joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022048
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r15, rcx
mov dword [rbp - 0x19], 0x6c6c642e
xor ebx, ebx
mov dword [rbp - 0x20], 0x73726576
lea rcx, [rbp - 0x20]
mov byte [rbp - 0x15], bl
mov rsi, r9
mov word [rbp - 0x1b], 0x6e6f
mov r14, r8
mov byte [rbp - 0x1c], 0x69
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400220fa
lea rdx, [rbp - 0x10]
mov word [rbp - 9], 0x5679
mov rcx, rax
mov word [rbp - 6], 0x756c
mov word [rbp - 0xe], 0x5172
mov word [rbp - 0xb], 0x7265
mov word [rbp - 3], 0x41
mov byte [rbp - 7], 0x61
mov word [rbp - 0x10], 0x6556
mov byte [rbp - 0xc], 0x75
mov byte [rbp - 4], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400220f1
mov r9, rsi
lea rdx, [0x14015ca48]
mov r8, r14
mov rcx, r15
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x140022118
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov r14, rcx
mov word [rbp - 0x20], 0x7052
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x1d], 0x2e347472
mov rsi, rdx
mov dword [rbp - 0x19], 0x6c6c64
mov ebx, 0xe
mov byte [rbp - 0x1e], 0x63
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400221b4
lea rdx, [rbp - 0x10]
mov dword [rbp - 8], 0x676e6972
mov rcx, rax
mov word [rbp - 0x10], 0x7555
mov word [rbp - 0xd], 0x5464
mov word [rbp - 0xa], 0x7453
mov byte [rbp - 0xe], 0x69
mov word [rbp - 4], 0x41
mov byte [rbp - 0xb], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400221ab
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x1400221d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rcx
mov word [rbp - 0x1f], 0x6370
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x19], 0x6c6c64
mov ebx, 0xe
mov word [rbp - 0x1c], 0x3474
mov byte [rbp - 0x1d], 0x72
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0x1a], 0x2e
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140022266
lea rdx, [rbp - 0x10]
mov dword [rbp - 7], 0x65657246
mov rcx, rax
mov dword [rbp - 0xd], 0x69727453
mov word [rbp - 0x10], 0x7052
mov word [rbp - 3], 0x41
mov word [rbp - 9], 0x676e
mov byte [rbp - 0xe], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002225d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x140022280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rsi, rcx
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x140022317
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1e], 0x63696c70
mov rcx, rax
mov word [rbp - 0x20], 0x7544
mov word [rbp - 0x15], 0x656b
mov word [rbp - 0x12], 0x7845
mov byte [rbp - 0x10], bl
mov dword [rbp - 0x19], 0x6f546574
mov byte [rbp - 0x13], 0x6e
mov byte [rbp - 0x1a], 0x61
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14002230e
mov rax, qword [rbp + 0x38]
lea r9d, [rbx + 2]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x2000000
mov dword [rsp + 0x20], 1
mov rcx, rsi
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret

Function at 0x140022330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.140021af8
mov rdi, rax
test rax, rax
je 0x1400223c1
lea rdx, [rbp - 0x20]
mov dword [rbp - 0xf], 0x636f6c42
mov rcx, rax
mov word [rbp - 0x20], 0x7243
mov word [rbp - 0x1d], 0x7461
mov word [rbp - 0x1a], 0x6e45
mov dword [rbp - 0x13], 0x746e656d
mov dword [rbp - 0x17], 0x6e6f7269
mov byte [rbp - 0x18], 0x76
mov byte [rbp - 0x1e], 0x65
mov byte [rbp - 0x1b], 0x65
mov word [rbp - 0xb], 0x6b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400223b8
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x1400223e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rsi, r8
mov r14, rdx
mov r15, rcx
xor ebx, ebx
call fcn.1400219e4
mov rdi, rax
test rax, rax
je 0x1400224ac
lea rdx, [rbp - 0x20]
mov dword [rbp - 0xf], 0x417265
mov rcx, rax
mov dword [rbp - 0x1a], 0x636f7250
mov dword [rbp - 0x20], 0x61657243
mov word [rbp - 0x12], 0x5573
mov word [rbp - 0x15], 0x7373
mov byte [rbp - 0x13], 0x41
mov word [rbp - 0x1c], 0x6574
mov byte [rbp - 0x10], 0x73
mov byte [rbp - 0x16], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400224a3
mov rax, qword [rbp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov r8, rsi
mov rax, qword [rbp + 0x68]
mov rdx, r14
mov qword [rsp + 0x48], rax
mov rcx, r15
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0x50]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400224cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov dword [rbp - 0x10], 0x42746547
mov rsi, rcx
mov dword [rbp - 8], 0x70795479
xor ebx, ebx
mov word [rbp - 3], 0x41
mov dword [rbp - 0xc], 0x72616e69
mov byte [rbp - 4], 0x65
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002252b
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x140022604
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov word [rbp - 0xb], 0x7373
mov rsi, rcx
mov dword [rbp - 0x10], 0x636f7250
xor ebx, ebx
mov word [rbp - 4], 0x74
mov dword [rbp - 9], 0x654e3233
mov byte [rbp - 5], 0x78
mov byte [rbp - 0xc], 0x65
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140022666
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x140022680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov dword [rbp - 8], 0x72694632
mov rsi, rcx
mov dword [rbp - 0xd], 0x73736563
xor ebx, ebx
mov word [rbp - 0xf], 0x6f72
mov word [rbp - 3], 0x74
mov byte [rbp - 4], 0x73
mov byte [rbp - 0x10], 0x50
mov byte [rbp - 9], 0x33
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400226e6
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x140022700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
or rbx, 0xffffffffffffffff
mov word [rbp - 0x14], 0x706c
mov dword [rbp - 0x1e], 0x65746165
mov word [rbp - 0xd], 0x7370
mov dword [rbp - 0x11], 0x616e5332
mov word [rbp - 0xa], 0x746f
mov dword [rbp - 0x18], 0x65686c6f
mov byte [rbp - 0x12], 0x33
mov byte [rbp - 8], 0
mov word [rbp - 0x20], 0x7243
mov word [rbp - 0x1a], 0x6f54
mov byte [rbp - 0xb], 0x68
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140022771
xor edx, edx
lea ecx, [rbx + 3]
call rax
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140022780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
call fcn.1400219a8
mov rdi, rax
test rax, rax
je 0x1400227ee
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x12], 0x41656d
mov rcx, rax
mov dword [rbp - 0x1d], 0x6e694668
mov dword [rbp - 0x16], 0x614e656c
mov word [rbp - 0x20], 0x6150
mov byte [rbp - 0x1e], 0x74
mov word [rbp - 0x19], 0x4664
mov byte [rbp - 0x17], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400227e5
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140022804
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
mov r14, r8
mov r15d, edx
mov r12, rcx
mov edi, 1
call fcn.1400219e4
mov rbx, rax
test rax, rax
je 0x1400228ab
lea rdx, [rbp - 0x10]
mov word [rbp - 4], 0x41
mov rcx, rax
mov dword [rbp - 0xe], 0x756e4567
mov word [rbp - 0x10], 0x6552
mov word [rbp - 0xa], 0x4b6d
mov word [rbp - 7], 0x4579
mov byte [rbp - 5], 0x78
mov byte [rbp - 8], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400228a2
and qword [rsp + 0x38], 0
mov r9, rsi
and qword [rsp + 0x30], 0
mov r8, r14
and qword [rsp + 0x28], 0
mov edx, r15d
and qword [rsp + 0x20], 0
mov rcx, r12
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400228cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
mov dword [rbp - 0x16], 0x41656d69
mov dword [rbp - 0xd], 0x656d6954
mov dword [rbp - 0x1f], 0x79537465
mov dword [rbp - 0x11], 0x656c6946
mov byte [rbp - 9], 0
mov dword [rbp - 0x1b], 0x6d657473
mov byte [rbp - 0x12], 0x73
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x17], 0x54
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002292b
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140022990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rsi, r9
xor ebx, ebx
call fcn.140021970
mov rdi, rax
test rax, rax
je 0x140022a25
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x14], 0x73736553
mov rcx, rax
mov dword [rbp - 0x10], 0x736e6f69
mov word [rbp - 0x18], 0x6172
mov word [rbp - 0x1b], 0x6d75
mov word [rbp - 0x16], 0x6574
mov dword [rbp - 0x20], 0x45535457
mov byte [rbp - 0x19], 0x65
mov word [rbp - 0xc], 0x41
mov byte [rbp - 0x1c], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140022a1c
mov rax, qword [rbp + 0x30]
lea r8d, [rbx + 1]
mov r9, rsi
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x140022a3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, r9
mov dword [rbp - 7], 0x646165
mov rsi, r8
mov dword [rbp - 0x10], 0x61657243
xor ebx, ebx
mov dword [rbp - 0xb], 0x72685465
mov byte [rbp - 0xc], 0x74
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140022aab
mov rax, qword [rbp + 0x38]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov r8, rsi
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call r10
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x140022ac4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
xor ebx, ebx
call fcn.1400219a8
mov rdi, rax
test rax, rax
je 0x140022b31
lea rdx, [rbp - 0x10]
mov dword [rbp - 5], 0x41737473
mov rcx, rax
mov word [rbp - 0x10], 0x6150
mov dword [rbp - 9], 0x69784565
mov dword [rbp - 0xd], 0x6c694668
mov byte [rbp - 1], bl
mov byte [rbp - 0xe], 0x74
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140022b28
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x140022b48
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov dword [rbp - 0xe], 0x63695474
mov word [rbp - 5], 0x74
mov dword [rbp - 0xa], 0x756f436b
mov word [rbp - 0x10], 0x6547
mov byte [rbp - 6], 0x6e
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140022b90
call rax
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x140022cec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov esi, r9d
mov r14, rdx
mov r15, rcx
mov edi, 1
call fcn.1400219e4
mov rbx, rax
test rax, rax
je 0x140022d7e
lea rdx, [rbp - 0x10]
mov dword [rbp - 7], 0x41784579
mov rcx, rax
mov word [rbp - 0xf], 0x6765
mov dword [rbp - 0xc], 0x4b6e6570
mov byte [rbp - 0x10], 0x52
mov byte [rbp - 3], 0
mov byte [rbp - 0xd], 0x4f
mov byte [rbp - 8], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140022d75
mov rax, qword [rbp + 0x40]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, r15
call r10
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x140022d9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
call fcn.1400219a8
mov rbx, rax
test rax, rax
je 0x140022e11
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1a], 0x6f6d
mov rcx, rax
mov dword [rbp - 0x15], 0x6e657478
mov dword [rbp - 0x1f], 0x52687461
mov dword [rbp - 0xf], 0x416e6f
mov byte [rbp - 0x1b], 0x65
mov word [rbp - 0x11], 0x6973
mov word [rbp - 0x17], 0x4565
mov byte [rbp - 0x20], 0x50
mov byte [rbp - 0x18], 0x76
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140022e08
mov rcx, rdi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x140022e24
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rdi, r9
mov dword [rbp - 0x15], 0x6d654d73
mov rsi, r8
mov dword [rbp - 0x1d], 0x72506574
mov r14, rdx
mov word [rbp - 0x18], 0x6563
mov r15, rcx
mov dword [rbp - 0x11], 0x79726f
xor ebx, ebx
mov byte [rbp - 0x19], 0x6f
mov byte [rbp - 0x16], 0x73
mov word [rbp - 0x20], 0x7257
mov byte [rbp - 0x1e], 0x69
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140022ea6
mov r9, rdi
mov qword [rsp + 0x20], rbx
mov r8, rsi
mov rdx, r14
mov rcx, r15
call rax
mov ebx, eax
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140022fb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp - 0x13], 0x747865
mov rsi, rcx
mov dword [rbp - 0x1d], 0x65726854
xor ebx, ebx
mov word [rbp - 0x20], 0x6547
mov dword [rbp - 0x18], 0x6e6f4364
mov byte [rbp - 0x14], 0x74
mov byte [rbp - 0x19], 0x61
mov byte [rbp - 0x1e], 0x74
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023017
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x140023030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, r8
mov dword [rbp - 0xf], 0x4d6e6570
xor ebx, ebx
mov word [rbp - 0xa], 0x6574
mov byte [rbp - 0xb], 0x75
mov byte [rbp - 0x10], 0x4f
mov word [rbp - 7], 0x41
mov byte [rbp - 8], 0x78
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002308c
mov r8, rdi
xor edx, edx
mov ecx, 0x100000
call rax
mov rbx, rax
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret
Function at 0x1400230a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x13], 0x79726f6d
mov byte [rbp - 0xf], bl
mov rdi, r8
mov rsi, rdx
mov dword [rbp - 0x1b], 0x65636f72
mov r14, rcx
mov dword [rbp - 0x1f], 0x50646165
mov dword [rbp - 0x17], 0x654d7373
mov byte [rbp - 0x20], 0x52
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023116
lea r9d, [rbx + 8]
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x140023134
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rsi, r8
mov edi, 0x80004005
call fcn.140021a50
mov rbx, rax
test rax, rax
je 0x1400231bf
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x74654748
mov rcx, rax
mov word [rbp - 0x12], 0x4168
mov dword [rbp - 0x17], 0x61507265
mov dword [rbp - 0x1b], 0x646c6f46
mov byte [rbp - 0x13], 0x74
mov byte [rbp - 0x20], 0x53
mov byte [rbp - 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400231b6
mov rax, qword [rbp + 0x30]
xor r9d, r9d
mov r8, rsi
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1c]
call r10
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x140023244
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp - 0x1f], 0x6f4d7465
xor ebx, ebx
mov dword [rbp - 0x13], 0x656d614e
mov word [rbp - 0xf], 0x41
mov dword [rbp - 0x19], 0x6946656c
mov word [rbp - 0x1b], 0x7564
mov word [rbp - 0x15], 0x656c
mov byte [rbp - 0x20], 0x47
call fcn.1400218fc
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400232ac
mov r8d, 0x104
mov rdx, rdi
xor ecx, ecx
call rax
mov ebx, eax
mov rdi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140023394
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
call fcn.140021a1c
mov rbx, rax
test rax, rax
je 0x1400233ff
lea rdx, [rbp - 0x10]
mov dword [rbp - 7], 0x65657246
mov rcx, rax
mov word [rbp - 0xc], 0x6b73
mov word [rbp - 0xf], 0x546f
mov byte [rbp - 0x10], 0x43
mov byte [rbp - 0xd], 0x61
mov word [rbp - 0xa], 0x654d
mov byte [rbp - 3], 0
mov byte [rbp - 8], 0x6d
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400233f6
mov rcx, rdi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret

Function at 0x1400234e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
xor ebx, ebx
call fcn.140021a50
mov rdi, rax
test rax, rax
je 0x14002356a
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x65705374
mov rcx, rax
mov word [rbp - 0x1f], 0x4748
mov dword [rbp - 0xe], 0x68746150
mov dword [rbp - 0x16], 0x6f466c61
mov word [rbp - 0x18], 0x6963
mov word [rbp - 0xa], 0x57
mov byte [rbp - 0x1d], 0x65
mov byte [rbp - 0x20], 0x53
mov dword [rbp - 0x12], 0x7265646c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023561
xor r9d, r9d
lea r8d, [rbx + 0x25]
mov rdx, rsi
xor ecx, ecx
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x140023584
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
call fcn.140021970
mov rbx, rax
test rax, rax
je 0x1400235e3
lea rdx, [rbp - 0x10]
mov dword [rbp - 7], 0x79726f6d
mov rcx, rax
mov dword [rbp - 0xb], 0x654d6565
mov dword [rbp - 0xf], 0x72465354
mov byte [rbp - 0x10], 0x57
mov byte [rbp - 3], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400235da
mov rcx, rdi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret