joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400445f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140072010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x28], 0x4a
mov byte [rsp + 0x30], 0xda
mov byte [rsp + 0x31], 0xcb
mov byte [rsp + 0x32], 0xcb
mov byte [rsp + 0x33], 0xa
mov byte [rsp + 0x34], 0xa
mov byte [rsp + 0x35], 0xa
mov byte [rsp + 0x36], 0x27
mov byte [rsp + 0x37], 0xcb
mov byte [rsp + 0x38], 0xcb
mov byte [rsp + 0x39], 0xcb
mov byte [rsp + 0x3a], 0xcb
mov byte [rsp + 0x3b], 0xcb
mov byte [rsp + 0x3c], 0x27
mov byte [rsp + 0x3d], 0xcb
mov byte [rsp + 0x3e], 0x27
mov byte [rsp + 0x3f], 0xcb
mov byte [rsp + 0x40], 0xcb
mov byte [rsp + 0x41], 0xcb
mov byte [rsp + 0x42], 0xcb
mov byte [rsp + 0x43], 0xcb
mov byte [rsp + 0x44], 0xcb
mov byte [rsp + 0x45], 0xcb
mov byte [rsp + 0x46], 0xcb
mov byte [rsp + 0x47], 0xcb
mov byte [rsp + 0x48], 0xcb
mov byte [rsp + 0x49], 0xcb
mov byte [rsp + 0x4a], 0xcb
mov byte [rsp + 0x4b], 0xcb
mov byte [rsp + 0x4c], 0xcb
mov byte [rsp + 0x4d], 0xcb
mov byte [rsp + 0x4e], 0xcb
mov byte [rsp + 0x4f], 0xcb
mov byte [rsp + 0x50], 0xcb
mov byte [rsp + 0x51], 0xcb
mov byte [rsp + 0x52], 0xcb
mov byte [rsp + 0x53], 0xcb
mov byte [rsp + 0x54], 0xcb
mov byte [rsp + 0x55], 0x27
mov byte [rsp + 0x56], 0xcb
mov byte [rsp + 0x57], 0x27
mov byte [rsp + 0x58], 0xcb
mov byte [rsp + 0x59], 0xcb
mov byte [rsp + 0x5a], 0xcb
mov byte [rsp + 0x5b], 0xcb
mov byte [rsp + 0x5c], 0xcb
mov byte [rsp + 0x5d], 0xcb
mov byte [rsp + 0x5e], 0xcb
mov byte [rsp + 0x5f], 0xcb
mov byte [rsp + 0x60], 0xcb
mov byte [rsp + 0x61], 0xcb
mov byte [rsp + 0x62], 0xcb
mov byte [rsp + 0x63], 0xcb
mov byte [rsp + 0x64], 0xcb
mov byte [rsp + 0x65], 0xcb
mov byte [rsp + 0x66], 0xcb
mov byte [rsp + 0x67], 0xcb
mov byte [rsp + 0x68], 0xcb
mov byte [rsp + 0x69], 0xcb
mov byte [rsp + 0x6a], 0xcb
mov byte [rsp + 0x6b], 0x27
mov byte [rsp + 0x6c], 0xcb
mov byte [rsp + 0x6d], 0x27
mov byte [rsp + 0x6e], 0xcb
mov byte [rsp + 0x6f], 0xcb
mov byte [rsp + 0x70], 0xcb
mov byte [rsp + 0x71], 0xcb
mov byte [rsp + 0x72], 0xcb
mov byte [rsp + 0x73], 0xcb
mov byte [rsp + 0x74], 0xcb
mov byte [rsp + 0x75], 0xcb
mov byte [rsp + 0x76], 0xcb
mov byte [rsp + 0x77], 0xcb
mov byte [rsp + 0x78], 0xb5
mov byte [rsp + 0x79], 0xab
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023cc34], eax
jle 0x14004482c
lea rcx, [0x14023cc34]
call fcn.14005f1ec
cmp dword [0x14023cc34], 0xffffffff
jne 0x14004482c
lea rax, [0x14023c960]
mov byte [rax + 0x4a], 1
mov qword [rsp + 0x20], 0
jmp 0x1400447e3
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x4a
jae 0x140044814
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x14023c960]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x1400447d6
lea rcx, [0x14006ae90]
call fcn.14005f844
lea rcx, [0x14023cc34]
call fcn.14005f180
lea rax, [0x14023c960]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005f160
add rsp, 0x98
ret
Function at 0x140044850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140072010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x28], 0x4a
mov byte [rsp + 0x30], 0x27
mov byte [rsp + 0x31], 0xeb
mov byte [rsp + 0x32], 0x2b
mov byte [rsp + 0x33], 0xf8
mov byte [rsp + 0x34], 0xf8
mov byte [rsp + 0x35], 0xf9
mov byte [rsp + 0x36], 0xeb
mov byte [rsp + 0x37], 0xeb
mov byte [rsp + 0x38], 0x2a
mov byte [rsp + 0x39], 0x2a
mov byte [rsp + 0x3a], 0x2a
mov byte [rsp + 0x3b], 0xeb
mov byte [rsp + 0x3c], 0x47
mov byte [rsp + 0x3d], 0xeb
mov byte [rsp + 0x3e], 0x47
mov byte [rsp + 0x3f], 0xeb
mov byte [rsp + 0x40], 0x2a
mov byte [rsp + 0x41], 0x2a
mov byte [rsp + 0x42], 0xeb
mov byte [rsp + 0x43], 0x2a
mov byte [rsp + 0x44], 0xeb
mov byte [rsp + 0x45], 0x2a
mov byte [rsp + 0x46], 0xeb
mov byte [rsp + 0x47], 0x2a
mov byte [rsp + 0x48], 0x2a
mov byte [rsp + 0x49], 0xeb
mov byte [rsp + 0x4a], 0x2a
mov byte [rsp + 0x4b], 0x2a
mov byte [rsp + 0x4c], 0xeb
mov byte [rsp + 0x4d], 0x2a
mov byte [rsp + 0x4e], 0xeb
mov byte [rsp + 0x4f], 0x2a
mov byte [rsp + 0x50], 0x2a
mov byte [rsp + 0x51], 0x2a
mov byte [rsp + 0x52], 0x2a
mov byte [rsp + 0x53], 0x2a
mov byte [rsp + 0x54], 0x2a
mov byte [rsp + 0x55], 0x47
mov byte [rsp + 0x56], 0xeb
mov byte [rsp + 0x57], 0x47
mov byte [rsp + 0x58], 0xeb
mov byte [rsp + 0x59], 0xeb
mov byte [rsp + 0x5a], 0xeb
mov byte [rsp + 0x5b], 0xeb
mov byte [rsp + 0x5c], 0xeb
mov byte [rsp + 0x5d], 0x2a
mov byte [rsp + 0x5e], 0x2a
mov byte [rsp + 0x5f], 0x2a
mov byte [rsp + 0x60], 0xeb
mov byte [rsp + 0x61], 0xeb
mov byte [rsp + 0x62], 0xeb
mov byte [rsp + 0x63], 0x2a
mov byte [rsp + 0x64], 0x2a
mov byte [rsp + 0x65], 0xeb
mov byte [rsp + 0x66], 0x2a
mov byte [rsp + 0x67], 0xeb
mov byte [rsp + 0x68], 0xeb
mov byte [rsp + 0x69], 0x2a
mov byte [rsp + 0x6a], 0x2a
mov byte [rsp + 0x6b], 0x47
mov byte [rsp + 0x6c], 0xeb
mov byte [rsp + 0x6d], 0x47
mov byte [rsp + 0x6e], 0xeb
mov byte [rsp + 0x6f], 0x2a
mov byte [rsp + 0x70], 0x2a
mov byte [rsp + 0x71], 0x2a
mov byte [rsp + 0x72], 0xeb
mov byte [rsp + 0x73], 0x2a
mov byte [rsp + 0x74], 0xeb
mov byte [rsp + 0x75], 0x2a
mov byte [rsp + 0x76], 0x2a
mov byte [rsp + 0x77], 0xeb
mov byte [rsp + 0x78], 0xd5
mov byte [rsp + 0x79], 0xcb
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d628], eax
jle 0x140044a8c
lea rcx, [0x14023d628]
call fcn.14005f1ec
cmp dword [0x14023d628], 0xffffffff
jne 0x140044a8c
lea rax, [0x14023f320]
mov byte [rax + 0x4a], 1
mov qword [rsp + 0x20], 0
jmp 0x140044a43
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x4a
jae 0x140044a74
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x14023f320]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x140044a36
lea rcx, [0x14006ae50]
call fcn.14005f844
lea rcx, [0x14023d628]
call fcn.14005f180
lea rax, [0x14023f320]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005f160
add rsp, 0x98
ret
Function at 0x140044ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140072010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x28], 0x4a
mov byte [rsp + 0x30], 0x61
mov byte [rsp + 0x31], 0xa1
mov byte [rsp + 0x32], 0x6e
mov byte [rsp + 0x33], 0x6e
mov byte [rsp + 0x34], 0x6f
mov byte [rsp + 0x35], 0x61
mov byte [rsp + 0x36], 0x9d
mov byte [rsp + 0x37], 0x70
mov byte [rsp + 0x38], 0x61
mov byte [rsp + 0x39], 0xa0
mov byte [rsp + 0x3a], 0x61
mov byte [rsp + 0x3b], 0x9d
mov byte [rsp + 0x3c], 0xbd
mov byte [rsp + 0x3d], 0x61
mov byte [rsp + 0x3e], 0xbd
mov byte [rsp + 0x3f], 0x70
mov byte [rsp + 0x40], 0x61
mov byte [rsp + 0x41], 0xa0
mov byte [rsp + 0x42], 0xa1
mov byte [rsp + 0x43], 0x61
mov byte [rsp + 0x44], 0xbd
mov byte [rsp + 0x45], 0x61
mov byte [rsp + 0x46], 0x68
mov byte [rsp + 0x47], 0xa0
mov byte [rsp + 0x48], 0xa0
mov byte [rsp + 0x49], 0x70
mov byte [rsp + 0x4a], 0x61
mov byte [rsp + 0x4b], 0xa0
mov byte [rsp + 0x4c], 0xa1
mov byte [rsp + 0x4d], 0x61
mov byte [rsp + 0x4e], 0xbd
mov byte [rsp + 0x4f], 0xa0
mov byte [rsp + 0x50], 0xa0
mov byte [rsp + 0x51], 0xa0
mov byte [rsp + 0x52], 0xa0
mov byte [rsp + 0x53], 0xa0
mov byte [rsp + 0x54], 0xa0
mov byte [rsp + 0x55], 0xbd
mov byte [rsp + 0x56], 0x61
mov byte [rsp + 0x57], 0xbd
mov byte [rsp + 0x58], 0x61
mov byte [rsp + 0x59], 0x61
mov byte [rsp + 0x5a], 0x61
mov byte [rsp + 0x5b], 0x61
mov byte [rsp + 0x5c], 0x70
mov byte [rsp + 0x5d], 0x61
mov byte [rsp + 0x5e], 0xa0
mov byte [rsp + 0x5f], 0x61
mov byte [rsp + 0x60], 0x9d
mov byte [rsp + 0x61], 0x61
mov byte [rsp + 0x62], 0x70
mov byte [rsp + 0x63], 0x61
mov byte [rsp + 0x64], 0xa0
mov byte [rsp + 0x65], 0xa1
mov byte [rsp + 0x66], 0x61
mov byte [rsp + 0x67], 0xbd
mov byte [rsp + 0x68], 0x70
mov byte [rsp + 0x69], 0x61
mov byte [rsp + 0x6a], 0xa0
mov byte [rsp + 0x6b], 0xa1
mov byte [rsp + 0x6c], 0x61
mov byte [rsp + 0x6d], 0xbd
mov byte [rsp + 0x6e], 0x70
mov byte [rsp + 0x6f], 0x61
mov byte [rsp + 0x70], 0xa0
mov byte [rsp + 0x71], 0x61
mov byte [rsp + 0x72], 0x9d
mov byte [rsp + 0x73], 0x61
mov byte [rsp + 0x74], 0x68
mov byte [rsp + 0x75], 0xa0
mov byte [rsp + 0x76], 0xa0
mov byte [rsp + 0x77], 0xbd
mov byte [rsp + 0x78], 0x4b
mov byte [rsp + 0x79], 0x41
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023eaf4], eax
jle 0x140044cec
lea rcx, [0x14023eaf4]
call fcn.14005f1ec
cmp dword [0x14023eaf4], 0xffffffff
jne 0x140044cec
lea rax, [0x14023ec00]
mov byte [rax + 0x4a], 1
mov qword [rsp + 0x20], 0
jmp 0x140044ca3
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x4a
jae 0x140044cd4
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x14023ec00]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x140044c96
lea rcx, [0x14006ae10]
call fcn.14005f844
lea rcx, [0x14023eaf4]
call fcn.14005f180
lea rax, [0x14023ec00]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005f160
add rsp, 0x98
ret
Function at 0x140044d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140072010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x28], 0x4a
mov byte [rsp + 0x30], 0x50
mov byte [rsp + 0x31], 0x7d
mov byte [rsp + 0x32], 0x80
mov byte [rsp + 0x33], 0x80
mov byte [rsp + 0x34], 0x50
mov byte [rsp + 0x35], 0x41
mov byte [rsp + 0x36], 0x50
mov byte [rsp + 0x37], 0x41
mov byte [rsp + 0x38], 0x49
mov byte [rsp + 0x39], 0x80
mov byte [rsp + 0x3a], 0x4a
mov byte [rsp + 0x3b], 0x41
mov byte [rsp + 0x3c], 0x9d
mov byte [rsp + 0x3d], 0x41
mov byte [rsp + 0x3e], 0x9d
mov byte [rsp + 0x3f], 0x41
mov byte [rsp + 0x40], 0x49
mov byte [rsp + 0x41], 0x80
mov byte [rsp + 0x42], 0x9d
mov byte [rsp + 0x43], 0x41
mov byte [rsp + 0x44], 0x9d
mov byte [rsp + 0x45], 0x41
mov byte [rsp + 0x46], 0x9d
mov byte [rsp + 0x47], 0x41
mov byte [rsp + 0x48], 0x9d
mov byte [rsp + 0x49], 0x41
mov byte [rsp + 0x4a], 0x49
mov byte [rsp + 0x4b], 0x80
mov byte [rsp + 0x4c], 0x9d
mov byte [rsp + 0x4d], 0x41
mov byte [rsp + 0x4e], 0x9d
mov byte [rsp + 0x4f], 0x41
mov byte [rsp + 0x50], 0x41
mov byte [rsp + 0x51], 0x41
mov byte [rsp + 0x52], 0x41
mov byte [rsp + 0x53], 0x41
mov byte [rsp + 0x54], 0x41
mov byte [rsp + 0x55], 0x9d
mov byte [rsp + 0x56], 0x41
mov byte [rsp + 0x57], 0x9d
mov byte [rsp + 0x58], 0x80
mov byte [rsp + 0x59], 0x80
mov byte [rsp + 0x5a], 0x80
mov byte [rsp + 0x5b], 0x9d
mov byte [rsp + 0x5c], 0x41
mov byte [rsp + 0x5d], 0x49
mov byte [rsp + 0x5e], 0x80
mov byte [rsp + 0x5f], 0x4a
mov byte [rsp + 0x60], 0x41
mov byte [rsp + 0x61], 0x9d
mov byte [rsp + 0x62], 0x41
mov byte [rsp + 0x63], 0x49
mov byte [rsp + 0x64], 0x80
mov byte [rsp + 0x65], 0x9d
mov byte [rsp + 0x66], 0x41
mov byte [rsp + 0x67], 0x9d
mov byte [rsp + 0x68], 0x41
mov byte [rsp + 0x69], 0x49
mov byte [rsp + 0x6a], 0x80
mov byte [rsp + 0x6b], 0x9d
mov byte [rsp + 0x6c], 0x41
mov byte [rsp + 0x6d], 0x9d
mov byte [rsp + 0x6e], 0x41
mov byte [rsp + 0x6f], 0x41
mov byte [rsp + 0x70], 0x80
mov byte [rsp + 0x71], 0x80
mov byte [rsp + 0x72], 0x50
mov byte [rsp + 0x73], 0x41
mov byte [rsp + 0x74], 0x9d
mov byte [rsp + 0x75], 0x41
mov byte [rsp + 0x76], 0x41
mov byte [rsp + 0x77], 0x41
mov byte [rsp + 0x78], 0x2b
mov byte [rsp + 0x79], 0x21
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d5cc], eax
jle 0x140044f4c
lea rcx, [0x14023d5cc]
call fcn.14005f1ec
cmp dword [0x14023d5cc], 0xffffffff
jne 0x140044f4c
lea rax, [0x14023f510]
mov byte [rax + 0x4a], 1
mov qword [rsp + 0x20], 0
jmp 0x140044f03
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x4a
jae 0x140044f34
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x14023f510]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x140044ef6
lea rcx, [0x14006add0]
call fcn.14005f844
lea rcx, [0x14023d5cc]
call fcn.14005f180
lea rax, [0x14023f510]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005f160
add rsp, 0x98
ret
Function at 0x140044f70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140072010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x28], 0x4c
mov byte [rsp + 0x30], 0xa9
mov byte [rsp + 0x31], 0xac
mov byte [rsp + 0x32], 0xac
mov byte [rsp + 0x33], 0xac
mov byte [rsp + 0x34], 0xac
mov byte [rsp + 0x35], 0x7c
mov byte [rsp + 0x36], 0x6d
mov byte [rsp + 0x37], 0xa9
mov byte [rsp + 0x38], 0xac
mov byte [rsp + 0x39], 0xac
mov byte [rsp + 0x3a], 0xac
mov byte [rsp + 0x3b], 0x7c
mov byte [rsp + 0x3c], 0xc9
mov byte [rsp + 0x3d], 0xac
mov byte [rsp + 0x3e], 0xc9
mov byte [rsp + 0x3f], 0xa9
mov byte [rsp + 0x40], 0xac
mov byte [rsp + 0x41], 0xac
mov byte [rsp + 0x42], 0x79
mov byte [rsp + 0x43], 0xac
mov byte [rsp + 0x44], 0xc9
mov byte [rsp + 0x45], 0xac
mov byte [rsp + 0x46], 0xc9
mov byte [rsp + 0x47], 0x6d
mov byte [rsp + 0x48], 0x6d
mov byte [rsp + 0x49], 0xa9
mov byte [rsp + 0x4a], 0xac
mov byte [rsp + 0x4b], 0xac
mov byte [rsp + 0x4c], 0x79
mov byte [rsp + 0x4d], 0xac
mov byte [rsp + 0x4e], 0xc9
mov byte [rsp + 0x4f], 0x6d
mov byte [rsp + 0x50], 0x6d
mov byte [rsp + 0x51], 0x6d
mov byte [rsp + 0x52], 0x6d
mov byte [rsp + 0x53], 0x6d
mov byte [rsp + 0x54], 0x6d
mov byte [rsp + 0x55], 0xa9
mov byte [rsp + 0x56], 0xac
mov byte [rsp + 0x57], 0xac
mov byte [rsp + 0x58], 0xac
mov byte [rsp + 0x59], 0xac
mov byte [rsp + 0x5a], 0xac
mov byte [rsp + 0x5b], 0x7c
mov byte [rsp + 0x5c], 0xa9
mov byte [rsp + 0x5d], 0xac
mov byte [rsp + 0x5e], 0xac
mov byte [rsp + 0x5f], 0xac
mov byte [rsp + 0x60], 0x7c
mov byte [rsp + 0x61], 0x6d
mov byte [rsp + 0x62], 0xa9
mov byte [rsp + 0x63], 0xac
mov byte [rsp + 0x64], 0xac
mov byte [rsp + 0x65], 0x79
mov byte [rsp + 0x66], 0xac
mov byte [rsp + 0x67], 0xc9
mov byte [rsp + 0x68], 0xa9
mov byte [rsp + 0x69], 0xac
mov byte [rsp + 0x6a], 0xac
mov byte [rsp + 0x6b], 0x79
mov byte [rsp + 0x6c], 0xac
mov byte [rsp + 0x6d], 0xc9
mov byte [rsp + 0x6e], 0xa9
mov byte [rsp + 0x6f], 0xac
mov byte [rsp + 0x70], 0xac
mov byte [rsp + 0x71], 0xac
mov byte [rsp + 0x72], 0xc9
mov byte [rsp + 0x73], 0xac
mov byte [rsp + 0x74], 0xc9
mov byte [rsp + 0x75], 0x6d
mov byte [rsp + 0x76], 0x6d
mov byte [rsp + 0x77], 0x6d
mov byte [rsp + 0x78], 0x57
mov byte [rsp + 0x79], 0x57
mov byte [rsp + 0x7a], 0x57
mov byte [rsp + 0x7b], 0x4d
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023ecdc], eax
jle 0x1400451b6
lea rcx, [0x14023ecdc]
call fcn.14005f1ec
cmp dword [0x14023ecdc], 0xffffffff
jne 0x1400451b6
lea rax, [0x14023ea00]
mov byte [rax + 0x4c], 1
mov qword [rsp + 0x20], 0
jmp 0x14004516d
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x4c
jae 0x14004519e
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x14023ea00]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x140045160
lea rcx, [0x14006ad90]
call fcn.14005f844
lea rcx, [0x14023ecdc]
call fcn.14005f180
lea rax, [0x14023ea00]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005f160
add rsp, 0x98
ret
Function at 0x1400452f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140072010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x28], 0x4b
mov byte [rsp + 0x30], 0xa0
mov byte [rsp + 0x31], 0xa0
mov byte [rsp + 0x32], 0xa0
mov byte [rsp + 0x33], 0x61
mov byte [rsp + 0x34], 0x61
mov byte [rsp + 0x35], 0xa0
mov byte [rsp + 0x36], 0xa0
mov byte [rsp + 0x37], 0xa0
mov byte [rsp + 0x38], 0x61
mov byte [rsp + 0x39], 0x61
mov byte [rsp + 0x3a], 0x61
mov byte [rsp + 0x3b], 0x61
mov byte [rsp + 0x3c], 0x61
mov byte [rsp + 0x3d], 0x61
mov byte [rsp + 0x3e], 0x61
mov byte [rsp + 0x3f], 0x61
mov byte [rsp + 0x40], 0x61
mov byte [rsp + 0x41], 0x61
mov byte [rsp + 0x42], 0x61
mov byte [rsp + 0x43], 0x61
mov byte [rsp + 0x44], 0x61
mov byte [rsp + 0x45], 0x61
mov byte [rsp + 0x46], 0x61
mov byte [rsp + 0x47], 0x61
mov byte [rsp + 0x48], 0x61
mov byte [rsp + 0x49], 0x61
mov byte [rsp + 0x4a], 0x61
mov byte [rsp + 0x4b], 0x61
mov byte [rsp + 0x4c], 0x61
mov byte [rsp + 0x4d], 0x61
mov byte [rsp + 0x4e], 0x61
mov byte [rsp + 0x4f], 0x61
mov byte [rsp + 0x50], 0x61
mov byte [rsp + 0x51], 0x61
mov byte [rsp + 0x52], 0x61
mov byte [rsp + 0x53], 0xa0
mov byte [rsp + 0x54], 0xa0
mov byte [rsp + 0x55], 0xa0
mov byte [rsp + 0x56], 0xa0
mov byte [rsp + 0x57], 0xa0
mov byte [rsp + 0x58], 0x61
mov byte [rsp + 0x59], 0x61
mov byte [rsp + 0x5a], 0x61
mov byte [rsp + 0x5b], 0x61
mov byte [rsp + 0x5c], 0x61
mov byte [rsp + 0x5d], 0x61
mov byte [rsp + 0x5e], 0x61
mov byte [rsp + 0x5f], 0x61
mov byte [rsp + 0x60], 0x61
mov byte [rsp + 0x61], 0x61
mov byte [rsp + 0x62], 0x61
mov byte [rsp + 0x63], 0xa0
mov byte [rsp + 0x64], 0x61
mov byte [rsp + 0x65], 0x61
mov byte [rsp + 0x66], 0x61
mov byte [rsp + 0x67], 0x61
mov byte [rsp + 0x68], 0x61
mov byte [rsp + 0x69], 0x61
mov byte [rsp + 0x6a], 0x61
mov byte [rsp + 0x6b], 0x61
mov byte [rsp + 0x6c], 0x61
mov byte [rsp + 0x6d], 0x61
mov byte [rsp + 0x6e], 0x61
mov byte [rsp + 0x6f], 0x61
mov byte [rsp + 0x70], 0x61
mov byte [rsp + 0x71], 0x61
mov byte [rsp + 0x72], 0x61
mov byte [rsp + 0x73], 0x61
mov byte [rsp + 0x74], 0x61
mov byte [rsp + 0x75], 0x61
mov byte [rsp + 0x76], 0x61
mov byte [rsp + 0x77], 0x61
mov byte [rsp + 0x78], 0x61
mov byte [rsp + 0x79], 0x4b
mov byte [rsp + 0x7a], 0x41
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023f0b8], eax
jle 0x140045531
lea rcx, [0x14023f0b8]
call fcn.14005f1ec
cmp dword [0x14023f0b8], 0xffffffff
jne 0x140045531
lea rax, [0x14023f010]
mov byte [rax + 0x4b], 1
mov qword [rsp + 0x20], 0
jmp 0x1400454e8
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x4b
jae 0x140045519
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x14023f010]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x1400454db
lea rcx, [0x14006ad10]
call fcn.14005f844
lea rcx, [0x14023f0b8]
call fcn.14005f180
lea rax, [0x14023f010]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005f160
add rsp, 0x98
ret
Function at 0x140045a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140072010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x28], 0x4a
mov byte [rsp + 0x30], 0x51
mov byte [rsp + 0x31], 0xf5
mov byte [rsp + 0x32], 0x51
mov byte [rsp + 0x33], 0x31
mov byte [rsp + 0x34], 4
mov byte [rsp + 0x35], 0x51
mov byte [rsp + 0x36], 0xf5
mov byte [rsp + 0x37], 0x51
mov byte [rsp + 0x38], 4
mov byte [rsp + 0x39], 0xf5
mov byte [rsp + 0x3a], 0x34
mov byte [rsp + 0x3b], 0xf5
mov byte [rsp + 0x3c], 0x31
mov byte [rsp + 0x3d], 0x51
mov byte [rsp + 0x3e], 0xf5
mov byte [rsp + 0x3f], 0xfc
mov byte [rsp + 0x40], 0x34
mov byte [rsp + 0x41], 0xf5
mov byte [rsp + 0x42], 0x31
mov byte [rsp + 0x43], 0xf5
mov byte [rsp + 0x44], 4
mov byte [rsp + 0x45], 0xf5
mov byte [rsp + 0x46], 0x34
mov byte [rsp + 0x47], 0xf5
mov byte [rsp + 0x48], 0x31
mov byte [rsp + 0x49], 0xf5
mov byte [rsp + 0x4a], 0xfc
mov byte [rsp + 0x4b], 0x34
mov byte [rsp + 0x4c], 0x34
mov byte [rsp + 0x4d], 4
mov byte [rsp + 0x4e], 0xf5
mov byte [rsp + 0x4f], 0x34
mov byte [rsp + 0x50], 0xf5
mov byte [rsp + 0x51], 0x31
mov byte [rsp + 0x52], 0x51
mov byte [rsp + 0x53], 0xf5
mov byte [rsp + 0x54], 0xf5
mov byte [rsp + 0x55], 0x34
mov byte [rsp + 0x56], 0x34
mov byte [rsp + 0x57], 0x31
mov byte [rsp + 0x58], 0xf5
mov byte [rsp + 0x59], 0x31
mov byte [rsp + 0x5a], 4
mov byte [rsp + 0x5b], 0xf5
mov byte [rsp + 0x5c], 4
mov byte [rsp + 0x5d], 0xf5
mov byte [rsp + 0x5e], 0xfc
mov byte [rsp + 0x5f], 0x34
mov byte [rsp + 0x60], 0xf5
mov byte [rsp + 0x61], 0x31
mov byte [rsp + 0x62], 0x51
mov byte [rsp + 0x63], 0xf5
mov byte [rsp + 0x64], 0x51
mov byte [rsp + 0x65], 4
mov byte [rsp + 0x66], 0xf5
mov byte [rsp + 0x67], 0x34
mov byte [rsp + 0x68], 0xf5
mov byte [rsp + 0x69], 0x31
mov byte [rsp + 0x6a], 0x51
mov byte [rsp + 0x6b], 0xf5
mov byte [rsp + 0x6c], 0xfc
mov byte [rsp + 0x6d], 0x34
mov byte [rsp + 0x6e], 0x34
mov byte [rsp + 0x6f], 4
mov byte [rsp + 0x70], 0xf5
mov byte [rsp + 0x71], 0x34
mov byte [rsp + 0x72], 0xf5
mov byte [rsp + 0x73], 0xf5
mov byte [rsp + 0x74], 0xfc
mov byte [rsp + 0x75], 0x34
mov byte [rsp + 0x76], 0x34
mov byte [rsp + 0x77], 0x51
mov byte [rsp + 0x78], 0xdf
mov byte [rsp + 0x79], 0xd5
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023e474], eax
jle 0x140045c4c
lea rcx, [0x14023e474]
call fcn.14005f1ec
cmp dword [0x14023e474], 0xffffffff
jne 0x140045c4c
lea rax, [0x14023ed50]
mov byte [rax + 0x4a], 1
mov qword [rsp + 0x20], 0
jmp 0x140045c03
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x4a
jae 0x140045c34
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x14023ed50]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x140045bf6
lea rcx, [0x14006ac50]
call fcn.14005f844
lea rcx, [0x14023e474]
call fcn.14005f180
lea rax, [0x14023ed50]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005f160
add rsp, 0x98
ret