joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007f10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, rcx
xor ebx, ebx
call fcn.1400a3820
mov rdi, rax
test rax, rax
je 0x140007f93
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x6f6d6552
mov rcx, rax
mov dword [rsp + 0x29], 0x6c694665
mov dword [rsp + 0x20], 0x68746150
mov dword [rsp + 0x2d], 0x65705365
mov word [rsp + 0x32], 0x41
mov byte [rsp + 0x28], 0x76
mov byte [rsp + 0x31], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007f8b
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140098790
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140007fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov dword [rbp - 0x1b], 0x61726269
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x1f], 0x4c64616f
mov word [rbp - 0x16], 0x4179
mov byte [rbp - 0x20], 0x4c
mov byte [rbp - 0x14], 0
mov byte [rbp - 0x17], 0x72
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000803f
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140008620
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov rbx, rcx
xor eax, eax
nop dword [rax]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x100
jl 0x140008640
xor edi, edi
movzx ebp, r8b
xor dl, dl
lea r14, [rbx + 0xff]
mov ecx, 0xff
lea r15, str.oeuhakxhmagyrlopjaappf
nop word [rax + rax]
xor esi, esi
mov r10d, 1
cmp ecx, r10d
jbe 0x140008690
nop dword [rax]
lea r10d, [r10*2 + 1]
cmp r10d, ecx
jb 0x140008680
nop dword [rax]
movzx edx, dl
lea r9d, [rdi + 1]
movzx edx, byte [rdx + rbx]
add dl, byte [rdi + r15]
movzx r8d, dl
cmp r9d, ebp
lea eax, [r8 + rbp]
movzx edx, al
cmovb edx, r8d
xor edi, edi
cmp r9d, ebp
movzx r11d, dl
mov eax, r11d
cmovb edi, r9d
and eax, r10d
inc esi
cmp esi, 0xb
jbe 0x1400086d1
xor edx, edx
div ecx
mov eax, edx
movzx edx, r11b
cmp eax, ecx
ja 0x140008690
movzx r8d, byte [r14]
movzx edx, al
movzx eax, byte [rdx + rbx]
mov byte [r14], al
dec r14
mov byte [rdx + rbx], r8b
movzx edx, r11b
sub ecx, 1
jne 0x140008670
movzx eax, byte [rbx + 1]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov byte [rbx + 0x100], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x101], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 0x102], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0x103], al
mov rax, rbx
movzx ecx, byte [r11 + rbx]
mov byte [rbx + 0x104], cl
mov rbx, qword [rsp + 0x18]
pop r15
pop r14
ret
Function at 0x140013430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, qword [rsp + 0x90]
mov ebp, r9d
mov rsi, rdx
mov ebx, 1
call fcn.1400a38f0
mov rdi, rax
test rax, rax
je 0x1400134cd
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x4f676552
mov rcx, rax
mov word [rsp + 0x34], 0x6570
mov dword [rsp + 0x37], 0x4579654b
mov word [rsp + 0x3c], 0x57
mov byte [rsp + 0x36], 0x6e
mov byte [rsp + 0x3b], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400134c5
mov r9d, ebp
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140098790
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x1400135c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x38], 0x6c6c64
mov dword [rbp - 0x40], 0x73726556
mov word [rbp - 0x3b], 0x6e6f
mov byte [rbp - 0x3c], 0x69
mov byte [rbp - 0x39], 0x2e
mov dword [rbp - 0x1b], 0x61726269
mov dword [rbp - 0x1f], 0x4c64616f
mov word [rbp - 0x16], 0x4179
mov byte [rbp - 0x20], 0x4c
mov byte [rbp - 0x14], 0
mov byte [rbp - 0x17], 0x72
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013667
lea rcx, [rbp - 0x40]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x60
pop rbp
ret
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x60
pop rbp
ret

Function at 0x140013800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov word [rbp - 0x1a], 0x7261
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x17], 0x65707954
mov rdi, rdx
mov word [rbp - 0x13], 0x41
mov word [rbp - 0x1d], 0x6942
mov word [rbp - 0x20], 0x6547
mov byte [rbp - 0x1b], 0x6e
mov byte [rbp - 0x1e], 0x74
mov byte [rbp - 0x18], 0x79
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013895
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x1400138c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.1400135c0
mov rdi, rax
test rax, rax
je 0x140013954
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x6e6f6973
mov rcx, rax
mov word [rbp - 0xa], 0x41
mov dword [rbp - 0x1f], 0x69467465
mov dword [rbp - 0x1a], 0x72655665
mov dword [rbp - 0xf], 0x7a69536f
mov word [rbp - 0x11], 0x666e
mov byte [rbp - 0x12], 0x49
mov byte [rbp - 0x1b], 0x6c
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0xb], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001394c
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140098790
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret

Function at 0x140013980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, r8
mov ebp, edx
mov rsi, rcx
xor ebx, ebx
call fcn.1400a38f0
mov rdi, rax
test rax, rax
je 0x140013a0b
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2c], 0x6e656b6f
mov rcx, rax
mov word [rsp + 0x24], 0x7250
mov word [rsp + 0x27], 0x6563
mov dword [rsp + 0x20], 0x6e65704f
mov word [rsp + 0x2a], 0x5473
mov byte [rsp + 0x26], 0x6f
mov byte [rsp + 0x30], bl
mov byte [rsp + 0x29], 0x73
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013a03
mov r8, r14
mov edx, ebp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140098790
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140013b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov word [rbp - 0x28], 0x65
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x2f], 0x6c61636f
mov word [rbp - 0x2b], 0x7246
mov byte [rbp - 0x30], 0x4c
mov byte [rbp - 0x29], 0x65
mov word [rbp - 0x1f], 0x7265
mov dword [rbp - 0x17], 0x6c6c64
mov dword [rbp - 0x1c], 0x32336c65
mov byte [rbp - 0x1d], 0x6e
mov byte [rbp - 0x20], 0x4b
mov byte [rbp - 0x18], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013b7c
mov rcx, rbx
call rax
jmp 0x140013b7f
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140013ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
mov word [rbp - 0x13], 0x70
mov dword [rbp - 0x1c], 0x65636f72
mov dword [rbp - 0x18], 0x65487373
mov dword [rbp - 0x20], 0x50746547
mov byte [rbp - 0x14], 0x61
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013c26
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x50
pop rbp
ret
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x50
pop rbp
ret

Function at 0x140013c40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
xor ebx, ebx
call fcn.1400a38f0
mov rdi, rax
test rax, rax
je 0x140013ce2
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x74696e49
mov rcx, rax
mov word [rbp - 0x16], 0x726f
mov dword [rbp - 0x20], 0x65447974
mov dword [rbp - 0x2c], 0x696c6169
mov dword [rbp - 0x24], 0x69727563
mov word [rbp - 0x27], 0x5365
mov word [rbp - 0x19], 0x7069
mov byte [rbp - 0x17], 0x74
mov byte [rbp - 0x14], bl
mov word [rbp - 0x1c], 0x6373
mov byte [rbp - 0x28], 0x7a
mov byte [rbp - 0x1a], 0x72
mov byte [rbp - 0x25], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013cda
lea edx, [rbx + 1]
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140098790
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x140013d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, r8
mov rsi, rcx
xor ebx, ebx
call fcn.1400a38f0
mov rdi, rax
test rax, rax
je 0x140013db0
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x24], 0x72637365
mov rcx, rax
mov dword [rbp - 0x2b], 0x69727563
mov dword [rbp - 0x30], 0x53746553
mov dword [rbp - 0x1a], 0x6c6361
mov word [rbp - 0x1f], 0x7470
mov word [rbp - 0x1c], 0x4472
mov word [rbp - 0x26], 0x4479
mov byte [rbp - 0x2c], 0x65
mov byte [rbp - 0x20], 0x69
mov byte [rbp - 0x27], 0x74
mov byte [rbp - 0x1d], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013da8
xor r9d, r9d
lea edx, [rbx + 1]
mov r8, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140098790
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
Function at 0x140013de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ebx, ebx
call fcn.1400a38f0
mov rdi, rax
test rax, rax
je 0x140013e53
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x614d4353
mov rcx, rax
mov dword [rsp + 0x28], 0x6567616e
mov word [rsp + 0x2c], 0x4172
mov dword [rsp + 0x20], 0x6e65704f
mov byte [rsp + 0x2e], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013e4b
xor edx, edx
lea r8d, [rbx + 1]
xor ecx, ecx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.140098790
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140013e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov word [rbp - 0x29], 0x65
lea rcx, [rbp - 0x20]
mov word [rbp - 0x2f], 0x6165
mov r14, r9
mov word [rbp - 0x2c], 0x6946
mov esi, r8d
mov byte [rbp - 0x2a], 0x6c
mov rdi, rdx
mov byte [rbp - 0x30], 0x52
mov byte [rbp - 0x2d], 0x64
mov word [rbp - 0x1f], 0x7265
mov dword [rbp - 0x17], 0x6c6c64
mov dword [rbp - 0x1c], 0x32336c65
mov byte [rbp - 0x1d], 0x6e
mov byte [rbp - 0x20], 0x4b
mov byte [rbp - 0x18], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013f19
mov r9, r14
mov qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140013f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov word [rbp - 0x1f], 0x6c6c
xor ebx, ebx
mov dword [rbp - 0x28], 0x72657355
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x1d], bl
mov byte [rbp - 0xc], bl
mov r14, rdx
mov dword [rbp - 0x24], 0x2e766e65
mov byte [rbp - 0x20], 0x64
mov dword [rbp - 0x13], 0x61726269
mov dword [rbp - 0x17], 0x4c64616f
mov word [rbp - 0xe], 0x4179
mov byte [rbp - 0x18], 0x4c
mov byte [rbp - 0xf], 0x72
mov word [rbp - 0x3f], 0x7265
mov dword [rbp - 0x37], 0x6c6c64
mov dword [rbp - 0x3c], 0x32336c65
mov byte [rbp - 0x3d], 0x6e
mov byte [rbp - 0x40], 0x4b
mov byte [rbp - 0x38], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001407c
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x90], rdi
call rax
mov rdi, rax
test rax, rax
je 0x140014055
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x3e], 0x65746165
mov rcx, rax
mov dword [rbp - 0x30], 0x6f6c4274
mov word [rbp - 0x35], 0x6e6f
mov word [rbp - 0x32], 0x6e65
mov word [rbp - 0x2c], 0x6b63
mov byte [rbp - 0x33], 0x6d
mov dword [rbp - 0x39], 0x7269766e
mov word [rbp - 0x40], 0x7243
mov byte [rbp - 0x3a], 0x45
mov byte [rbp - 0x2a], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001404d
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140098790
mov rdi, qword [rsp + 0x90]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
mov eax, ebx
jmp 0x14001405f

Function at 0x140014090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov dword [rbp - 0x1e], 0x72685474
lea rcx, [rbp - 0x30]
mov word [rbp - 0x20], 0x6547
mov rdi, rdx
mov dword [rbp - 0x17], 0x746e6f43
mov dword [rbp - 0x13], 0x747865
mov word [rbp - 0x19], 0x6461
mov byte [rbp - 0x1a], 0x65
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001411f
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x140014150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14d, dword [rbp + 0x50]
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x1f], 0x75747269
mov rsi, r8
mov dword [rbp - 0x19], 0x6f6c6c41
mov rdi, rdx
mov dword [rbp - 0x15], 0x784563
mov byte [rbp - 0x20], 0x56
mov word [rbp - 0x1b], 0x6c61
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400141ea
mov r9d, 0x3000
mov dword [rsp + 0x20], r14d
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140014210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov dword [rbp - 0x1a], 0x50657461
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x13], 0x737365
mov dword [rbp - 0x20], 0x6d726554
mov word [rbp - 0x1c], 0x6e69
mov word [rbp - 0x15], 0x636f
mov byte [rbp - 0x16], 0x72
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014296
xor edx, edx
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140017880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], rbx
mov r14d, 1
mov qword [rbp - 0x38], 0
cmp qword [rdx + 0x18], 0x10
jb 0x1400178ce
mov rdx, qword [rdx]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov r9d, 0x20219
call fcn.1400079e0
test eax, eax
jne 0x1400179c7
mov dword [rbp - 0x3c], r14d
mov dword [rbp - 0x40], 0x800
mov edx, 0x800
mov rcx, rsi
call fcn.14001ca60
mov qword [rbp - 0x30], rax
mov r12, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14001791a
mov r12, qword [rbx]
mov r13, qword [rbp - 0x38]
call fcn.1400a3820
mov r15, rax
test rax, rax
je 0x140017995
mov word [rbp - 0x15], 0x7465
mov word [rbp - 0x12], 0x6c61
mov word [rbp - 0xf], 0x4165
mov word [rbp - 0x17], 0x4748
mov byte [rbp - 0xd], 0
mov byte [rbp - 0x13], 0x56
mov byte [rbp - 0x18], 0x53
mov byte [rbp - 0x10], 0x75
lea rdx, [rbp - 0x18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001798d
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x3c]
mov r8, r12
lea rdx, [0x1400ba5a0]
mov rcx, r13
call rax
mov r14d, eax
mov rcx, r15
call fcn.140098790
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1400179a2
mov rcx, qword [rsi]
test rcx, rcx
jne 0x1400179ab
xor eax, eax
jmp 0x1400179b0
call fcn.140067b40
movsxd rdx, eax
xor r8d, r8d
mov rcx, rsi
call fcn.14001cd30
mov rcx, qword [rbp - 0x38]
call fcn.1400a3d20
test r14d, r14d
sete sil
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140017a08
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140017a03
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140017a8c
mov rcx, r8
call fcn.14006126c
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140017a51
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140017a4c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140017a92
mov rcx, r8
call fcn.14006126c
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
movzx eax, sil
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140067948
nop
call fcn.140067948
int3
Function at 0x140018810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x3b], 0x6c6c642e
mov dword [rbp - 0x40], 0x33656c4f
mov byte [rbp - 0x37], 0
mov byte [rbp - 0x3c], 0x32
mov dword [rbp - 0x1b], 0x61726269
mov dword [rbp - 0x1f], 0x4c64616f
mov word [rbp - 0x16], 0x4179
mov byte [rbp - 0x20], 0x4c
mov byte [rbp - 0x14], 0
mov byte [rbp - 0x17], 0x72
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400188b1
lea rcx, [rbp - 0x40]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x60
pop rbp
ret
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x60
pop rbp
ret

Function at 0x140018990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov esi, ecx
mov dword [rbp - 0x18], 0x61737457
xor ebx, ebx
mov dword [rbp - 0x13], 0x2e323369
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x1c], bl
mov r14, rdx
mov dword [rbp - 0xf], 0x6c6c64
mov byte [rbp - 0x14], 0x70
mov dword [rbp - 0x23], 0x61726269
mov dword [rbp - 0x27], 0x4c64616f
mov word [rbp - 0x1e], 0x4179
mov byte [rbp - 0x28], 0x4c
mov byte [rbp - 0x1f], 0x72
mov word [rbp - 0x3f], 0x7265
mov dword [rbp - 0x37], 0x6c6c64
mov dword [rbp - 0x3c], 0x32336c65
mov byte [rbp - 0x3d], 0x6e
mov byte [rbp - 0x40], 0x4b
mov byte [rbp - 0x38], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140018aaf
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x90], rdi
call rax
mov rdi, rax
test rax, rax
je 0x140018a88
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x40], 0x51535457
mov rcx, rax
mov dword [rbp - 0x38], 0x72657355
mov dword [rbp - 0x3c], 0x79726575
mov dword [rbp - 0x34], 0x656b6f54
mov word [rbp - 0x30], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140018a80
mov rdx, r14
mov ecx, esi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.140098790
mov rdi, qword [rsp + 0x90]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
mov eax, ebx
jmp 0x140018a92