joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003f860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, r8
mov r12, rdx
mov r15, rcx
xor esi, esi
mov r14, qword [r15 + 0x20]
lea rcx, [rbp - 0x40]
xor ebx, ebx
mov word [rbp - 0x3b], 0x3233
mov dword [rbp - 0x40], 0x70797243
mov dword [rbp - 0x38], 0x6c6c64
mov byte [rbp - 0x39], 0x2e
mov byte [rbp - 0x3c], 0x74
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14003f92c
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x24], 0x63696669
mov rcx, rax
mov dword [rbp - 0x28], 0x74726543
mov word [rbp - 0x2a], 0x6d75
mov dword [rbp - 0x18], 0x65726f
mov dword [rbp - 0x1e], 0x6e497365
mov word [rbp - 0x30], 0x6543
mov word [rbp - 0x2d], 0x4574
mov byte [rbp - 0x2e], 0x72
mov word [rbp - 0x1a], 0x7453
mov word [rbp - 0x20], 0x7461
mov byte [rbp - 0x2b], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003f923
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, rbx
test rbx, rbx
je 0x14003f94d
mov rdx, r13
mov rcx, rbx
call r12
test al, al
jne 0x14003f890
mov rcx, rbx
call fcn.14003d3c0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140046880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, qword [rbp + 0x68]
mov rsi, r8
mov r15, rdx
xor ebx, ebx
mov r8b, 1
xor edx, edx
mov rdi, r9
mov r12, rcx
mov qword [r13], rbx
mov r14d, ebx
call fcn.14002c000
test rax, rax
js 0x140046a14
test rax, rax
movabs rcx, 0x7fffffffffffffff
cmove rax, rcx
cmp r15, 0xffffffffffffffff
jne 0x1400468f1
mov rcx, rax
call fcn.140049430
mov edx, eax
jmp 0x140046939
mov r8, rax
mov qword [rbp - 0x58], r15
mov edx, 1
mov dword [rbp - 0x50], 0x700
lea rcx, [rbp - 0x58]
call fcn.1400495f0
test eax, eax
jle 0x140046a0d
movzx ecx, word [rbp - 0x4e]
mov eax, 0x303
test ax, cx
mov edx, 0x604
mov eax, ebx
setne al
and cx, dx
mov edx, eax
or edx, 4
test cx, cx
cmove edx, eax
test edx, edx
jle 0x140046a0d
lea rcx, [rbp - 0x20]
mov word [rbp - 0x1e], 0x5f32
mov ebx, 0xffffffff
mov word [rbp - 0x1b], 0x2e32
mov word [rbp - 0x20], 0x7357
mov word [rbp - 0x18], 0x6c6c
mov byte [rbp - 0x1c], 0x33
mov byte [rbp - 0x16], 0
mov byte [rbp - 0x19], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140046988
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400469ba
lea rdx, [rbp - 0x28]
mov word [rbp - 0x25], 0x76
mov rcx, rax
mov word [rbp - 0x28], 0x6572
mov byte [rbp - 0x26], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400469ba
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, r15
call rax
mov ebx, eax
movsxd rax, ebx
cmp rax, 0xffffffffffffffff
jne 0x1400469d6
call fcn.14002b460
cmp eax, 0x2733
je 0x1400469e8
mov eax, 0x38
jmp 0x140046a19
cmp rdi, rax
je 0x140046a01
test ebx, ebx
je 0x140046a0d
sub rdi, rax
add rsi, rax
add r14, rax
mov r8b, 1
xor edx, edx
mov rcx, r12
call fcn.14002c000
test rax, rax
js 0x140046a14
xor ebx, ebx
jmp 0x1400468ce
lea rcx, [rax + r14]
xor eax, eax
mov qword [r13], rcx
jmp 0x140046a19
mov eax, 0xffffffff
jmp 0x140046a19
mov eax, 0x1c
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400493a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.140024690
test rax, rax
je 0x14004940f
lea rdx, [rsp + 0x20]
mov word [rsp + 0x28], 0x7473
mov rcx, rax
mov word [rsp + 0x2e], 0x72
mov dword [rsp + 0x21], 0x65534153
mov word [rsp + 0x2b], 0x7272
mov word [rsp + 0x26], 0x614c
mov byte [rsp + 0x20], 0x57
mov byte [rsp + 0x2d], 0x6f
mov byte [rsp + 0x25], 0x74
mov byte [rsp + 0x2a], 0x45
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004940f
mov ecx, 0x2726
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x48
ret

Function at 0x140049430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
test rcx, rcx
je 0x1400494d5
test rcx, rcx
jns 0x140049473
call fcn.1400493a0
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x40
pop rbx
ret
mov eax, 0xffffffff
mov dword [rsp + 0x21], 0x7065656c
cmp rbx, rax
mov byte [rsp + 0x20], 0x53
mov ecx, 0xfffffffe
mov byte [rsp + 0x25], 0
cmovge rbx, rcx
mov dword [rsp + 0x30], 0x6c6c642e
lea rcx, [rsp + 0x28]
mov dword [rsp + 0x2c], 0x32336c65
mov dword [rsp + 0x28], 0x6e72654b
mov byte [rsp + 0x34], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400494d5
mov ecx, ebx
call rax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x40
pop rbx
ret
Function at 0x14004fc40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1400cea10], 0
mov rdi, rcx
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x38], 0x6c6c642e
mov dword [rbp - 0x3c], 0x32336c65
mov dword [rbp - 0x40], 0x6e72654b
je 0x14004fd06
mov dword [rbp - 0x20], 0x72657551
mov dword [rbp - 0x16], 0x6e616d72
mov dword [rbp - 0x1b], 0x66726550
mov word [rbp - 0xe], 0x6e75
mov dword [rbp - 0x12], 0x6f436563
mov word [rbp - 0xb], 0x7265
mov byte [rbp - 9], 0
mov byte [rbp - 0x1c], 0x79
mov byte [rbp - 0xc], 0x74
mov byte [rbp - 0x17], 0x6f
mov byte [rbp - 0x34], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004fcde
lea rcx, [rbp - 0x30]
call rax
mov rax, qword [rbp - 0x30]
cqo
idiv qword [0x1400cea08]
mov r8, rax
imul rax, rdx, 0xf4240
cqo
idiv qword [0x1400cea08]
mov dword [rdi + 8], eax
mov qword [rdi], r8
jmp 0x14004fd70
mov qword [rsp + 0x70], rbx
xor ebx, ebx
mov byte [rbp - 0x34], bl
mov dword [rbp - 0x2c], 0x436b6369
mov dword [rbp - 0x30], 0x54746547
mov word [rbp - 0x25], 0x74
mov word [rbp - 0x28], 0x756f
mov byte [rbp - 0x26], 0x6e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004fd4a
call rax
mov ebx, eax
mov eax, 0x10624dd3
mul ebx
shr edx, 6
imul ecx, edx, 0x3e8
mov r8d, edx
sub ebx, ecx
imul eax, ebx, 0x3e8
mov dword [rdi + 8], eax
mov qword [rdi], r8
mov rbx, qword [rsp + 0x70]
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret

Function at 0x14004fed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ebx, ecx
mov word [rbp - 0x1b], 0x7473
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x1f], 0x614c7465
mov dword [rbp - 0x18], 0x726f7272
mov byte [rbp - 0x20], 0x53
mov byte [rbp - 0x19], 0x45
mov byte [rbp - 0x14], 0
mov dword [rbp - 0x28], 0x6c6c642e
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x30], 0x6e72654b
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004ff46
mov ecx, ebx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140050920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
mov word [rbp - 0x26], 0x5f32
test edx, edx
mov word [rbp - 0x23], 0x2e32
mov rbx, rcx
mov word [rbp - 0x28], 0x7357
setne al
mov word [rbp - 0x20], 0x6c6c
lea rcx, [rbp - 0x28]
mov dword [rbp - 0x30], eax
mov byte [rbp - 0x24], 0x33
mov byte [rbp - 0x1e], 0
mov byte [rbp - 0x21], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14005098a
lea rcx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400509c1
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x10], 0x74656b
mov rcx, rax
mov dword [rbp - 0x18], 0x74636f69
mov dword [rbp - 0x14], 0x636f736c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400509c1
lea r8, [rbp - 0x30]
mov edx, 0x8004667e
mov rcx, rbx
call rax
jmp 0x1400509c6
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x140050c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov rdi, rdx
lea rcx, [rbp - 0x60]
call fcn.14004fc40
mov rcx, rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
