joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023c78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov edi, 1
call fcn.140021664
mov rbx, rax
test rax, rax
je 0x140023cf3
lea rdx, [rbp - 0x10]
mov word [rbp - 0xc], 0x6570
mov rcx, rax
mov dword [rbp - 9], 0x4179654b
mov dword [rbp - 0x10], 0x4f676552
mov byte [rbp - 0xa], 0x6e
mov byte [rbp - 5], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023cea
mov r8, rsi
mov rdx, r14
mov rcx, 0xffffffff80000002
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret

Function at 0x140023d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rsi, r9
mov r14, r8
mov r15, rdx
xor ebx, ebx
call fcn.140021664
mov rdi, rax
test rax, rax
je 0x140023db4
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x6e756f63
mov rcx, rax
mov dword [rbp - 0x13], 0x41646953
mov dword [rbp - 0x1e], 0x70756b6f
mov byte [rbp - 0xf], bl
mov word [rbp - 0x20], 0x6f4c
mov word [rbp - 0x1a], 0x6341
mov byte [rbp - 0x14], 0x74
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140023dab
mov rax, qword [rbp + 0x50]
mov r9, rsi
mov qword [rsp + 0x30], rax
mov r8, r14
mov rax, qword [rbp + 0x48]
mov rdx, r15
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140023dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15, rcx
mov edi, 1
call fcn.140021664
mov rbx, rax
test rax, rax
je 0x140023e5a
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x13], 0x79746972
mov rcx, rax
mov dword [rbp - 0x1d], 0x4b746547
mov dword [rbp - 0x17], 0x75636553
mov word [rbp - 0x19], 0x7965
mov word [rbp - 0x20], 0x6552
mov byte [rbp - 0xf], 0
mov byte [rbp - 0x1e], 0x67
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023e51
mov r9, rsi
lea edx, [rdi + 3]
mov r8, r14
mov rcx, r15
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x140023e78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.140021664
mov rdi, rax
test rax, rax
je 0x140023ee8
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x72655365
mov rcx, rax
mov dword [rbp - 0x18], 0x65636976
mov dword [rbp - 0x14], 0x646e6148
mov word [rbp - 0x10], 0x656c
mov dword [rbp - 0x20], 0x736f6c43
mov byte [rbp - 0xe], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023edf
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x140023f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
call fcn.140021664
mov rdi, rax
test rax, rax
je 0x140023f6d
lea rdx, [rbp - 0x10]
mov dword [rbp - 0xa], 0x616e614d
mov rcx, rax
mov dword [rbp - 0xe], 0x43536e65
mov word [rbp - 0x10], 0x704f
mov word [rbp - 3], 0x41
mov word [rbp - 6], 0x6567
mov byte [rbp - 4], 0x72
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023f64
xor edx, edx
lea r8d, [rbx + 1]
xor ecx, ecx
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x140023f80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.140021664
mov rdi, rax
test rax, rax
je 0x140024001
lea rdx, [rbp - 0x10]
mov word [rbp - 0xf], 0x6570
mov rcx, rax
mov word [rbp - 0xc], 0x6553
mov dword [rbp - 9], 0x65636976
mov byte [rbp - 0xa], 0x72
mov word [rbp - 5], 0x41
mov byte [rbp - 0x10], 0x4f
mov byte [rbp - 0xd], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023ff8
mov r8d, 0x60000
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x140024020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov word [rbp - 0xe], 0x7472
mov byte [rbp - 4], bl
mov rdi, rdx
mov dword [rbp - 8], 0x636f6c6c
mov word [rbp - 0xb], 0x6c61
mov word [rbp - 0x10], 0x6956
mov byte [rbp - 9], 0x41
mov byte [rbp - 0xc], 0x75
call fcn.14002157c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140024086
lea r9d, [rbx + 4]
mov r8d, 0x1000
mov rdx, rdi
xor ecx, ecx
call rax
mov rbx, rax
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x14002409c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov word [rbp - 0xd], 0x7574
