joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002f40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Autres_tgerald_tindustries_tsamara_ttraveltourism_ttreasures_tfo_tprt_tqsc_tbookimages_tweba_tarrow_thotjobs_tpntables_telementary_tuserarea_tscgibin_tstar_torel_trotatorwidget_tdatasheets_tbulletin_twebfiles_tchat_ttt_tvypiska_tboxes_trecomendar_teasyeditor_tgeometry_tauthfiles_tfranchisee_tmysimpleads_trevistas_tect
mov r10, rax
sub rbx, rax
movabs rdi, 0xe525982af70c880f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xa]
mul rcx
add r11d, 0xa
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xa
jb 0x140002f90
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140003f90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Autres_tgerald_tindustries_tsamara_ttraveltourism_ttreasures_tfo_tprt_tqsc_tbookimages_tweba_tarrow_thotjobs_tpntables_telementary_tuserarea_tscgibin_tstar_torel_trotatorwidget_tdatasheets_tbulletin_twebfiles_tchat_ttt_tvypiska_tboxes_trecomendar_teasyeditor_tgeometry_tauthfiles_tfranchisee_tmysimpleads_trevistas_tect
mov r10, rax
sub rbx, rax
movabs rdi, 0xe525982af70c880f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xc]
mul rcx
add r11d, 0xc
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xc
jb 0x140003fe0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400041d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Autres_tgerald_tindustries_tsamara_ttraveltourism_ttreasures_tfo_tprt_tqsc_tbookimages_tweba_tarrow_thotjobs_tpntables_telementary_tuserarea_tscgibin_tstar_torel_trotatorwidget_tdatasheets_tbulletin_twebfiles_tchat_ttt_tvypiska_tboxes_trecomendar_teasyeditor_tgeometry_tauthfiles_tfranchisee_tmysimpleads_trevistas_tect
mov r10, rax
sub rbx, rax
movabs rdi, 0xe525982af70c880f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 6]
mov rax, rdi
mov rcx, r8
mul r8
add r11d, 6
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 7]
mov byte [r9 - 7], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 6
jb 0x140004220
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004960
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Autres_tgerald_tindustries_tsamara_ttraveltourism_ttreasures_tfo_tprt_tqsc_tbookimages_tweba_tarrow_thotjobs_tpntables_telementary_tuserarea_tscgibin_tstar_torel_trotatorwidget_tdatasheets_tbulletin_twebfiles_tchat_ttt_tvypiska_tboxes_trecomendar_teasyeditor_tgeometry_tauthfiles_tfranchisee_tmysimpleads_trevistas_tect
mov r10, rax
sub rbx, rax
movabs rdi, 0xe525982af70c880f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xd]
mul rcx
add r11d, 0xd
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xc]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xd
jb 0x1400049b0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004e60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Autres_tgerald_tindustries_tsamara_ttraveltourism_ttreasures_tfo_tprt_tqsc_tbookimages_tweba_tarrow_thotjobs_tpntables_telementary_tuserarea_tscgibin_tstar_torel_trotatorwidget_tdatasheets_tbulletin_twebfiles_tchat_ttt_tvypiska_tboxes_trecomendar_teasyeditor_tgeometry_tauthfiles_tfranchisee_tmysimpleads_trevistas_tect
mov r10, rax
sub rbx, rax
movabs rdi, 0xe525982af70c880f
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 0xc]
mov rax, rdi
mov rcx, r8
mul r8
add r11d, 6
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 0xe]
movsx eax, al
mov word [r9 - 0xe], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 0xc]
movsx eax, al
mov word [r9 - 0xc], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 0xa]
movsx eax, al
mov word [r9 - 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 6
jb 0x140004eb0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004fd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xe]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Autres_tgerald_tindustries_tsamara_ttraveltourism_ttreasures_tfo_tprt_tqsc_tbookimages_tweba_tarrow_thotjobs_tpntables_telementary_tuserarea_tscgibin_tstar_torel_trotatorwidget_tdatasheets_tbulletin_twebfiles_tchat_ttt_tvypiska_tboxes_trecomendar_teasyeditor_tgeometry_tauthfiles_tfranchisee_tmysimpleads_trevistas_tect
mov r10, rax
sub rbx, rax
movabs rdi, 0xe525982af70c880f
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
lea rcx, [r8 + 8]
mov rax, rdi
mul rcx
add r11d, 0xb
lea r9, [r9 + 0x16]
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 0xb
jb 0x140005020
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x61
mov dword [rbp - 0x20], 0x30000a
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x3c0026
mov dword [rbp - 0x18], 0x3f0020
mov dword [rbp - 0x14], 0x26004b
mov dword [rbp - 0x10], 0x370036
call fcn.140004fd0
mov rcx, rax
call 0x14000cec0
mov qword [0x1400161b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x65
mov dword [rbp - 0x20], 0x30000a
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x3c0026
mov dword [rbp - 0x18], 0x3f0020
mov dword [rbp - 0x14], 0x55003a
call fcn.1400022a0
mov rcx, rax
call 0x14000cec0
lea rcx, [rbp - 0x20]
mov qword [0x1400161a8], rax
mov dword [rbp - 0x20], 0x1002f
mov dword [rbp - 0x1c], 0x1e0010
mov dword [rbp - 0x18], 0x730009
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000cec0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000cf22
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.140009b70
test al, al
jne 0x14000cf34
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000cef0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400161c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x1d0012
mov dword [rbp - 0x1c], 0x1e0011
mov dword [rbp - 0x18], 0x400009
mov dword [rbp - 0x14], 0x49003b
mov dword [rbp - 0x10], 0x1e0001
mov dword [rbp - 0xc], 0x6c000d
call fcn.1400029c0
mov rcx, rax
call rbx
mov rbx, qword [0x1400161c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400161a0], rax
mov dword [rbp - 0x20], 0x1c0016
mov dword [rbp - 0x1c], 0x1b001a
mov dword [rbp - 0x18], 0x16000b
mov dword [rbp - 0x14], 0x49007d
mov dword [rbp - 0x10], 0x1e0001
mov dword [rbp - 0xc], 0x6c000d
call fcn.1400029c0
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x140014dd0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400161b0], rax
mov word [rbp - 0x10], 0x2212
mov byte [rbp - 0xe], 0x73
call fcn.140004620
mov rcx, qword [0x1400161a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140016130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x1e111d12
mov dword [rbp - 0x1c], 0x2713609
mov dword [rbp - 0x18], 0x9150706
mov word [rbp - 0x14], 0x933
call fcn.140001180
mov rcx, qword [0x1400161a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140016130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x17001b08
mov dword [rbp - 0x1c], 0x136c1d17
mov dword [rbp - 0x18], 0x204022a
mov word [rbp - 0x14], 0x925
call fcn.140001180
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140014eb0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160e8], rax
mov byte [rbp - 0x10], 0x64
call fcn.140004330
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140014d70]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160f0], rax
mov dword [rbp - 0x10], 0x74161900
call fcn.140002660
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140014df0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160e0], rax
mov byte [rbp - 0x10], 0x64
call fcn.140004330
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140014e60]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160d8], rax
mov dword [rbp - 0x10], 0x351d1a0d
mov byte [rbp - 0xc], 0x72
call fcn.140003130
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140014d90]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x340a
mov byte [rbp - 0xe], 0x73
call fcn.140004620
mov rcx, qword [0x1400161b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp rax
Function at 0x14000cec0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x61
mov dword [rbp - 0x20], 0x30000a
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x3c0026
mov dword [rbp - 0x18], 0x3f0020
mov dword [rbp - 0x14], 0x26004b
mov dword [rbp - 0x10], 0x370036
call fcn.140004fd0
mov rcx, rax
call 0x14000cec0
mov qword [0x1400161b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x65
mov dword [rbp - 0x20], 0x30000a
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x3c0026
mov dword [rbp - 0x18], 0x3f0020
mov dword [rbp - 0x14], 0x55003a
call fcn.1400022a0
mov rcx, rax
call 0x14000cec0
lea rcx, [rbp - 0x20]
mov qword [0x1400161a8], rax
mov dword [rbp - 0x20], 0x1002f
mov dword [rbp - 0x1c], 0x1e0010
mov dword [rbp - 0x18], 0x730009
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000cec0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000cf22
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.140009b70
test al, al
jne 0x14000cf34
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000cef0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18002e520
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov ebx, dword [rsp + 0xa8]
lea eax, [r9 + 0x244]
mov dword [rsp + 0x40], eax
mov r13d, r9d
mov r12, r8
mov rbp, rcx
cmp r9d, eax
jae 0x18002e58a
mov r15d, dword [rsp + 0xa8]
xor esi, esi
mov eax, r13d
sub eax, 0x52
je 0x18002e697
sub eax, 0x4b
je 0x18002e651
sub eax, 0x91
je 0x18002e5a4
cmp eax, 0x91
jne 0x18002e6e4
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 0x4b]
call fcn.180078510
test al, al
je 0x18002e6fb
mov rcx, qword [rbp + 0x28]
mov ebx, esi
call qword [rbp + 0x20]
test al, al
je 0x18002e61a
mov edi, 0xde
nop dword [rax]
mov eax, edi
sub eax, 0xdd
je 0x18002e5f6
cmp eax, 1
jne 0x18002e610
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdx, rbp
mov ecx, 0xf4
mov r15d, eax
call fcn.180029a40
jmp 0x18002e610
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
sub ecx, r15d
mul ecx
mov ebx, edx
shr ebx, 6
call qword [rbp + 0x50]
dec edi
cmp edi, 0xdc
ja 0x18002e5d0
mov rdx, qword [0x1800a9f08]
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea ecx, [r9 + 0x42]
mov qword [rsp + 0x20], rsi
call fcn.18002b160
mov rdx, qword [rsp + 0x98]
jmp 0x18002e6e4
mov r8, qword [0x1800a9f08]
mov edx, 0xd5
xor ecx, ecx
call fcn.18002c480
test al, al
je 0x18002e725
mov rdx, qword [0x1800a9f08]
lea r8, [rsp + 0xa8]
mov ecx, 0xf1
mov byte [rsp + 0xa8], 1
call fcn.18002e730
mov rdx, qword [rsp + 0x98]
jmp 0x18002e6e4
cmp qword [r12], 0
jbe 0x18002e6e2
mov r14, rbp
mov rdi, rdx
sub r14, rdx
nop word [rax + rax]
mov rax, qword [r14 + rdi]
lea r8, [rsp + 0x48]
mov edx, 0x5b
mov qword [rsp + 0x48], rax
xor ecx, ecx
call fcn.18002a6d0
mov qword [rdi], rax
lea rdi, [rdi + 8]
inc rsi
cmp rsi, qword [r12]
jb 0x18002e6b0
mov rdx, qword [rsp + 0x98]
xor esi, esi
add r13d, 0x91
cmp r13d, dword [rsp + 0x40]
jb 0x18002e563
jmp 0x18002e58a
mov rdx, qword [0x1800a9f08]
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea ecx, [r9 + 0x42]
mov qword [rsp + 0x20], rsi
call fcn.18002b160
mov eax, esi
jmp 0x18002e58c