call case.0x14002e419.0
mov rcx, rdi
mov rsi, rax
call case.0x14002e419.0
mov edi, dword [rbp - 0x10]
mov rbx, rax
mov r14, qword [rbp - 0x18]
movabs r15, 0x20c49ba5e353f6
movabs r12, 0x4189374bc6a7ec
lea rcx, [rbp - 0x28]
mov byte [rbp - 0x3e], 0x76
mov byte [rbp - 0x36], 0x41
mov word [rbp - 0x40], 0x6f4d
mov word [rbp - 0x3d], 0x4665
mov dword [rbp - 0x3a], 0x7845656c
mov byte [rbp - 0x35], 0
mov byte [rbp - 0x3b], 0x69
mov dword [rbp - 0x20], 0x6c6c642e
mov dword [rbp - 0x24], 0x32336c65
mov dword [rbp - 0x28], 0x6e72654b
mov byte [rbp - 0x1c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140050d5f
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call rax
test eax, eax
jne 0x140050e04
lea rcx, [rbp - 0x50]
call fcn.14004fc40
movups xmm0, xmmword [rax]
movq r8, xmm0
movaps xmmword [rbp - 0x60], xmm0
sub r8, r14
lea rax, [r8 + r15]
cmp rax, r12
ja 0x140050e22
mov ecx, dword [rbp - 0x58]
mov eax, 0x10624dd3
sub ecx, edi
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul rax, r8, 0x3e8
movsxd rcx, edx
add rcx, rax
cmp rcx, 0x3e8
ja 0x140050e22
lea rcx, [rbp - 0x18]
mov dword [rbp - 0x2f], 0x7065656c
mov byte [rbp - 0x30], 0x53
mov byte [rbp - 0x2b], 0
mov dword [rbp - 0x10], 0x6c6c642e
mov dword [rbp - 0x14], 0x32336c65
mov dword [rbp - 0x18], 0x6e72654b
mov byte [rbp - 0xc], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140050cf1
mov ecx, 1
call rax
jmp 0x140050cf1
test rsi, rsi
je 0x140050e11
mov rcx, rsi
call fcn.14006baa8
test rbx, rbx
je 0x140050e1e
mov rcx, rbx
call fcn.14006baa8
xor eax, eax
jmp 0x140050e41
test rsi, rsi
je 0x140050e2f
mov rcx, rsi
call fcn.14006baa8
test rbx, rbx
je 0x140050e3c
mov rcx, rbx
call fcn.14006baa8
mov eax, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400567a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r15
lea rbp, [r11 - 0x198]
sub rsp, 0x278
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor sil, sil
mov r15, rdx
mov rdi, rcx
test rcx, rcx
je 0x140056975
mov qword [r11 + 0x20], r12
mov r8, rcx
xor r12d, r12d
mov qword [r11 - 0x28], r14
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea edx, [r12 + 8]
call fcn.14003b480
movsxd r14, eax
test eax, eax
jle 0x140056965
mov rcx, r14
mov qword [rsp + 0x2b0], rbx
add rcx, rcx
call fcn.14006bcf0
mov rbx, rax
test rax, rax
je 0x14005695d
mov dword [rsp + 0x28], r14d
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.14003b480
test eax, eax
jne 0x14005684a
mov rcx, rbx
call fcn.14006baa8
jmp 0x14005695d
lea rcx, [rsp + 0x50]
mov word [rsp + 0x58], 0x642e
mov r14d, r12d
mov dword [rsp + 0x52], 0x6c616d72
mov word [rsp + 0x50], 0x6f4e
mov word [rsp + 0x5b], 0x6c
mov word [rsp + 0x56], 0x7a69
mov byte [rsp + 0x5a], 0x6c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400568e7
lea rdx, [rsp + 0x40]
mov word [rsp + 0x40], 0x6449
mov rcx, rax
mov dword [rsp + 0x43], 0x73416f54
mov word [rsp + 0x48], 0x6969
mov byte [rsp + 0x4a], sil
mov byte [rsp + 0x47], 0x63
mov byte [rsp + 0x42], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400568de
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 0xff
mov r8d, 0xffffffff
mov rdx, rbx
xor ecx, ecx
call rax
mov r14d, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.14006baa8
test r14d, r14d
je 0x14005695d
mov dword [rsp + 0x28], r12d
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], r12
call fcn.14003b390
movsxd rdi, eax
test eax, eax
jle 0x14005695d
mov rcx, rdi
call fcn.14006bcf0
mov rbx, rax
test rax, rax
je 0x14005695d
mov dword [rsp + 0x28], edi
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.14003b390
mov rcx, rbx
test eax, eax
je 0x140056840
call qword [case.0x14002e419.0]
mov rcx, rbx
mov qword [r15], rax
call fcn.14006baa8
cmp qword [r15], r12
mov eax, 1
movzx esi, sil
cmovne esi, eax
mov rbx, qword [rsp + 0x2b0]
mov r12, qword [rsp + 0x2b8]
mov r14, qword [rsp + 0x270]
movzx eax, sil
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x278
pop r15
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400569a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov word [rbp - 0x2b], 0x6148
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x28], 0x656c64
mov dword [rbp - 0x30], 0x736f6c43
mov byte [rbp - 0x29], 0x6e
mov byte [rbp - 0x2c], 0x65
mov dword [rbp - 0x18], 0x6c6c642e
mov dword [rbp - 0x1c], 0x32336c65
mov dword [rbp - 0x20], 0x6e72654b
mov byte [rbp - 0x14], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140056a14
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x140056a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, qword [rcx]
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x13], 0x656a624f
mov edi, 0xffffffff
mov word [rbp - 0xc], 0x78
mov word [rbp - 0x19], 0x6953
mov word [rbp - 0x1f], 0x6961
mov word [rbp - 0x1c], 0x6f46
mov word [rbp - 0xf], 0x7463
mov dword [rbp - 0x17], 0x656c676e
mov byte [rbp - 0xd], 0x45
mov byte [rbp - 0x20], 0x57
mov byte [rbp - 0x1d], 0x74
mov byte [rbp - 0x1a], 0x72
mov dword [rbp - 0x28], 0x6c6c642e
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x30], 0x6e72654b
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140056add
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call rax
mov edi, eax
mov rcx, qword [rbx]
call fcn.1400569a0
xor eax, eax
test edi, edi
mov qword [rbx], rax
sete al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x14005d160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x60
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r15d, r15d
mov dword [rsp + 0x20], r8d
xor edi, edi
mov qword [rsp + 0x28], rdx
mov r12, rdx
mov r13, rcx
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
cmp byte [rdx + rsi + 1], dil
lea rsi, [rsi + 1]
jne 0x14005d1a0
test r13, r13
jne 0x14005d1b7
xor eax, eax
jmp 0x14005d33c
mov qword [rsp + 0x58], rbp
xor ebp, ebp
cmp dword [rcx + 0x260], edi
jle 0x14005d334
mov qword [rsp + 0x50], r14
lea r14, [rcx + 0x84]
mov qword [rsp + 0x90], rbx
nop
cmp dword [r14 - 4], 0x1c
je 0x14005d2ee
lea rdx, [rsi + 0x41]
mov ecx, 1
call qword [fcn.14006da94]
mov rbx, rax
test rax, rax
je 0x14005d303
lea rcx, [rax + 0x30]
mov rdx, r12
mov qword [rax + 0x20], rcx
lea r8, [rsi + 1]
add rcx, 0x10
mov qword [rax + 0x18], rcx
call fcn.140062140
test rdi, rdi
cmove rdi, rbx
test r15, r15
je 0x14005d232
mov qword [r15 + 0x28], rbx
mov r12, qword [rbx + 0x20]
mov ecx, 2
movzx r15d, word [rsp + 0x20]
mov dword [rbx + 4], ecx
mov dword [rbx + 8], 1
mov dword [rbx + 0x10], 0x10
mov eax, dword [r14]
mov word [r12], cx
lea rcx, [rsp + 0x30]
mov dword [r12 + 4], eax
mov word [rsp + 0x32], 0x5f32
mov word [rsp + 0x35], 0x2e32
mov word [rsp + 0x30], 0x7357
mov word [rsp + 0x38], 0x6c6c
mov byte [rsp + 0x34], 0x33
mov byte [rsp + 0x3a], 0
mov byte [rsp + 0x37], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14005d2aa
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14005d2e0
lea rdx, [rsp + 0x40]
mov word [rsp + 0x41], 0x6f74
mov rcx, rax
mov word [rsp + 0x44], 0x73
mov byte [rsp + 0x40], 0x68
mov byte [rsp + 0x43], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005d2e0
movzx ecx, word [rsp + 0x20]
call rax
movzx r15d, ax
mov word [r12 + 2], r15w
mov r15, rbx
mov r12, qword [rsp + 0x28]
inc ebp
add r14, 0x14
cmp ebp, dword [r13 + 0x260]
jl 0x14005d1e0
jmp 0x14005d327
test rdi, rdi
je 0x14005d325
nop dword [rax + rax]
mov rbx, qword [rdi + 0x28]
mov rcx, rdi
call qword [fcn.14006baa8]
mov rdi, rbx
test rbx, rbx
jne 0x14005d310
xor edi, edi
mov rbx, qword [rsp + 0x90]
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rax, rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x60
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14005f6c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov dword [rbp - 0x30], 0x61766441
lea rcx, [rbp - 0x30]
mov word [rbp - 0x28], 0x642e
mov r15, r9
mov dword [rbp - 0x2c], 0x32336970
mov r14, r8
mov word [rbp - 0x25], 0x6c
xor ebx, ebx
mov byte [rbp - 0x26], 0x6c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14005f774
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x14], 0x61726150
mov rcx, rax
mov dword [rbp - 0x20], 0x70797243
mov dword [rbp - 0x1b], 0x48746547
mov word [rbp - 0x10], 0x6d
mov word [rbp - 0x17], 0x7361
mov byte [rbp - 0x15], 0x68
mov byte [rbp - 0x1c], 0x74
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005f76b
mov r9, r15
mov dword [rsp + 0x20], ebx
mov r8, r14
lea edx, [rbx + 2]
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005f7a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
mov dword [rbp - 0x30], 0x61766441
lea rcx, [rbp - 0x30]
mov word [rbp - 0x28], 0x642e
xor esi, esi
mov dword [rbp - 0x2c], 0x32336970
mov word [rbp - 0x25], 0x6c
mov byte [rbp - 0x26], 0x6c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14005f8fb
lea rdx, [rbp - 0x20]
mov word [rbp - 0x17], 0x7269
mov rcx, rax
mov dword [rbp - 0x14], 0x746e6f43
mov dword [rbp - 0xf], 0x417478
mov dword [rbp - 0x1c], 0x71634174
mov dword [rbp - 0x20], 0x70797243
mov byte [rbp - 0x10], 0x65
mov byte [rbp - 0x15], 0x65
mov byte [rbp - 0x18], 0x75
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005f856
lea r9d, [rsi + 0x18]
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call rax
mov esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x14005f8fb
mov rsi, qword [rdi]
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x61766441
mov word [rbp - 0x28], 0x642e
mov dword [rbp - 0x2c], 0x32336970
mov word [rbp - 0x25], 0x6c
mov byte [rbp - 0x26], 0x6c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14005f8fb
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1d], 0x7470
mov rcx, rax
mov word [rbp - 0x15], 0x6148
mov word [rbp - 0x20], 0x7243
mov dword [rbp - 0x1b], 0x61657243
mov word [rbp - 0x12], 0x68
mov byte [rbp - 0x13], 0x73
mov byte [rbp - 0x1e], 0x79
mov word [rbp - 0x17], 0x6574
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005f8f2
lea rdx, [rdi + 8]
xor r9d, r9d
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov edx, 0x800c
mov rcx, rsi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140060fb0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14005f920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, qword [rcx + 8]
mov esi, r8d
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x61766441
mov rdi, rdx
mov word [rbp - 0x28], 0x642e
mov dword [rbp - 0x2c], 0x32336970
mov word [rbp - 0x25], 0x6c
mov byte [rbp - 0x26], 0x6c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14005f9c6
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1a], 0x7361
mov rcx, rax
mov dword [rbp - 0x20], 0x70797243
mov word [rbp - 0x17], 0x6144
mov word [rbp - 0x1c], 0x4874
mov word [rbp - 0x14], 0x61
mov byte [rbp - 0x18], 0x68
mov byte [rbp - 0x15], 0x74
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005f9bd
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret