joyce8/EMBER2024-capa huggingface dataset:
Function at 0x676906a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x676906df
jb 0x676906f4
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret

Function at 0x67690760
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x6769079f
jb 0x676907b4
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x67690820
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x676908f0
jb 0x6769094f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.67690ab0
aeskeygenassist xmm1, xmm0, 1
call fcn.67690ac0
aeskeygenassist xmm1, xmm2, 2
call fcn.67690ab0
aeskeygenassist xmm1, xmm0, 2
call fcn.67690ac0
aeskeygenassist xmm1, xmm2, 4
call fcn.67690ab0
aeskeygenassist xmm1, xmm0, 4
call fcn.67690ac0
aeskeygenassist xmm1, xmm2, 8
call fcn.67690ab0
aeskeygenassist xmm1, xmm0, 8
call fcn.67690ac0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.67690ab0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.67690ac0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.67690ab0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.67690ac0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.67690ab0
jmp 0x676909bd
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.67690a20
aeskeygenassist xmm1, xmm2, 2
call fcn.67690a70
aeskeygenassist xmm1, xmm2, 4
call fcn.67690a20
aeskeygenassist xmm1, xmm2, 8
call fcn.67690a70
aeskeygenassist xmm1, xmm2, 0x10
call fcn.67690a20
aeskeygenassist xmm1, xmm2, 0x20
call fcn.67690a70
aeskeygenassist xmm1, xmm2, 0x40
call fcn.67690a20
aeskeygenassist xmm1, xmm2, 0x80
call fcn.67690a70
jmp 0x676909bd
aeskeygenassist xmm1, xmm0, 1
call fcn.676909f0
aeskeygenassist xmm1, xmm0, 2
call fcn.676909f0
aeskeygenassist xmm1, xmm0, 4
call fcn.676909f0
aeskeygenassist xmm1, xmm0, 8
call fcn.676909f0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.676909f0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.676909f0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.676909f0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.676909f0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.676909f0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.676909f0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x676909ca
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x676ae060
Capabilities:
Execute syscall

Disassembly:
xor rax, rax
mov ax, word [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov rdx, rsp
add rdx, 0x48
mov qword [rdx], 0
mov r8, qword [rsp + 0x2b]
mov r9, rsp
add r9, 0x28
add rsp, 8
mov r10, rcx
syscall
sub rsp, 8
ret

Function at 0x676bc8d0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
mov r8, rdx
xor edx, edx
call qword [sym.imp.msvcrt.dll__beginthread]
cmp rax, 0xffffffffffffffff
je 0x676bc8ec
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, 2
mov ebx, dword [rax]
call qword [fcn.676c3010]
lea rdx, [0x6789ef90]
mov rcx, rax
mov r8d, ebx
call fcn.676bc7c0
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x676bcbf0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov r8, rcx
lea rcx, [0x676bcb70]
call qword [sym.imp.msvcrt.dll__beginthread]
cmp rax, 0xffffffffffffffff
je 0x676bcc13
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, 2
mov ebx, dword [rax]
call qword [fcn.676c3010]
lea rdx, str.runtime:_failed_to_create_new_OS_thread___d__n
mov rcx, rax
mov r8d, ebx
call fcn.676bcbb0
call sub.msvcrt.dll_abort
nop
nop
nop

Function at 0x676c1c30
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.676c3010
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.676c3010
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x676c1ca0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x678d2984]
mov r12, rcx
test ebx, ebx
jle 0x676c1dd0
mov rax, qword [0x678d2988]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x676c1cec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x676c1d73
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x676c1cd0
mov rcx, r12
call fcn.676c2430
mov rsi, rax
test rax, rax
je 0x676c1df2
mov rax, qword [0x678d2988]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.676c2560
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x678d2988]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x676c1dd7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x676c1d6c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x676c1d80
add dword [0x678d2984], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x678d2988]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x676c1d6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.676c1c30
nop dword [rax]
xor ebx, ebx
jmp 0x676c1cf7
mov rax, qword [0x678d2988]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.676c1c30
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.676c1c30
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x676c20a0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x678d29c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x678d29a0]
test rbx, rbx
je 0x676c20f4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x676c20eb
test r12, r12
je 0x676c20eb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x676c20d0
lea rcx, [0x678d29c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x676c2430
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x6789f5c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x676c2450
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x676c2458
ret
cmp word [r8 + 0x18], 0x20b
jne 0x676c2450
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x676c24a5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x676c249c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x676c2450
add rax, 0x28
cmp rax, r9
jne 0x676c2488
xor eax, eax
ret

Function at 0x676c24b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x6789f5c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x676c24d0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x676c24d8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x676c24d0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x676c2560
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x6789f5c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x676c2580
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x676c2588
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x14000225a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0xa8
mov word [rsp + 0x20], 0x3f
mov word [rsp + 0x22], 0x35
mov word [rsp + 0x24], 0x48
mov word [rsp + 0x26], 0x4a
mov word [rsp + 0x28], 0x4c
mov word [rsp + 0x2a], 0x56
mov word [rsp + 0x2c], 0x57
mov word [rsp + 0x2e], 0x55
mov word [rsp + 0x30], 0x5c
mov word [rsp + 0x32], 0x3f
mov word [rsp + 0x34], 0x30
mov word [rsp + 0x36], 0x44
mov word [rsp + 0x38], 0x46
mov word [rsp + 0x3a], 0x4b
mov word [rsp + 0x3c], 0x4c
mov word [rsp + 0x3e], 0x51
mov word [rsp + 0x40], 0x48
mov word [rsp + 0x42], 0x3f
mov word [rsp + 0x44], 0x36
mov word [rsp + 0x46], 0x3c
mov word [rsp + 0x48], 0x36
mov word [rsp + 0x4a], 0x37
mov word [rsp + 0x4c], 0x28
mov word [rsp + 0x4e], 0x30
mov word [rsp + 0x50], 0x3f
mov word [rsp + 0x52], 0x26
mov word [rsp + 0x54], 0x58
mov word [rsp + 0x56], 0x55
mov word [rsp + 0x58], 0x55
mov word [rsp + 0x5a], 0x48
mov word [rsp + 0x5c], 0x51
mov word [rsp + 0x5e], 0x57
mov word [rsp + 0x60], 0x26
mov word [rsp + 0x62], 0x52
mov word [rsp + 0x64], 0x51
mov word [rsp + 0x66], 0x57
mov word [rsp + 0x68], 0x55
mov word [rsp + 0x6a], 0x52
mov word [rsp + 0x6c], 0x4f
mov word [rsp + 0x6e], 0x36
mov word [rsp + 0x70], 0x48
mov word [rsp + 0x72], 0x57
mov word [rsp + 0x74], 0x3f
mov word [rsp + 0x76], 0x36
mov word [rsp + 0x78], 0x48
mov word [rsp + 0x7a], 0x55
mov word [rsp + 0x7c], 0x59
mov word [rsp + 0x7e], 0x4c
mov word [rsp + 0x80], 0x46
mov word [rsp + 0x82], 0x48
mov word [rsp + 0x84], 0x56
mov word [rsp + 0x86], 0x3f
mov word [rsp + 0x88], 0x38
mov word [rsp + 0x8a], 0x56
mov word [rsp + 0x8c], 0x52
mov word [rsp + 0x8e], 0x36
mov word [rsp + 0x90], 0x59
mov word [rsp + 0x92], 0x46
mov word [rsp + 0x94], 0xe3
cmp byte [0x1409d51e8], 0
jne 0x140002461
mov byte [0x1409d5276], 1
mov eax, 0
lea rcx, [0x1409d5200]
movzx edx, word [rsp + rax*2 + 0x20]
mov word [rcx + rax*2], dx
add rax, 1
cmp rax, 0x3b
jne 0x14000243b
mov byte [0x1409d51e8], 1
lea rcx, [0x14000161f]
call fcn.1400014f0
lea rax, [0x1409d5200]
add rsp, 0xa8
ret
Function at 0x140002470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0xa8
mov word [rsp + 0x20], 0x79
mov word [rsp + 0x22], 0x6f
mov word [rsp + 0x24], 0x82
mov word [rsp + 0x26], 0x84
mov word [rsp + 0x28], 0x86
mov word [rsp + 0x2a], 0x90
mov word [rsp + 0x2c], 0x91
mov word [rsp + 0x2e], 0x8f
mov word [rsp + 0x30], 0x96
mov word [rsp + 0x32], 0x79
mov word [rsp + 0x34], 0x6a
mov word [rsp + 0x36], 0x7e
mov word [rsp + 0x38], pe_nt_image_headers64
mov word [rsp + 0x3a], 0x85
mov word [rsp + 0x3c], 0x86
mov word [rsp + 0x3e], 0x8b
mov word [rsp + 0x40], 0x82
mov word [rsp + 0x42], 0x79
mov word [rsp + 0x44], 0x70
mov word [rsp + 0x46], 0x76
mov word [rsp + 0x48], 0x70
mov word [rsp + 0x4a], 0x71
mov word [rsp + 0x4c], 0x62
mov word [rsp + 0x4e], 0x6a
mov word [rsp + 0x50], 0x79
mov word [rsp + 0x52], 0x60
mov word [rsp + 0x54], 0x92
mov word [rsp + 0x56], 0x8f
mov word [rsp + 0x58], 0x8f
mov word [rsp + 0x5a], 0x82
mov word [rsp + 0x5c], 0x8b
mov word [rsp + 0x5e], 0x91
mov word [rsp + 0x60], 0x60
mov word [rsp + 0x62], 0x8c
mov word [rsp + 0x64], 0x8b
mov word [rsp + 0x66], 0x91
mov word [rsp + 0x68], 0x8f
mov word [rsp + 0x6a], 0x8c
mov word [rsp + 0x6c], 0x89
mov word [rsp + 0x6e], 0x70
mov word [rsp + 0x70], 0x82
mov word [rsp + 0x72], 0x91
mov word [rsp + 0x74], 0x79
mov word [rsp + 0x76], 0x70
mov word [rsp + 0x78], 0x82
mov word [rsp + 0x7a], 0x8f
mov word [rsp + 0x7c], 0x93
mov word [rsp + 0x7e], 0x86
mov word [rsp + pe_nt_image_headers64], 0x80
mov word [rsp + 0x82], 0x82
mov word [rsp + 0x84], 0x90
mov word [rsp + 0x86], 0x79
mov word [rsp + 0x88], 0x94
mov word [rsp + 0x8a], 0x92
mov word [rsp + 0x8c], 0x7e
mov word [rsp + 0x8e], 0x92
mov word [rsp + 0x90], 0x90
mov word [rsp + 0x92], 0x82
mov word [rsp + 0x94], 0x8f
mov word [rsp + 0x96], 0x93
mov word [rsp + 0x98], 0x1d
cmp byte [0x1409d5040], 0
jne 0x14000268b
mov byte [0x1409d50da], 1
mov eax, 0
lea rcx, [0x1409d5060]
movzx edx, word [rsp + rax*2 + 0x20]
mov word [rcx + rax*2], dx
add rax, 1
cmp rax, 0x3d
jne 0x140002665
mov byte [0x1409d5040], 1
lea rcx, [0x14000168a]
call fcn.1400014f0
lea rax, [0x1409d5060]
add rsp, 0xa8
ret
Function at 0x1400028a6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x55
mov byte [rsp + 0x22], 0x60
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x5f
mov byte [rsp + 0x25], 0x5d
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x52
mov byte [rsp + 0x28], 0x55
mov byte [rsp + 0x29], 0x1f
mov byte [rsp + 0x2a], 0x68
mov byte [rsp + 0x2b], 0x5a
mov byte [rsp + 0x2c], 0x5f
mov byte [rsp + 0x2d], 0x55
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x68
mov byte [rsp + 0x30], 0x64
mov byte [rsp + 0x31], 0x66
mov byte [rsp + 0x32], 0x61
mov byte [rsp + 0x33], 0x55
mov byte [rsp + 0x34], 0x52
mov byte [rsp + 0x35], 0x65
mov byte [rsp + 0x36], 0x56
mov byte [rsp + 0x37], 0x1f
mov byte [rsp + 0x38], 0x54
mov byte [rsp + 0x39], 0x60
mov byte [rsp + 0x3a], 0x5e
mov byte [rsp + 0x3b], 0xf1
cmp byte [0x1409d4d18], 0
jne 0x140002977
mov byte [0x1409d4d3c], 1
mov eax, 0
lea rcx, [0x1409d4d20]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x1c
jne 0x140002952
mov byte [0x1409d4d18], 1
lea rcx, [0x14000175d]
call fcn.1400014f0
lea rax, [0x1409d4d20]
add rsp, 0x48
ret

Function at 0x140002984
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x55
mov byte [rsp + 0x22], 0x60
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x5f
mov byte [rsp + 0x25], 0x5d
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x52
mov byte [rsp + 0x28], 0x55
mov byte [rsp + 0x29], 0x1f
mov byte [rsp + 0x2a], 0x68
mov byte [rsp + 0x2b], 0x5a
mov byte [rsp + 0x2c], 0x5f
mov byte [rsp + 0x2d], 0x55
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x68
mov byte [rsp + 0x30], 0x64
mov byte [rsp + 0x31], 0x66
mov byte [rsp + 0x32], 0x61
mov byte [rsp + 0x33], 0x55
mov byte [rsp + 0x34], 0x52
mov byte [rsp + 0x35], 0x65
mov byte [rsp + 0x36], 0x56
mov byte [rsp + 0x37], 0x1f
mov byte [rsp + 0x38], 0x54
mov byte [rsp + 0x39], 0x60
mov byte [rsp + 0x3a], 0x5e
mov byte [rsp + 0x3b], 0xf1
cmp byte [0x1409d4c10], 0
jne 0x140002a55
mov byte [0x1409d4c3c], 1
mov eax, 0
lea rcx, [0x1409d4c20]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x1c
jne 0x140002a30
mov byte [0x1409d4c10], 1
lea rcx, [0x1400017ed]
call fcn.1400014f0
lea rax, [0x1409d4c20]
add rsp, 0x48
ret
Function at 0x140002a62
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x55
mov byte [rsp + 0x22], 0x60
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x5f
mov byte [rsp + 0x25], 0x5d
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x52
mov byte [rsp + 0x28], 0x55
mov byte [rsp + 0x29], 0x1f
mov byte [rsp + 0x2a], 0x68
mov byte [rsp + 0x2b], 0x5a
mov byte [rsp + 0x2c], 0x5f
mov byte [rsp + 0x2d], 0x55
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x68
mov byte [rsp + 0x30], 0x64
mov byte [rsp + 0x31], 0x66
mov byte [rsp + 0x32], 0x61
mov byte [rsp + 0x33], 0x55
mov byte [rsp + 0x34], 0x52
mov byte [rsp + 0x35], 0x65
mov byte [rsp + 0x36], 0x56
mov byte [rsp + 0x37], 0x1f
mov byte [rsp + 0x38], 0x54
mov byte [rsp + 0x39], 0x60
mov byte [rsp + 0x3a], 0x5e
mov byte [rsp + 0x3b], 0xf1
cmp byte [0x1409d4ab0], 0
jne 0x140002b33
mov byte [0x1409d4adc], 1
mov eax, 0
lea rcx, [0x1409d4ac0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x1c
jne 0x140002b0e
mov byte [0x1409d4ab0], 1
lea rcx, [0x1400018ad]
call fcn.1400014f0
lea rax, [0x1409d4ac0]
add rsp, 0x48
ret

Function at 0x140002b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x67
mov byte [rsp + 0x23], 0x60
mov byte [rsp + 0x24], 0x63
mov byte [rsp + 0x25], 0x65
mov byte [rsp + 0x26], 0x56
mov byte [rsp + 0x27], 0x69
mov byte [rsp + 0x28], 0x1f
mov byte [rsp + 0x29], 0x55
mov byte [rsp + 0x2a], 0x52
mov byte [rsp + 0x2b], 0x65
mov byte [rsp + 0x2c], 0x52
mov byte [rsp + 0x2d], 0x1f
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0x5a
mov byte [rsp + 0x30], 0x54
mov byte [rsp + 0x31], 0x63
mov byte [rsp + 0x32], 0x60
mov byte [rsp + 0x33], 0x64
mov byte [rsp + 0x34], 0x60
mov byte [rsp + 0x35], 0x57
mov byte [rsp + 0x36], 0x65
mov byte [rsp + 0x37], 0x1f
mov byte [rsp + 0x38], 0x54
mov byte [rsp + 0x39], 0x60
mov byte [rsp + 0x3a], 0x5e
mov byte [rsp + 0x3b], 0xf1
cmp byte [0x1409d49a8], 0
jne 0x140002c11
mov byte [0x1409d49cc], 1
mov eax, 0
lea rcx, [0x1409d49b0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x1c
jne 0x140002bec
mov byte [0x1409d49a8], 1
lea rcx, [0x14000193d]
call fcn.1400014f0
lea rax, [0x1409d49b0]
add rsp, 0x48
ret
Function at 0x140002c1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x1f
mov byte [rsp + 0x23], 0x5e
mov byte [rsp + 0x24], 0x5a
mov byte [rsp + 0x25], 0x54
mov byte [rsp + 0x26], 0x63
mov byte [rsp + 0x27], 0x60
mov byte [rsp + 0x28], 0x64
mov byte [rsp + 0x29], 0x60
mov byte [rsp + 0x2a], 0x57
mov byte [rsp + 0x2b], 0x65
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x1409d4cf0], 0
jne 0x140002cb8
mov byte [0x1409d4d11], 1
mov eax, 0
lea rcx, [0x1409d4d00]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140002c93
mov byte [0x1409d4cf0], 1
lea rcx, [0x140001775]
call fcn.1400014f0
lea rax, [0x1409d4d00]
add rsp, 0x48
ret

Function at 0x140002cc4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x65
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x65
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x5d
mov byte [rsp + 0x2a], 0x52
mov byte [rsp + 0x2b], 0x67
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x1409d47f0], 0
jne 0x140002d5e
mov byte [0x1409d4811], 1
mov eax, 0
lea rcx, [0x1409d4800]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140002d39
mov byte [0x1409d47f0], 1
lea rcx, [0x140001a2d]
call fcn.1400014f0
lea rax, [0x1409d4800]
add rsp, 0x48
ret

Function at 0x140002d6a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x53
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x65
mov byte [rsp + 0x24], 0x55
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x57
mov byte [rsp + 0x27], 0x56
mov byte [rsp + 0x28], 0x5f
mov byte [rsp + 0x29], 0x55
mov byte [rsp + 0x2a], 0x56
mov byte [rsp + 0x2b], 0x63
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x1409d46d8], 0
jne 0x140002e04
mov byte [0x1409d46f1], 1
mov eax, 0
lea rcx, [0x1409d46e0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140002ddf
mov byte [0x1409d46d8], 1
lea rcx, [0x140001b05]
call fcn.1400014f0
lea rax, [0x1409d46e0]
add rsp, 0x48
ret
Function at 0x140002e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x55
mov byte [rsp + 0x26], 0x61
mov byte [rsp + 0x27], 0x53
mov byte [rsp + 0x28], 0x60
mov byte [rsp + 0x29], 0x5d
mov byte [rsp + 0x2a], 0x67
mov byte [rsp + 0x2b], 0x68
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x5f
mov byte [rsp + 0x2e], 0x56
mov byte [rsp + 0x2f], 0x65
mov byte [rsp + 0x30], 0xf1
cmp byte [0x1409d43a0], 0
jne 0x140002eaa
mov byte [0x1409d43c1], 1
mov eax, 0
lea rcx, [0x1409d43b0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140002e85
mov byte [0x1409d43a0], 1
lea rcx, [0x140001d8d]
call fcn.1400014f0
lea rax, [0x1409d43b0]
add rsp, 0x48
ret

Function at 0x140002eb6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x59
mov byte [rsp + 0x22], 0x60
mov byte [rsp + 0x23], 0x5e
mov byte [rsp + 0x24], 0x56
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x64
mov byte [rsp + 0x27], 0x60
mov byte [rsp + 0x28], 0x61
mov byte [rsp + 0x29], 0x59
mov byte [rsp + 0x2a], 0x60
mov byte [rsp + 0x2b], 0x64
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x1409d4348], 0
jne 0x140002f50
mov byte [0x1409d4361], 1
mov eax, 0
lea rcx, [0x1409d4350]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140002f2b
mov byte [0x1409d4348], 1
lea rcx, [0x140001dd5]
call fcn.1400014f0
lea rax, [0x1409d4350]
add rsp, 0x48
ret

Function at 0x140002f5c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x52
mov byte [rsp + 0x26], 0x55
mov byte [rsp + 0x27], 0x52
mov byte [rsp + 0x28], 0x68
mov byte [rsp + 0x29], 0x52
mov byte [rsp + 0x2a], 0x63
mov byte [rsp + 0x2b], 0x56
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x1409d4300], 0
jne 0x140002ff6
mov byte [0x1409d4321], 1
mov eax, 0
lea rcx, [0x1409d4310]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140002fd1
mov byte [0x1409d4300], 1
lea rcx, [0x140001e05]
call fcn.1400014f0
lea rax, [0x1409d4310]
add rsp, 0x48
ret