je 0x140026807
sub eax, 1
je 0x140026807
cmp eax, 2
jne 0x140026841
movsx ecx, byte [rbp - 0x40]
jmp 0x1400267a3
mov r14, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x140026831
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.140034bbc
cmp r14, rax
jne 0x140026841
lea rax, [rbp - 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x30], rax
mov eax, esi
jne 0x140026843
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002d370
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140028a74
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov qword [rbp - 0x30], rcx
mov rbx, rcx
mov word [rbp - 0x28], 0x6c47
mov dword [rbp - 0x1f], 0x6174736e
mov dword [rbp - 0x25], 0x5c6c6162
mov dword [rbp - 0x15], 0x786574
mov word [rbp - 0x17], 0x754d
mov word [rbp - 0x1a], 0x656c
mov word [rbp - 0x21], 0x4943
mov byte [rbp - 0x26], 0x6f
mov byte [rbp - 0x1b], 0x6c
mov byte [rbp - 0x18], 0x72
call fcn.140028184
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140028af4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov qword [rbp - 0x30], rcx
mov rbx, rcx
mov dword [rbp - 0x24], 0x465c6c61
mov word [rbp - 0x27], 0x6f6c
mov word [rbp - 0x13], 0x7865
mov dword [rbp - 0x20], 0x736e4946
mov dword [rbp - 0x18], 0x754d7265
mov byte [rbp - 0x28], 0x47
mov dword [rbp - 0x1c], 0x6c6c6174
mov byte [rbp - 0x25], 0x62
mov byte [rbp - 0x11], 0
mov byte [rbp - 0x14], 0x74
call fcn.140028184
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x140028dec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov qword [rbp - 0x30], rcx
mov rbx, rcx
mov word [rbp - 0x1a], 0x6c6c
mov word [rbp - 0x20], 0x4945
mov word [rbp - 0x28], 0x6c47
mov word [rbp - 0x1d], 0x7473
mov dword [rbp - 0x25], 0x5c6c6162
mov dword [rbp - 0x17], 0x74754d72
mov byte [rbp - 0x18], 0x65
mov byte [rbp - 0x1b], 0x61
mov byte [rbp - 0x26], 0x6f
mov byte [rbp - 0x21], 0x49
mov word [rbp - 0x12], 0x78
mov byte [rbp - 0x1e], 0x6e
mov byte [rbp - 0x13], 0x65
call fcn.140028184
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002d370
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140028e78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1400f8148]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov qword [rbp - 0x31], rcx
and dword [rbp - 0x39], 0
and qword [rcx], 0
and qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 0xf
mov byte [rcx], 0
mov dword [rbp - 0x39], 1
xor edi, edi
mov dword [rbp - 0x23], 0x642e3233
mov word [rbp - 0x1f], 0x6c6c
mov dword [rbp - 0x27], 0x6c656e72
mov byte [rbp - 0x1d], dil
mov word [rbp - 0x29], 0x654b
mov word [rbp - 0x10], 0x6e75
mov word [rbp - 0x13], 0x436b
mov word [rbp - 0x16], 0x6954
mov word [rbp - 0x19], 0x6547
mov word [rbp - 0xe], 0x74
mov byte [rbp - 0x11], 0x6f
mov byte [rbp - 0x17], 0x74
mov byte [rbp - 0x14], 0x63
lea rcx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140028f2d
call rax
mov edi, eax
mov word [rbp + 0x24], 0x2525
mov word [rbp + 0x14], 0x6576
mov dword [rbp + 0x36], 0x26642525
mov word [rbp + 0x3f], 0x6425
mov dword [rbp - 4], 0x732f2f3a
mov dword [rbp + 0x19], 0x253d6e6f
mov dword [rbp + 0x27], 0x72617626
mov word [rbp + 0x17], 0x6973
mov dword [rbp + 0x3a], 0x656d6974
mov word [rbp + 3], 0x6d70
mov dword [rbp + 6], 0x2f6d6f63
mov byte [rbp + 0x41], 0
mov word [rbp], 0x6f73
mov dword [rbp + 0x30], 0x756c6176
mov byte [rbp + 0x3e], 0x3d
mov dword [rbp - 9], 0x70747468
mov dword [rbp + 0x2b], 0x7325253d
mov dword [rbp + 0xd], 0x702e6b63
mov word [rbp + 0x1d], 0x2673
mov word [rbp + 0xa], 0x6266
mov byte [rbp + 0x26], 0x73
mov byte [rbp + 0x16], 0x72
mov dword [rbp + 0x20], 0x3d646975
mov word [rbp + 0x11], 0x7068
mov byte [rbp + 0x13], 0x3f
mov byte [rbp + 0x2f], 0x26
mov byte [rbp + 0x1f], 0x67
mov byte [rbp + 2], 0x61
mov byte [rbp - 5], 0x73
mov word [rbp + 0x34], 0x3d65
mov byte [rbp + 5], 0x2e
mov byte [rbp + 0xc], 0x61
mov r8d, edi
lea rdx, [rbp - 9]
mov rcx, rbx
call fcn.140028814
mov rax, rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14002d370
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret