joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014787
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov eax, dword [0x1400c349c]
test eax, eax
jne 0x140014899
lea rax, str.GC_DISABLE_INCREMENTAL
mov rcx, rax
call sym.getenv
test rax, rax
jne 0x140014899
mov eax, dword [0x1400c34e8]
test eax, eax
je 0x1400147d2
lea rax, [0x1400c34c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov eax, dword [0x1400c3584]
test eax, eax
jne 0x14001487a
call sym.GC_setpagesize
mov eax, dword [0x1400c3554]
test eax, eax
jne 0x14001483a
mov dword [0x1400c3584], 1
mov eax, dword [0x1400c34e8]
test eax, eax
je 0x140014816
lea rax, [0x1400c34c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
call sym.GC_init
mov eax, dword [0x1400c34e8]
test eax, eax
je 0x14001483f
lea rax, [0x1400c34c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
jmp 0x14001483f
call sym.set_incremental_mode_on
mov eax, dword [0x1400c3584]
test eax, eax
je 0x14001487a
mov eax, dword [0x1400c3490]
test eax, eax
jne 0x14001487a
mov rax, qword [0x1400990e8]
test rax, rax
je 0x140014870
lea rax, [sym.GC_never_stop_func]
mov rcx, rax
call sym.GC_try_to_collect_inner
jmp 0x14001487a
mov ecx, 1
call sym.GC_read_dirty
mov eax, dword [0x1400c34e8]
test eax, eax
je 0x1400148a0
lea rax, [0x1400c34c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400148a0
call sym.GC_init
jmp 0x1400148a1
nop
add rsp, 0x20
pop rbp
ret
Function at 0x14001490d
Capabilities:
Query environment variable

Disassembly:
push rbp
sub rsp, 0x180
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xfc], 0
lea rax, [rbp - 0x30]
mov qword [rbp + 0xf0], rax
lea rax, [rbp - 0x30]
mov r8d, 0x105
mov rdx, rax
lea rax, str.GC_LOG_FILE
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call rax
sub eax, 1
cmp eax, 0x103
ja 0x140014968
mov dword [rbp + 0xfc], 1
jmp 0x1400149d1
lea rax, [rbp - 0x30]
mov r8d, 0x105
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
mov dword [rbp + 0xf8], eax
cmp dword [rbp + 0xf8], 4
jle 0x1400149ad
mov eax, dword [rbp + 0xf8]
sub eax, 4
cdqe
movzx eax, byte [rbp + rax - 0x30]
cmp al, 0x2e
jne 0x1400149ad
sub dword [rbp + 0xf8], 4
lea rdx, [rbp - 0x30]
mov eax, dword [rbp + 0xf8]
cdqe
add rax, rdx
mov r8d, 8
lea rdx, str..gc.log
mov rcx, rax
call sym.memcpy
mov eax, dword [0x1400c3578]
cmp eax, 2
jne 0x1400149e3
mov ecx, pe_nt_image_headers64
jmp 0x1400149e8
mov ecx, 0x80000080
cmp dword [rbp + 0xfc], 0
je 0x1400149f8
mov edx, 4
jmp 0x1400149fd
mov edx, 2
mov rax, qword [rbp + 0xf0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov r9d, 0
mov r8d, 1
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0xe8], rax
cmp dword [rbp + 0xfc], 0
je 0x140014a78
cmp qword [rbp + 0xe8], 0xffffffffffffffff
je 0x140014a78
mov dword [rbp - 0x34], 0
lea rdx, [rbp - 0x34]
mov rax, qword [rbp + 0xe8]
mov r9d, 2
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFilePointer]
call rax
mov rax, qword [rbp + 0xe8]
add rsp, 0x180
pop rbp
ret

Function at 0x140014a88
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x18], 0
jne 0x140014aa9
mov eax, 0
jmp 0x140014b6d
mov eax, dword [0x1400c34e8]
test eax, eax
je 0x140014ac6
lea rax, [0x1400c35c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400c3ff0]
test rax, rax
jne 0x140014ade
call sym.GC_CreateLogFile
mov qword [0x1400c3ff0], rax
mov rax, qword [0x1400c3ff0]
cmp rax, 0xffffffffffffffff
jne 0x140014b0f
mov eax, dword [0x1400c34e8]
test eax, eax
je 0x140014b08
lea rax, [0x1400c35c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
mov eax, 0xffffffff
jmp 0x140014b6d
mov rax, qword [rbp + 0x18]
mov r8d, eax
mov rax, qword [0x1400c3ff0]
lea rcx, [rbp - 8]
mov rdx, qword [rbp + 0x10]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov dword [rbp - 4], eax
mov eax, dword [0x1400c34e8]
test eax, eax
je 0x140014b5d
lea rax, [0x1400c35c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
cmp dword [rbp - 4], 0
je 0x140014b68
mov eax, dword [rbp - 8]
jmp 0x140014b6d
mov eax, 0xffffffff
add rsp, 0x40
pop rbp
ret
Function at 0x140014ee8
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov dword [0x1400c3fe8], 1
cmp qword [rbp + 0x10], 0
je 0x140014f51
mov rax, qword [rbp + 0x10]
mov r8d, 0x10
lea rdx, str.Fatal_error_in_GC
mov rcx, rax
call sym.GC_win32_MessageBoxA
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.strlen
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.GC_write
test eax, eax
js 0x140014f51
mov edx, 1
lea rax, [0x140087a08]
mov rcx, rax
call sym.GC_write
lea rax, str.GC_LOOP_ON_ABORT
mov rcx, rax
call sym.getenv
test rax, rax
je 0x140014f67
jmp 0x140014f65
nop
add rsp, 0x20
pop rbp
ret

Function at 0x140015cc4
Capabilities:
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rax, [0x1400c3500]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [0x1400c3504]
mov eax, eax
mov qword [0x1400c34f0], rax
nop
add rsp, 0x20
pop rbp
ret

Function at 0x140017ac4
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbp
sub rsp, 0x500
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x490], rcx
mov dword [rbp + 0x47c], 0
mov rax, qword [rbp + 0x490]
mov rax, qword [rax + 0x18]
lea rdx, [rbp + 0x478]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
call rax
test eax, eax
je 0x140017b28
mov eax, dword [rbp + 0x478]
cmp eax, 0x103
je 0x140017b28
mov rax, qword [rbp + 0x490]
mov rcx, rax
call sym.GC_delete_thread
jmp 0x140017c64
mov rax, qword [rbp + 0x490]
mov rax, qword [rax + 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SuspendThread]
call rax
cmp eax, 0xffffffff
je 0x140017bf7
mov dword [rbp - 0x30], 0x10000b
mov rax, qword [rbp + 0x490]
mov rax, qword [rax + 0x18]
lea rdx, [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadContext]
call rax
test eax, eax
je 0x140017bbf
mov rax, qword [rbp + 0x490]
lea rcx, [rax + 0x30]
lea rax, [rbp - 0x60]
mov rdx, rax
call sym.copy_ptr_regs
mov rdx, qword [rbp + 0x490]
mov qword [rdx + 0x28], rax
mov rax, qword [rbp + 0x490]
movzx eax, byte [rax + 0x20]
or eax, 0x40
mov edx, eax
mov rax, qword [rbp + 0x490]
mov byte [rax + 0x20], dl
mov rax, qword [0x1400c8820]
test rax, rax
jne 0x140017c46
jmp 0x140017c64
mov rax, qword [rbp + 0x490]
mov rax, qword [rax + 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
cmp eax, 0xffffffff
jne 0x140017bf7
mov rax, qword [sym.GC_default_on_abort]
lea rdx, str.ResumeThread_failed_in_suspend_loop
mov rcx, rdx
call rax
mov rax, qword [sym.imp.KERNEL32.dll_DebugBreak]
call rax
cmp dword [rbp + 0x47c], 1
jle 0x140017c0e
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
add dword [rbp + 0x47c], 1
cmp dword [rbp + 0x47c], 0xf423f
jle 0x140017ae5
mov rax, qword [sym.GC_default_on_abort]
lea rdx, str.SuspendThread_loop_failed
mov rcx, rdx
call rax
mov rax, qword [sym.imp.KERNEL32.dll_DebugBreak]
call rax
jmp 0x140017ae5
mov r8, qword [0x1400c8820]
mov rax, qword [rbp + 0x490]
mov rax, qword [rax + 0x18]
mov rdx, rax
mov ecx, 0xa
call r8
nop
add rsp, 0x500
pop rbp
ret
Function at 0x140017d2e
Capabilities:
Resume thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 0xc], 0
jmp 0x140017dfe
mov eax, dword [rbp - 0xc]
cdqe
lea rdx, [rax*8]
lea rax, [0x1400c8020]
mov rax, qword [rdx + rax]
mov qword [rbp - 8], rax
jmp 0x140017def
mov rax, qword [rbp - 8]
movzx eax, byte [rax + 0x20]
movzx eax, al
and eax, 0x40
test eax, eax
je 0x140017de4
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
cmp eax, 0xffffffff
jne 0x140017daa
mov rax, qword [sym.GC_default_on_abort]
lea rdx, str.ResumeThread_failed
mov rcx, rdx
call rax
mov rax, qword [sym.imp.KERNEL32.dll_DebugBreak]
call rax
mov rax, qword [rbp - 8]
movzx eax, byte [rax + 0x20]
and eax, 0xffffffbf
mov edx, eax
mov rax, qword [rbp - 8]
mov byte [rax + 0x20], dl
mov rax, qword [0x1400c8820]
test rax, rax
je 0x140017de4
mov r8, qword [0x1400c8820]
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x18]
mov rdx, rax
mov ecx, 0xb
call r8
mov rax, qword [rbp - 8]
mov rax, qword [rax]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140017d63
add dword [rbp - 0xc], 1
cmp dword [rbp - 0xc], 0xff
jle 0x140017d42
nop
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140018d89
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov eax, dword [0x1400c3554]
test eax, eax
jne 0x140018db0
call sym.GC_init
mov ecx, 0x10
call sym.GC_malloc_uncollectable
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
sete al
movzx eax, al
test eax, eax
je 0x140018de5
mov ecx, 8
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
call rax
mov eax, 0
jmp 0x140018e71
mov rax, qword [rbp - 8]
mov rdx, qword [rbp + 0x20]
mov qword [rax], rdx
mov rax, qword [rbp - 8]
mov rdx, qword [rbp + 0x28]
mov qword [rax + 8], rdx
mov eax, dword [0x1400c3580]
test eax, eax
je 0x140018e12
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.GC_dirty_inner
mov dword [0x1400c34e8], 1
mov r8, qword [rbp - 8]
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x30]
mov dword [rsp + 0x20], ecx
mov r9, r8
lea r8, [sym.GC_win32_start]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
sete al
movzx eax, al
test eax, eax
je 0x140018e6d
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.GC_free
mov rax, qword [rbp - 0x10]
add rsp, 0x40
pop rbp
ret
Function at 0x140018e96
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov eax, dword [0x1400c3554]
test eax, eax
jne 0x140018ebc
call sym.GC_init
mov ecx, 0x10
call sym.GC_malloc_uncollectable
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
sete al
movzx eax, al
test eax, eax
je 0x140018ef2
mov rax, qword [sym.imp.msvcrt.dll__errno]
call rax
mov dword [rax], 0xb
mov eax, 0
jmp 0x140018f7d
mov rax, qword [rbp - 8]
mov rdx, qword [rbp + 0x20]
mov qword [rax], rdx
mov rax, qword [rbp - 8]
mov rdx, qword [rbp + 0x28]
mov qword [rax + 8], rdx
mov eax, dword [0x1400c3580]
test eax, eax
je 0x140018f1f
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.GC_dirty_inner
mov dword [0x1400c34e8], 1
mov r8, qword [rbp - 8]
mov edx, dword [rbp + 0x18]
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp + 0x30]
mov dword [rsp + 0x20], ecx
mov r9, r8
lea r8, [sym.GC_win32_start]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__beginthreadex]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
sete al
movzx eax, al
test eax, eax
je 0x140018f79
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.GC_free
mov rax, qword [rbp - 0x10]
add rsp, 0x40
pop rbp
ret
Function at 0x140049091
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xb0]
mov qword [rbp + 0x20], rcx
mov rbx, rdx
mov byte [rbp - 1], 0
mov byte [rbp - 0x50], 0x30
mov byte [rbp - 0x4f], 0x30
mov byte [rbp - 0x4e], 0x30
mov byte [rbp - 0x4d], 0x30
mov byte [rbp - 0x4c], 0x2d
mov byte [rbp - 0x4b], 0x30
mov byte [rbp - 0x4a], 0x30
mov byte [rbp - 0x49], 0x2d
mov byte [rbp - 0x48], 0x30
mov byte [rbp - 0x47], 0x30
mov byte [rbp - 0x46], 0x20
mov byte [rbp - 0x45], 0x30
mov byte [rbp - 0x44], 0x30
mov byte [rbp - 0x43], 0x3a
mov byte [rbp - 0x42], 0x30
mov byte [rbp - 0x41], 0x30
mov byte [rbp - 0x40], 0x3a
mov byte [rbp - 0x3f], 0x30
mov byte [rbp - 0x3e], 0x30
lea rax, [rbp - 0x80]
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0x13
mov edx, 0x13
mov rcx, rax
call sym.new_array_from_c_array_noscan
mov rax, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov byte [rbp - 1], 1
mov eax, dword [rbx + 8]
lea rdx, [rbp - 0x30]
mov r8d, 4
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0xc]
lea rdx, [rbp - 0x30]
mov r8d, 7
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x10]
lea rdx, [rbp - 0x30]
mov r8d, 0xa
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x14]
lea rdx, [rbp - 0x30]
mov r8d, 0xd
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x18]
lea rdx, [rbp - 0x30]
mov r8d, 0x10
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x1c]
lea rdx, [rbp - 0x30]
mov r8d, 0x13
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
lea rcx, [rbp - 0x60]
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdx
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
lea rax, [rbp - 0x80]
mov rdx, rax
call sym.Array_u8_bytestr
cmp byte [rbp - 1], 0
je 0x1400491fd
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.array_free
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov rax, qword [rbp + 0x20]
add rsp, 0xb8
pop rbx
pop rbp
ret
Function at 0x14004921e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xb0]
mov qword [rbp + 0x20], rcx
mov rbx, rdx
mov byte [rbp - 1], 0
mov byte [rbp - 0x50], 0x30
mov byte [rbp - 0x4f], 0x30
mov byte [rbp - 0x4e], 0x30
mov byte [rbp - 0x4d], 0x30
mov byte [rbp - 0x4c], 0x2d
mov byte [rbp - 0x4b], 0x30
mov byte [rbp - 0x4a], 0x30
mov byte [rbp - 0x49], 0x2d
mov byte [rbp - 0x48], 0x30
mov byte [rbp - 0x47], 0x30
mov byte [rbp - 0x46], 0x20
mov byte [rbp - 0x45], 0x30
mov byte [rbp - 0x44], 0x30
mov byte [rbp - 0x43], 0x3a
mov byte [rbp - 0x42], 0x30
mov byte [rbp - 0x41], 0x30
mov byte [rbp - 0x40], 0x3a
mov byte [rbp - 0x3f], 0x30
mov byte [rbp - 0x3e], 0x30
mov byte [rbp - 0x3d], 0x2e
mov byte [rbp - 0x3c], 0x30
mov byte [rbp - 0x3b], 0x30
mov byte [rbp - 0x3a], 0x30
lea rax, [rbp - 0x80]
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0x17
mov edx, 0x17
mov rcx, rax
call sym.new_array_from_c_array_noscan
mov rax, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov byte [rbp - 1], 1
mov eax, dword [rbx + 8]
lea rdx, [rbp - 0x30]
mov r8d, 4
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0xc]
lea rdx, [rbp - 0x30]
mov r8d, 7
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x10]
lea rdx, [rbp - 0x30]
mov r8d, 0xa
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x14]
lea rdx, [rbp - 0x30]
mov r8d, 0xd
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x18]
lea rdx, [rbp - 0x30]
mov r8d, 0x10
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x1c]
lea rdx, [rbp - 0x30]
mov r8d, 0x13
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x20]
movsxd rdx, eax
imul rdx, rdx, 0x431bde83
shr rdx, 0x20
mov ecx, edx
sar ecx, 0x12
cdq
mov eax, ecx
sub eax, edx
mov dword [rbp - 8], eax
lea rdx, [rbp - 0x30]
mov eax, dword [rbp - 8]
mov r8d, 0x17
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
lea rcx, [rbp - 0x60]
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdx
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
lea rax, [rbp - 0x80]
mov rdx, rax
call sym.Array_u8_bytestr
cmp byte [rbp - 1], 0
je 0x1400493cc
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.array_free
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov rax, qword [rbp + 0x20]
add rsp, 0xb8
pop rbx
pop rbp
ret
Function at 0x1400493ed
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xb0]
mov qword [rbp + 0x20], rcx
mov rbx, rdx
mov byte [rbp - 1], 0
mov byte [rbp - 0x50], 0x30
mov byte [rbp - 0x4f], 0x30
mov byte [rbp - 0x4e], 0x30
mov byte [rbp - 0x4d], 0x30
mov byte [rbp - 0x4c], 0x2d
mov byte [rbp - 0x4b], 0x30
mov byte [rbp - 0x4a], 0x30
mov byte [rbp - 0x49], 0x2d
mov byte [rbp - 0x48], 0x30
mov byte [rbp - 0x47], 0x30
mov byte [rbp - 0x46], 0x20
mov byte [rbp - 0x45], 0x30
mov byte [rbp - 0x44], 0x30
mov byte [rbp - 0x43], 0x3a
mov byte [rbp - 0x42], 0x30
mov byte [rbp - 0x41], 0x30
mov byte [rbp - 0x40], 0x3a
mov byte [rbp - 0x3f], 0x30
mov byte [rbp - 0x3e], 0x30
mov byte [rbp - 0x3d], 0x2e
mov byte [rbp - 0x3c], 0x30
mov byte [rbp - 0x3b], 0x30
mov byte [rbp - 0x3a], 0x30
mov byte [rbp - 0x39], 0x30
mov byte [rbp - 0x38], 0x30
mov byte [rbp - 0x37], 0x30
lea rax, [rbp - 0x80]
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0x1a
mov edx, 0x1a
mov rcx, rax
call sym.new_array_from_c_array_noscan
mov rax, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov byte [rbp - 1], 1
mov eax, dword [rbx + 8]
lea rdx, [rbp - 0x30]
mov r8d, 4
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0xc]
lea rdx, [rbp - 0x30]
mov r8d, 7
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x10]
lea rdx, [rbp - 0x30]
mov r8d, 0xa
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x14]
lea rdx, [rbp - 0x30]
mov r8d, 0xd
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x18]
lea rdx, [rbp - 0x30]
mov r8d, 0x10
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x1c]
lea rdx, [rbp - 0x30]
mov r8d, 0x13
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x20]
movsxd rdx, eax
imul rdx, rdx, 0x10624dd3
shr rdx, 0x20
mov ecx, edx
sar ecx, 6
cdq
mov eax, ecx
sub eax, edx
mov dword [rbp - 8], eax
lea rdx, [rbp - 0x30]
mov eax, dword [rbp - 8]
mov r8d, 0x1a
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
lea rcx, [rbp - 0x60]
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdx
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
lea rax, [rbp - 0x80]
mov rdx, rax
call sym.Array_u8_bytestr
cmp byte [rbp - 1], 0
je 0x1400495a7
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.array_free
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov rax, qword [rbp + 0x20]
add rsp, 0xb8
pop rbx
pop rbp
ret
Function at 0x1400495c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xb0]
mov qword [rbp + 0x20], rcx
mov rbx, rdx
mov byte [rbp - 1], 0
mov byte [rbp - 0x50], 0x30
mov byte [rbp - 0x4f], 0x30
mov byte [rbp - 0x4e], 0x30
mov byte [rbp - 0x4d], 0x30
mov byte [rbp - 0x4c], 0x2d
mov byte [rbp - 0x4b], 0x30
mov byte [rbp - 0x4a], 0x30
mov byte [rbp - 0x49], 0x2d
mov byte [rbp - 0x48], 0x30
mov byte [rbp - 0x47], 0x30
mov byte [rbp - 0x46], 0x20
mov byte [rbp - 0x45], 0x30
mov byte [rbp - 0x44], 0x30
mov byte [rbp - 0x43], 0x3a
mov byte [rbp - 0x42], 0x30
mov byte [rbp - 0x41], 0x30
mov byte [rbp - 0x40], 0x3a
mov byte [rbp - 0x3f], 0x30
mov byte [rbp - 0x3e], 0x30
mov byte [rbp - 0x3d], 0x2e
mov byte [rbp - 0x3c], 0x30
mov byte [rbp - 0x3b], 0x30
mov byte [rbp - 0x3a], 0x30
mov byte [rbp - 0x39], 0x30
mov byte [rbp - 0x38], 0x30
mov byte [rbp - 0x37], 0x30
mov byte [rbp - 0x36], 0x30
mov byte [rbp - 0x35], 0x30
mov byte [rbp - 0x34], 0x30
lea rax, [rbp - 0x80]
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0x1d
mov edx, 0x1d
mov rcx, rax
call sym.new_array_from_c_array_noscan
mov rax, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov byte [rbp - 1], 1
mov eax, dword [rbx + 8]
lea rdx, [rbp - 0x30]
mov r8d, 4
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0xc]
lea rdx, [rbp - 0x30]
mov r8d, 7
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x10]
lea rdx, [rbp - 0x30]
mov r8d, 0xa
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x14]
lea rdx, [rbp - 0x30]
mov r8d, 0xd
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x18]
lea rdx, [rbp - 0x30]
mov r8d, 0x10
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x1c]
lea rdx, [rbp - 0x30]
mov r8d, 0x13
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
mov eax, dword [rbx + 0x20]
lea rdx, [rbp - 0x30]
mov r8d, 0x1d
mov ecx, eax
call sym.time__int_to_byte_array_no_pad
lea rcx, [rbp - 0x60]
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdx
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
lea rax, [rbp - 0x80]
mov rdx, rax
call sym.Array_u8_bytestr
cmp byte [rbp - 1], 0
je 0x140049770
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.array_free
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov rax, qword [rbp + 0x20]
add rsp, 0xb8
pop rbx
pop rbp
ret