joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002bb4c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14001ae40
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14002bbd6
cmp byte [rbp - 0x21], r15b
je 0x14002bbd1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14002bc0c
call fcn.1400248c4
test eax, eax
jne 0x14002bbf8
cmp byte [rbp - 0x21], r15b
je 0x14002bbf0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14002bc0c
cmp byte [rbp - 0x21], r15b
je 0x14002bc09
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14001b41c
test eax, eax
jne 0x14002bcac
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14001ae40
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14002bc4b
cmp byte [rbp - 0x21], r15b
je 0x14002bc80
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14002bc80
call fcn.1400248c4
test eax, eax
jne 0x14002bc6c
cmp byte [rbp - 0x21], r15b
je 0x14002bc65
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14002bc80
cmp byte [rbp - 0x21], r15b
je 0x14002bc7d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14001b41c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14002bcac
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14002bcaf
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14002bcbd
mov rcx, rdi
call fcn.14001c3b0
cmp byte [rbp + 0x3f], r15b
je 0x14002bccc
mov rcx, qword [rbp + 0x27]
call fcn.14001c3b0
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14002e1c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002e1e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002e1e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140007244
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x140007252
mov byte [rsp + 8], 0x4d
mov byte [rsp + 9], 0x65
mov byte [rsp + 0xa], 0x73
mov byte [rsp + 0xb], 0x73
mov byte [rsp + 0xc], 0x61
mov byte [rsp + 0xd], 0x67
mov byte [rsp + 0xe], 0x65
mov byte [rsp + 0xf], 0x42
mov byte [rsp + 0x10], 0x6f
mov byte [rsp + 0x11], 0x78
mov byte [rsp + 0x12], 0x41
mov byte [rsp + 0x13], 0
mov qword [rsp], 0
jmp 0x1400072a6
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xc
jae 0x1400072d0
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000729b
mov rax, qword [rsp + 0x30]
jmp 0x1400072df
add rsp, 0x28
ret

Function at 0x140007751
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x14000775f
mov byte [rsp + 8], 0x44
mov byte [rsp + 9], 0x62
mov byte [rsp + 0xa], 0x67
mov byte [rsp + 0xb], 0x42
mov byte [rsp + 0xc], 0x72
mov byte [rsp + 0xd], 0x65
mov byte [rsp + 0xe], 0x61
mov byte [rsp + 0xf], 0x6b
mov byte [rsp + 0x10], 0x50
mov byte [rsp + 0x11], 0x6f
mov byte [rsp + 0x12], 0x69
mov byte [rsp + 0x13], 0x6e
mov byte [rsp + 0x14], 0x74
mov byte [rsp + 0x15], 0
mov qword [rsp], 0
jmp 0x1400077bd
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe
jae 0x1400077e7
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x1400077b2
mov rax, qword [rsp + 0x30]
jmp 0x1400077f6
add rsp, 0x28
ret

Function at 0x140008035
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov dword [rsp + 4], 0
mov dword [rsp + 8], 0
mov dword [rsp + 0xc], 0
mov dword [rsp], 0
mov eax, dword [rsp + 0x40]
and eax, 0x20000000
test eax, eax
je 0x140008075
mov dword [rsp + 4], 1
mov eax, dword [rsp + 0x40]
and eax, 0x40000000
test eax, eax
je 0x14000808e
mov dword [rsp + 8], 1
mov eax, dword [rsp + 0x40]
and eax, 0x80000000
test eax, eax
je 0x1400080a7
mov dword [rsp + 0xc], 1
mov dword [rsp + 0x10], 1
mov dword [rsp + 0x14], 8
mov dword [rsp + 0x18], 2
mov dword [rsp + 0x1c], 4
mov dword [rsp + 0x20], 0x10
mov dword [rsp + 0x24], 0x80
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x2c], 0x40
movsxd rax, dword [rsp + 4]
imul rax, rax, 0x10
lea rax, [rsp + rax + 0x10]
movsxd rcx, dword [rsp + 8]
lea rax, [rax + rcx*8]
movsxd rcx, dword [rsp + 0xc]
mov eax, dword [rax + rcx*4]
mov dword [rsp], eax
mov eax, dword [rsp + 0x40]
and eax, 0x4000000
test eax, eax
je 0x140008124
mov eax, dword [rsp]
bts eax, 9
mov dword [rsp], eax
mov eax, dword [rsp]
add rsp, 0x38
ret
Function at 0x14000cd20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x14000cd2e
mov byte [rsp + 8], 0x4d
mov byte [rsp + 9], 0x65
mov byte [rsp + 0xa], 0x73
mov byte [rsp + 0xb], 0x73
mov byte [rsp + 0xc], 0x61
mov byte [rsp + 0xd], 0x67
mov byte [rsp + 0xe], 0x65
mov byte [rsp + 0xf], 0x42
mov byte [rsp + 0x10], 0x6f
mov byte [rsp + 0x11], 0x78
mov byte [rsp + 0x12], 0x57
mov byte [rsp + 0x13], 0
mov qword [rsp], 0
jmp 0x14000cd82
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xc
jae 0x14000cdac
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000cd77
mov rax, qword [rsp + 0x30]
jmp 0x14000cdbb
add rsp, 0x28
ret

Function at 0x14000cdc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
jmp 0x14000cdce
mov byte [rsp + 8], 0x52
mov byte [rsp + 9], 0x74
mov byte [rsp + 0xa], 0x6c
mov byte [rsp + 0xb], 0x41
mov byte [rsp + 0xc], 0x64
mov byte [rsp + 0xd], 0x64
mov byte [rsp + 0xe], 0x56
mov byte [rsp + 0xf], 0x65
mov byte [rsp + 0x10], 0x63
mov byte [rsp + 0x11], 0x74
mov byte [rsp + 0x12], 0x6f
mov byte [rsp + 0x13], 0x72
mov byte [rsp + 0x14], 0x65
mov byte [rsp + 0x15], 0x64
mov byte [rsp + 0x16], 0x45
mov byte [rsp + 0x17], 0x78
mov byte [rsp + 0x18], 0x63
mov byte [rsp + 0x19], 0x65
mov byte [rsp + 0x1a], 0x70
mov byte [rsp + 0x1b], 0x74
mov byte [rsp + 0x1c], 0x69
mov byte [rsp + 0x1d], 0x6f
mov byte [rsp + 0x1e], 0x6e
mov byte [rsp + 0x1f], 0x48
mov byte [rsp + 0x20], 0x61
mov byte [rsp + 0x21], 0x6e
mov byte [rsp + 0x22], 0x64
mov byte [rsp + 0x23], 0x6c
mov byte [rsp + 0x24], 0x65
mov byte [rsp + 0x25], 0x72
mov byte [rsp + 0x26], 0
mov qword [rsp], 0
jmp 0x14000ce81
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x1f
jae 0x14000ceab
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000ce76
mov rax, qword [rsp + 0x40]
jmp 0x14000ceba
add rsp, 0x38
ret

Function at 0x14000cf16
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x14000cf24
mov byte [rsp + 8], 0x5f
mov byte [rsp + 9], 0x76
mov byte [rsp + 0xa], 0x73
mov byte [rsp + 0xb], 0x6e
mov byte [rsp + 0xc], 0x70
mov byte [rsp + 0xd], 0x72
mov byte [rsp + 0xe], 0x69
mov byte [rsp + 0xf], 0x6e
mov byte [rsp + 0x10], 0x74
mov byte [rsp + 0x11], 0x66
mov byte [rsp + 0x12], 0
mov qword [rsp], 0
jmp 0x14000cf73
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xb
jae 0x14000cf9d
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000cf68
mov rax, qword [rsp + 0x30]
jmp 0x14000cfac
add rsp, 0x28
ret
Function at 0x14000d14d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x14000d15b
mov byte [rsp + 8], 0x4c
mov byte [rsp + 9], 0x6f
mov byte [rsp + 0xa], 0x61
mov byte [rsp + 0xb], 0x64
mov byte [rsp + 0xc], 0x4c
mov byte [rsp + 0xd], 0x69
mov byte [rsp + 0xe], 0x62
mov byte [rsp + 0xf], 0x72
mov byte [rsp + 0x10], 0x61
mov byte [rsp + 0x11], 0x72
mov byte [rsp + 0x12], 0x79
mov byte [rsp + 0x13], 0x45
mov byte [rsp + 0x14], 0x78
mov byte [rsp + 0x15], 0x41
mov byte [rsp + 0x16], 0
mov qword [rsp], 0
jmp 0x14000d1be
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xf
jae 0x14000d1e8
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000d1b3
mov rax, qword [rsp + 0x30]
jmp 0x14000d1f7
add rsp, 0x28
ret

Function at 0x14000d253
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x14000d261
mov byte [rsp + 8], 0x4c
mov byte [rsp + 9], 0x6f
mov byte [rsp + 0xa], 0x61
mov byte [rsp + 0xb], 0x64
mov byte [rsp + 0xc], 0x4c
mov byte [rsp + 0xd], 0x69
mov byte [rsp + 0xe], 0x62
mov byte [rsp + 0xf], 0x72
mov byte [rsp + 0x10], 0x61
mov byte [rsp + 0x11], 0x72
mov byte [rsp + 0x12], 0x79
mov byte [rsp + 0x13], 0x41
mov byte [rsp + 0x14], 0
mov qword [rsp], 0
jmp 0x14000d2ba
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xd
jae 0x14000d2e4
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000d2af
mov rax, qword [rsp + 0x30]
jmp 0x14000d2f3
add rsp, 0x28
ret

Function at 0x14000d2f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x14000d306
mov byte [rsp + 8], 0x47
mov byte [rsp + 9], 0x65
mov byte [rsp + 0xa], 0x74
mov byte [rsp + 0xb], 0x50
mov byte [rsp + 0xc], 0x72
mov byte [rsp + 0xd], 0x6f
mov byte [rsp + 0xe], 0x63
mov byte [rsp + 0xf], 0x41
mov byte [rsp + 0x10], 0x64
mov byte [rsp + 0x11], 0x64
mov byte [rsp + 0x12], 0x72
mov byte [rsp + 0x13], 0x65
mov byte [rsp + 0x14], 0x73
mov byte [rsp + 0x15], 0x73
mov byte [rsp + 0x16], 0
mov qword [rsp], 0
jmp 0x14000d369
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xf
jae 0x14000d393
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000d35e
mov rax, qword [rsp + 0x30]
jmp 0x14000d3a2
add rsp, 0x28
ret
Function at 0x14000d3a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x14000d3b5
mov byte [rsp + 8], 0x54
mov byte [rsp + 9], 0x70
mov byte [rsp + 0xa], 0x53
mov byte [rsp + 0xb], 0x65
mov byte [rsp + 0xc], 0x74
mov byte [rsp + 0xd], 0x54
mov byte [rsp + 0xe], 0x69
mov byte [rsp + 0xf], 0x6d
mov byte [rsp + 0x10], 0x65
mov byte [rsp + 0x11], 0x72
mov byte [rsp + 0x12], 0
mov qword [rsp], 0
jmp 0x14000d404
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xb
jae 0x14000d42e
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000d3f9
mov rax, qword [rsp + 0x30]
jmp 0x14000d43d
add rsp, 0x28
ret

Function at 0x14000d442
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x14000d450
mov byte [rsp + 8], 0x43
mov byte [rsp + 9], 0x72
mov byte [rsp + 0xa], 0x65
mov byte [rsp + 0xb], 0x61
mov byte [rsp + 0xc], 0x74
mov byte [rsp + 0xd], 0x65
mov byte [rsp + 0xe], 0x54
mov byte [rsp + 0xf], 0x68
mov byte [rsp + 0x10], 0x72
mov byte [rsp + 0x11], 0x65
mov byte [rsp + 0x12], 0x61
mov byte [rsp + 0x13], 0x64
mov byte [rsp + 0x14], 0x70
mov byte [rsp + 0x15], 0x6f
mov byte [rsp + 0x16], 0x6f
mov byte [rsp + 0x17], 0x6c
mov byte [rsp + 0x18], 0x54
mov byte [rsp + 0x19], 0x69
mov byte [rsp + 0x1a], 0x6d
mov byte [rsp + 0x1b], 0x65
mov byte [rsp + 0x1c], 0x72
mov byte [rsp + 0x1d], 0
mov qword [rsp], 0
jmp 0x14000d4d6
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x16
jae 0x14000d500
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000d4cb
mov rax, qword [rsp + 0x30]
jmp 0x14000d50f
add rsp, 0x28
ret

Function at 0x14000d514
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
jmp 0x14000d522
mov byte [rsp + 8], 0x43
mov byte [rsp + 9], 0x72
mov byte [rsp + 0xa], 0x65
mov byte [rsp + 0xb], 0x61
mov byte [rsp + 0xc], 0x74
mov byte [rsp + 0xd], 0x65
mov byte [rsp + 0xe], 0x54
mov byte [rsp + 0xf], 0x68
mov byte [rsp + 0x10], 0x72
mov byte [rsp + 0x11], 0x65
mov byte [rsp + 0x12], 0x61
mov byte [rsp + 0x13], 0x64
mov byte [rsp + 0x14], 0x70
mov byte [rsp + 0x15], 0x6f
mov byte [rsp + 0x16], 0x6f
mov byte [rsp + 0x17], 0x6c
mov byte [rsp + 0x18], 0x43
mov byte [rsp + 0x19], 0x6c
mov byte [rsp + 0x1a], 0x65
mov byte [rsp + 0x1b], 0x61
mov byte [rsp + 0x1c], 0x6e
mov byte [rsp + 0x1d], 0x75
mov byte [rsp + 0x1e], 0x70
mov byte [rsp + 0x1f], 0x47
mov byte [rsp + 0x20], 0x72
mov byte [rsp + 0x21], 0x6f
mov byte [rsp + 0x22], 0x75
mov byte [rsp + 0x23], 0x70
mov byte [rsp + 0x24], 0
mov qword [rsp], 0
jmp 0x14000d5cb
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x1d
jae 0x14000d5f5
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000d5c0
mov rax, qword [rsp + 0x40]
jmp 0x14000d604
add rsp, 0x38
ret
Function at 0x14000d660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x14000d66e
mov byte [rsp + 8], 0x54
mov byte [rsp + 9], 0x70
mov byte [rsp + 0xa], 0x53
mov byte [rsp + 0xb], 0x65
mov byte [rsp + 0xc], 0x74
mov byte [rsp + 0xd], 0x50
mov byte [rsp + 0xe], 0x6f
mov byte [rsp + 0xf], 0x6f
mov byte [rsp + 0x10], 0x6c
mov byte [rsp + 0x11], 0x4d
mov byte [rsp + 0x12], 0x69
mov byte [rsp + 0x13], 0x6e
mov byte [rsp + 0x14], 0x54
mov byte [rsp + 0x15], 0x68
mov byte [rsp + 0x16], 0x72
mov byte [rsp + 0x17], 0x65
mov byte [rsp + 0x18], 0x61
mov byte [rsp + 0x19], 0x64
mov byte [rsp + 0x1a], 0x73
mov byte [rsp + 0x1b], 0
mov qword [rsp], 0
jmp 0x14000d6ea
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x14
jae 0x14000d714
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000d6df
mov rax, qword [rsp + 0x30]
jmp 0x14000d723
add rsp, 0x28
ret

Function at 0x14000d728
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x14000d736
mov byte [rsp + 8], 0x54
mov byte [rsp + 9], 0x70
mov byte [rsp + 0xa], 0x53
mov byte [rsp + 0xb], 0x65
mov byte [rsp + 0xc], 0x74
mov byte [rsp + 0xd], 0x50
mov byte [rsp + 0xe], 0x6f
mov byte [rsp + 0xf], 0x6f
mov byte [rsp + 0x10], 0x6c
mov byte [rsp + 0x11], 0x4d
mov byte [rsp + 0x12], 0x61
mov byte [rsp + 0x13], 0x78
mov byte [rsp + 0x14], 0x54
mov byte [rsp + 0x15], 0x68
mov byte [rsp + 0x16], 0x72
mov byte [rsp + 0x17], 0x65
mov byte [rsp + 0x18], 0x61
mov byte [rsp + 0x19], 0x64
mov byte [rsp + 0x1a], 0x73
mov byte [rsp + 0x1b], 0
mov qword [rsp], 0
jmp 0x14000d7b2
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x14
jae 0x14000d7dc
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000d7a7
mov rax, qword [rsp + 0x30]
jmp 0x14000d7eb
add rsp, 0x28
ret

Function at 0x14000d7f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x14000d7fe
mov byte [rsp + 8], 0x43
mov byte [rsp + 9], 0x72
mov byte [rsp + 0xa], 0x65
mov byte [rsp + 0xb], 0x61
mov byte [rsp + 0xc], 0x74
mov byte [rsp + 0xd], 0x65
mov byte [rsp + 0xe], 0x54
mov byte [rsp + 0xf], 0x68
mov byte [rsp + 0x10], 0x72
mov byte [rsp + 0x11], 0x65
mov byte [rsp + 0x12], 0x61
mov byte [rsp + 0x13], 0x64
mov byte [rsp + 0x14], 0x70
mov byte [rsp + 0x15], 0x6f
mov byte [rsp + 0x16], 0x6f
mov byte [rsp + 0x17], 0x6c
mov byte [rsp + 0x18], 0
mov qword [rsp], 0
jmp 0x14000d86b
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x11
jae 0x14000d895
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000d860
mov rax, qword [rsp + 0x30]
jmp 0x14000d8a4
add rsp, 0x28
ret
Function at 0x14000e23d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x14000e24b
mov byte [rsp + 8], 0x4e
mov byte [rsp + 9], 0x74
mov byte [rsp + 0xa], 0x54
mov byte [rsp + 0xb], 0x65
mov byte [rsp + 0xc], 0x72
mov byte [rsp + 0xd], 0x6d
mov byte [rsp + 0xe], 0x69
mov byte [rsp + 0xf], 0x6e
mov byte [rsp + 0x10], 0x61
mov byte [rsp + 0x11], 0x74
mov byte [rsp + 0x12], 0x65
mov byte [rsp + 0x13], 0x50
mov byte [rsp + 0x14], 0x72
mov byte [rsp + 0x15], 0x6f
mov byte [rsp + 0x16], 0x63
mov byte [rsp + 0x17], 0x65
mov byte [rsp + 0x18], 0x73
mov byte [rsp + 0x19], 0x73
mov byte [rsp + 0x1a], 0
mov qword [rsp], 0
jmp 0x14000e2c2
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x13
jae 0x14000e2ec
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000e2b7
mov rax, qword [rsp + 0x30]
jmp 0x14000e2fb
add rsp, 0x28
ret

Function at 0x14000e9c3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
jmp 0x14000e9d1
mov byte [rsp + 8], 0x4e
mov byte [rsp + 9], 0x74
mov byte [rsp + 0xa], 0x4f
mov byte [rsp + 0xb], 0x70
mov byte [rsp + 0xc], 0x65
mov byte [rsp + 0xd], 0x6e
mov byte [rsp + 0xe], 0x54
mov byte [rsp + 0xf], 0x68
mov byte [rsp + 0x10], 0x72
mov byte [rsp + 0x11], 0x65
mov byte [rsp + 0x12], 0x61
mov byte [rsp + 0x13], 0x64
mov byte [rsp + 0x14], 0
mov qword [rsp], 0
jmp 0x14000ea2a
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xd
jae 0x14000ea54
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000ea1f
mov rax, qword [rsp + 0x30]
jmp 0x14000ea63
add rsp, 0x28
ret

Function at 0x14000ea68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
jmp 0x14000ea76
mov byte [rsp + 8], 0x4e
mov byte [rsp + 9], 0x74
mov byte [rsp + 0xa], 0x51
mov byte [rsp + 0xb], 0x75
mov byte [rsp + 0xc], 0x65
mov byte [rsp + 0xd], 0x72
mov byte [rsp + 0xe], 0x79
mov byte [rsp + 0xf], 0x53
mov byte [rsp + 0x10], 0x79
mov byte [rsp + 0x11], 0x73
mov byte [rsp + 0x12], 0x74
mov byte [rsp + 0x13], 0x65
mov byte [rsp + 0x14], 0x6d
mov byte [rsp + 0x15], 0x49
mov byte [rsp + 0x16], 0x6e
mov byte [rsp + 0x17], 0x66
mov byte [rsp + 0x18], 0x6f
mov byte [rsp + 0x19], 0x72
mov byte [rsp + 0x1a], 0x6d
mov byte [rsp + 0x1b], 0x61
mov byte [rsp + 0x1c], 0x74
mov byte [rsp + 0x1d], 0x69
mov byte [rsp + 0x1e], 0x6f
mov byte [rsp + 0x1f], 0x6e
mov byte [rsp + 0x20], 0
mov qword [rsp], 0
jmp 0x14000eb0b
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x19
jae 0x14000eb35
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000eb00
mov rax, qword [rsp + 0x40]
jmp 0x14000eb44
add rsp, 0x38
ret
Function at 0x14000eba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
jmp 0x14000ebae
mov byte [rsp + 8], 0x4e
mov byte [rsp + 9], 0x74
mov byte [rsp + 0xa], 0x51
mov byte [rsp + 0xb], 0x75
mov byte [rsp + 0xc], 0x65
mov byte [rsp + 0xd], 0x72
mov byte [rsp + 0xe], 0x79
mov byte [rsp + 0xf], 0x49
mov byte [rsp + 0x10], 0x6e
mov byte [rsp + 0x11], 0x66
mov byte [rsp + 0x12], 0x6f
mov byte [rsp + 0x13], 0x72
mov byte [rsp + 0x14], 0x6d
mov byte [rsp + 0x15], 0x61
mov byte [rsp + 0x16], 0x74
mov byte [rsp + 0x17], 0x69
mov byte [rsp + 0x18], 0x6f
mov byte [rsp + 0x19], 0x6e
mov byte [rsp + 0x1a], 0x54
mov byte [rsp + 0x1b], 0x68
mov byte [rsp + 0x1c], 0x72
mov byte [rsp + 0x1d], 0x65
mov byte [rsp + 0x1e], 0x61
mov byte [rsp + 0x1f], 0x64
mov byte [rsp + 0x20], 0
mov qword [rsp], 0
jmp 0x14000ec43
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x19
jae 0x14000ec6d
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000ec38
mov rax, qword [rsp + 0x40]
jmp 0x14000ec7c
add rsp, 0x38
ret

Function at 0x14000ec81
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
jmp 0x14000ec8f
mov byte [rsp + 8], 0x4e
mov byte [rsp + 9], 0x74
mov byte [rsp + 0xa], 0x51
mov byte [rsp + 0xb], 0x75
mov byte [rsp + 0xc], 0x65
mov byte [rsp + 0xd], 0x72
mov byte [rsp + 0xe], 0x79
mov byte [rsp + 0xf], 0x49
mov byte [rsp + 0x10], 0x6e
mov byte [rsp + 0x11], 0x66
mov byte [rsp + 0x12], 0x6f
mov byte [rsp + 0x13], 0x72
mov byte [rsp + 0x14], 0x6d
mov byte [rsp + 0x15], 0x61
mov byte [rsp + 0x16], 0x74
mov byte [rsp + 0x17], 0x69
mov byte [rsp + 0x18], 0x6f
mov byte [rsp + 0x19], 0x6e
mov byte [rsp + 0x1a], 0x50
mov byte [rsp + 0x1b], 0x72
mov byte [rsp + 0x1c], 0x6f
mov byte [rsp + 0x1d], 0x63
mov byte [rsp + 0x1e], 0x65
mov byte [rsp + 0x1f], 0x73
mov byte [rsp + 0x20], 0x73
mov byte [rsp + 0x21], 0
mov qword [rsp], 0
jmp 0x14000ed29
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x1a
jae 0x14000ed53
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
movzx ecx, byte [rsp + rcx + 8]
mov byte [rax], cl
jmp 0x14000ed1e
mov rax, qword [rsp + 0x40]
jmp 0x14000ed62
add rsp, 0x38
ret