mov byte [rbp - 2], bl
mov rdi, r8
mov rsi, rdx
mov word [rbp - 0x10], 0x6956
mov r14, rcx
mov dword [rbp - 6], 0x7845636f
mov word [rbp - 0xb], 0x6c61
mov word [rbp - 8], 0x6c6c
mov byte [rbp - 9], 0x41
mov byte [rbp - 0xe], 0x72
call fcn.14002157c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140024122
mov eax, dword [rbp + 0x30]
mov r9d, 0x3000
mov r8, rdi
mov dword [rsp + 0x20], eax
mov rdx, rsi
mov rcx, r14
call r10
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x1400245a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov esi, r9d
mov r14, r8
mov r15, rcx
xor ebx, ebx
call fcn.140021664
mov rdi, rax
test rax, rax
je 0x14002464e
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x72657551
mov rcx, rax
mov dword [rbp - 0xc], 0x69727563
mov dword [rbp - 0x18], 0x65636976
mov dword [rbp - 0x1c], 0x72655379
mov dword [rbp - 0x13], 0x63656a62
mov word [rbp - 7], 0x79
mov word [rbp - 0xf], 0x5374
mov byte [rbp - 0x14], 0x4f
mov byte [rbp - 0xd], 0x65
mov byte [rbp - 8], 0x74
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140024645
mov rax, qword [rbp + 0x40]
lea edx, [rbx + 4]
mov r9d, esi
mov qword [rsp + 0x20], rax
mov r8, r14
mov rcx, r15
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002466c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov esi, r9d
mov r14, rdx
mov edi, 1
call fcn.140021664
mov rbx, rax
test rax, rax
je 0x140024704
lea rdx, [rbp - 0x10]
mov dword [rbp - 6], 0x577845
mov rcx, rax
mov word [rbp - 0xf], 0x6765
mov byte [rbp - 0x10], 0x52
mov word [rbp - 0xc], 0x6570
mov word [rbp - 9], 0x654b
mov byte [rbp - 0xa], 0x6e
mov byte [rbp - 0xd], 0x4f
mov byte [rbp - 7], 0x79
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400246fb
mov rax, qword [rbp + 0x30]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, 0xffffffff80000002
call r10
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140024720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, rdx
mov r15, rcx
mov edi, 1
call fcn.140021664
mov rbx, rax
test rax, rax
je 0x1400247bc
lea rdx, [rbp - 0x20]
mov word [rbp - 0x11], 0x57
mov rcx, rax
mov dword [rbp - 0x16], 0x4565756c
mov dword [rbp - 0x1a], 0x61567972
mov dword [rbp - 0x20], 0x51676552
mov word [rbp - 0x1c], 0x6575
mov byte [rbp - 0x12], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400247b3
mov rax, qword [rbp + 0x48]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rax, qword [rbp + 0x40]
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], rax
call r10
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400247d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rsi, rdx
mov edi, 1
call fcn.140021664
mov rbx, rax
test rax, rax
je 0x140024881
lea rdx, [rbp - 0x10]
mov dword [rbp - 5], 0x41784579
mov rcx, rax
mov dword [rbp - 0xe], 0x65724367
mov word [rbp - 0xa], 0x7461
mov word [rbp - 0x10], 0x6552
mov word [rbp - 7], 0x654b
mov byte [rbp - 1], 0
mov byte [rbp - 8], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140024878
and qword [rsp + 0x40], 0
xor r9d, r9d
mov rax, qword [rbp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rdx, rsi
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000003
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call r10
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14002489c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
mov edi, 1
call fcn.140021664
mov rbx, rax
test rax, rax
je 0x140024912
lea rdx, [rbp - 0x10]
mov word [rbp - 7], 0x7965
mov rcx, rax
mov word [rbp - 0x10], 0x6552
mov word [rbp - 0xd], 0x6c43
mov byte [rbp - 5], 0
mov word [rbp - 0xa], 0x6573
mov byte [rbp - 0xe], 0x67
mov byte [rbp - 0xb], 0x6f
mov byte [rbp - 8], 0x4b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140024909
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret

Function at 0x14002492c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.140021664
mov rdi, rax
test rax, rax
je 0x1400249ba
lea rdx, [rbp - 0x20]
mov dword [rbp - 0xd], 0x416469
mov rcx, rax
mov dword [rbp - 0x1e], 0x7265766e
mov dword [rbp - 0x16], 0x74536f54
mov word [rbp - 0x19], 0x6953
mov word [rbp - 0x12], 0x6972
mov word [rbp - 0xf], 0x5367
mov byte [rbp - 0x1a], 0x74
mov byte [rbp - 0x17], 0x64
mov word [rbp - 0x20], 0x6f43
mov byte [rbp - 0x10], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400249b1
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x140024a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, r8
mov edi, 1
call fcn.140021628
mov rbx, rax
test rax, rax
je 0x140024af8
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1e], 0x51636f73
mov rcx, rax
mov word [rbp - 0x16], 0x7453
mov word [rbp - 0x13], 0x6e69
mov word [rbp - 0x20], 0x7341
mov word [rbp - 0x10], 0x41
mov word [rbp - 0x19], 0x7265
mov byte [rbp - 0x14], 0x72
mov byte [rbp - 0x11], 0x67
mov byte [rbp - 0x1a], 0x75
mov byte [rbp - 0x17], 0x79
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140024aef
mov rax, qword [rbp + 0x38]
lea edx, [rdi + 1]
mov qword [rsp + 0x28], rax
mov r9, rsi
mov rax, qword [rbp + 0x30]
mov r8, r14
xor ecx, ecx
mov qword [rsp + 0x20], rax
call r10
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x140024c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
or ebx, 0xffffffff
mov dword [rbp - 0x18], 0x65766974
mov dword [rbp - 0xc], 0x69737365
mov dword [rbp - 0x12], 0x6c6f736e
mov word [rbp - 8], 0x6e6f
mov word [rbp - 5], 0x64
mov dword [rbp - 0x1d], 0x41746547
mov byte [rbp - 6], 0x49
mov byte [rbp - 0x19], 0x63
mov word [rbp - 0xe], 0x5365
mov word [rbp - 0x1f], 0x5354
mov word [rbp - 0x14], 0x6f43
mov byte [rbp - 0x20], 0x57
call fcn.14002157c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140024c91
call rax
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140024ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
mov dword [rbp - 0x14], 0x6a624f65
or ebx, 0xffffffff
mov dword [rbp - 0x10], 0x746365
mov word [rbp - 0x1f], 0x6961
mov dword [rbp - 0x19], 0x676e6953
mov word [rbp - 0x1c], 0x6f46
mov byte [rbp - 0x1d], 0x74
mov byte [rbp - 0x1a], 0x72
mov byte [rbp - 0x20], 0x57
mov byte [rbp - 0x15], 0x6c
call fcn.14002157c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140024d09
mov edx, ebx
mov rcx, rdi
call rax
mov ebx, eax
mov rdi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140024d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.140021664
mov rdi, rax
test rax, rax
je 0x140024e20
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1a], 0x65537265
mov rcx, rax
mov word [rbp - 0xe], 0x486c
mov dword [rbp - 6], 0x417845
mov dword [rbp - 0x14], 0x43656369
mov word [rbp - 0xb], 0x646e
mov word [rbp - 8], 0x7265
mov word [rbp - 0x16], 0x7672
mov dword [rbp - 0x1f], 0x73696765
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0x1b], 0x74
mov byte [rbp - 0xc], 0x61
mov word [rbp - 0x10], 0x7274
mov byte [rbp - 9], 0x6c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140024e17
xor r8d, r8d
lea rdx, [0x1400156a8]
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x140024e38
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov word [rbp - 0xc], 0x6574
mov word [rbp - 7], 0x746e
mov word [rbp - 0xf], 0x6572
mov word [rbp - 0xa], 0x7645
mov byte [rbp - 0xd], 0x61
mov word [rbp - 5], 0x41
mov byte [rbp - 8], 0x65
mov byte [rbp - 0x10], 0x43
call fcn.14002157c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140024e98
xor r9d, r9d
lea edx, [rbx + 1]
xor r8d, r8d
xor ecx, ecx
call rax
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x140024ea8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
mov dword [rbp - 0x19], 0x6f567473
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x15], 0x656d756c
mov dword [rbp - 0x1e], 0x6946646e
mov word [rbp - 0x20], 0x6946
mov word [rbp - 0x11], 0x57
mov byte [rbp - 0x1a], 0x72
call fcn.14002157c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140024f0a
mov edx, 0x104
mov rcx, rdi
call rax
mov rbx, rax
mov rdi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140024f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp - 0x19], 0x77656956
mov rsi, rcx
mov dword [rbp - 0x1e], 0x616d6e55
mov ebx, 0xc0000022
mov dword [rbp - 0x15], 0x6553664f
mov byte [rbp - 0x1a], 0x70
mov dword [rbp - 0xf], 0x6e6f69
mov word [rbp - 0x20], 0x744e
mov word [rbp - 0x11], 0x7463
call fcn.1400215bc
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140024f8f
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x140024fa8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov dword [rbp - 0xe], 0x65746165
mov byte [rbp - 2], bl
mov rdi, rdx
mov rsi, rcx
mov word [rbp - 6], 0x7365
mov word [rbp - 9], 0x6f72
mov byte [rbp - 0xa], 0x50
mov byte [rbp - 7], 0x63
mov word [rbp - 0x10], 0x7243
mov word [rbp - 4], 0x4173
call fcn.14002157c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140025044
mov rax, qword [rbp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov rax, qword [rbp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x40], rax
mov rcx, rsi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], ebx
call r10
mov ebx, eax
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140025160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov edi, edx
mov word [rbp - 0x10], 0x7243
mov rsi, rcx
mov word [rbp - 0xd], 0x7461
or rbx, 0xffffffffffffffff
mov word [rbp - 0xa], 0x6946
mov word [rbp - 7], 0x4165
mov byte [rbp - 5], 0
mov byte [rbp - 0xe], 0x65
mov byte [rbp - 0xb], 0x65
mov byte [rbp - 8], 0x6c
call fcn.14002157c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400251e7
and qword [rsp + 0x30], 0
xor r9d, r9d
mov eax, dword [rbp + 0x38]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov edx, edi
mov eax, dword [rbp + 0x30]
mov rcx, rsi
mov dword [rsp + 0x20], eax
call r10
mov rbx, rax
mov rsi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret

Function at 0x1400254ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 6], 0x70616548
mov byte [rbp - 2], bl
mov dword [rbp - 0xb], 0x7365636f
mov dword [rbp - 0xf], 0x72507465
mov byte [rbp - 0x10], 0x47
mov byte [rbp - 7], 0x73
call fcn.14002157c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140025537
call rax
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x140025548
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
mov ebx, 1
mov dword [rbp - 0xf], 0x614c7465
mov word [rbp - 9], 0x7245
mov word [rbp - 6], 0x726f
mov word [rbp - 0xb], 0x7473
mov byte [rbp - 7], 0x72
mov byte [rbp - 0x10], 0x47
mov byte [rbp - 4], 0
call fcn.14002157c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002559a
call rax
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x1400255a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov r14, qword [0x14017d4b8]
mov rsi, rdx
xor ebx, ebx
call fcn.140021664
mov rdi, rax
test rax, rax
je 0x14002562d
lea rdx, [rbp - 0x20]
mov word [rbp - 0x18], 0x6563
mov rcx, rax
mov dword [rbp - 0x20], 0x53746553
mov dword [rbp - 0x15], 0x75746174
mov byte [rbp - 0x16], 0x53
mov word [rbp - 0x1b], 0x7672
mov byte [rbp - 0x1c], 0x65
mov word [rbp - 0x11], 0x73
mov byte [rbp - 0x19], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140025624
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret