joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d35c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x70]
mov r12, r9
mov r13, qword [rbp + 0x68]
mov r15, r8
mov qword [rbp - 0x38], rax
mov r14, rdx
mov rsi, rcx
mov edi, 1
call fcn.1400145ec
mov rbx, rax
test rax, rax
je 0x14000d414
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x2a], 0x61567972
mov rcx, rax
mov word [rbp - 0x22], 0x4178
mov word [rbp - 0x2c], 0x6575
mov word [rbp - 0x2f], 0x6765
mov word [rbp - 0x25], 0x6575
mov byte [rbp - 0x20], 0
mov byte [rbp - 0x30], 0x52
mov byte [rbp - 0x23], 0x45
mov byte [rbp - 0x2d], 0x51
mov byte [rbp - 0x26], 0x6c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d40b
mov rcx, qword [rbp - 0x38]
mov r9, r12
mov qword [rsp + 0x28], rcx
mov r8, r15
mov rcx, rsi
mov qword [rsp + 0x20], r13
mov rdx, r14
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140058060
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14000d43c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, qword [rbp + 0x68]
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rsi, rcx
mov edi, 0x80004005
call fcn.1400146a4
mov rbx, rax
test rax, rax
je 0x14000d4d7
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x20], 0x50726564
mov rcx, rax
mov dword [rbp - 0x1b], 0x416874
mov dword [rbp - 0x28], 0x65474853
mov word [rbp - 0x23], 0x6f46
mov byte [rbp - 0x21], 0x6c
mov byte [rbp - 0x24], 0x74
mov byte [rbp - 0x1c], 0x61
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d4ce
mov r9d, r12d
mov qword [rsp + 0x20], r13
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000d4fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r15d, r9d
mov r14d, r8d
mov rsi, rdx
mov rdi, rcx
call fcn.1400145ec
mov rbx, rax
test rax, rax
je 0x14000d5b0
lea rdx, [rbp - 0x38]
mov word [rbp - 0x21], 0x614e
mov rcx, rax
mov word [rbp - 0x1e], 0x4165
mov dword [rbp - 0x2c], 0x63634174
mov word [rbp - 0x26], 0x5773
mov byte [rbp - 0x1c], 0
mov dword [rbp - 0x38], 0x6c697542
mov dword [rbp - 0x32], 0x696c7078
mov byte [rbp - 0x1f], 0x6d
mov word [rbp - 0x23], 0x6874
mov byte [rbp - 0x24], 0x69
mov word [rbp - 0x28], 0x7365
mov word [rbp - 0x2e], 0x6963
mov word [rbp - 0x34], 0x4564
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d5a7
mov r10d, dword [rbp + 0x58]
mov r9d, r15d
mov r8d, r14d
mov dword [rsp + 0x20], r10d
mov rdx, rsi
mov rcx, rdi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140058060
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14000d5d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.1400145ec
mov rdi, rax
test rax, rax
je 0x14000d661
lea rdx, [rbp - 0x20]
mov word [rbp - 0xf], 0x536f
mov rcx, rax
mov dword [rbp - 0x14], 0x64695367
mov dword [rbp - 0x18], 0x6e697274
mov dword [rbp - 0xd], 0x416469
mov dword [rbp - 0x1c], 0x53747265
mov word [rbp - 0x1f], 0x6e6f
mov byte [rbp - 0x10], 0x54
mov byte [rbp - 0x1d], 0x76
mov byte [rbp - 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d658
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140058060
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x14000d688
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x70]
mov r12, r9
mov r13, qword [rbp + 0x68]
mov r15, r8
mov qword [rbp - 0x30], rax
mov r14, rdx
mov rax, qword [rbp + 0x78]
mov rsi, rcx
mov qword [rbp - 0x38], rax
xor ebx, ebx
call fcn.1400145ec
mov rdi, rax
test rax, rax
je 0x14000d743
lea rdx, [rbp - 0x28]
mov word [rbp - 0x19], 0x4164
mov rcx, rax
mov byte [rbp - 0x17], bl
mov dword [rbp - 0x1e], 0x53746e75
mov dword [rbp - 0x22], 0x6f636341
mov dword [rbp - 0x28], 0x6b6f6f4c
mov word [rbp - 0x24], 0x7075
mov byte [rbp - 0x1a], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d73a
mov rcx, qword [rbp - 0x38]
mov r9, r12
mov qword [rsp + 0x30], rcx
mov r8, r15
mov rcx, qword [rbp - 0x30]
mov rdx, r14
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov qword [rsp + 0x20], r13
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14000d768
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15d, r8d
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.1400145ec
mov rdi, rax
test rax, rax
je 0x14000d7e8
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x614d4353
mov rcx, rax
mov dword [rbp - 0x18], 0x6567616e
mov word [rbp - 0x14], 0x4172
mov dword [rbp - 0x20], 0x6e65704f
mov byte [rbp - 0x12], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d7df
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d814
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, qword [rbp + 0x70]
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
call fcn.1400145ec
mov rdi, rax
test rax, rax
je 0x14000d8b7
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x1e], 0x6e656b6f
mov rcx, rax
mov dword [rbp - 0x27], 0x696c7075
mov dword [rbp - 0x23], 0x65746163
mov word [rbp - 0x19], 0x78
mov byte [rbp - 0x1f], 0x54
mov byte [rbp - 0x1a], 0x45
mov byte [rbp - 0x28], 0x44
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x14000d8ae
mov eax, dword [rbp + 0x68]
mov r9d, r12d
mov qword [rsp + 0x28], r13
mov r8, r15
mov edx, r14d
mov dword [rsp + 0x20], eax
mov rcx, rsi
call r10
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14000d994
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.14008c2cc
mov rdi, rax
test rax, rax
je 0x14000da19
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x15], 0x416575
mov rcx, rax
mov dword [rbp - 0x20], 0x51726556
mov dword [rbp - 0x1a], 0x61567972
mov word [rbp - 0x1c], 0x6575
mov byte [rbp - 0x16], 0x6c
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000da10
mov r9, r12
mov r8, r15
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14000dae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r12d, dword [rbp + 0x68]
xor ebx, ebx
mov r13, qword [rbp + 0x70]
mov r15, r9
mov byte [rbp - 0x1c], bl
mov r14, r8
mov rsi, rdx
mov dword [rbp - 0x23], 0x72685465
mov rdi, rcx
mov word [rbp - 0x25], 0x7461
mov word [rbp - 0x1e], 0x6461
mov word [rbp - 0x28], 0x7243
mov byte [rbp - 0x1f], 0x65
mov byte [rbp - 0x26], 0x65
call fcn.14000655c
mov rcx, rax
lea rdx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000db6e
mov qword [rsp + 0x28], r13
mov r9, r15
mov r8, r14
mov dword [rsp + 0x20], r12d
mov rdx, rsi
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140058060
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000db94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov dword [rbp - 0x20], 0x4c746547
mov byte [rbp - 0x14], bl
mov dword [rbp - 0x1b], 0x72457473
mov word [rbp - 0x16], 0x726f
mov byte [rbp - 0x17], 0x72
mov byte [rbp - 0x1c], 0x61
call fcn.14000655c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000dbeb
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000e120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor ebx, ebx
mov dword [rbp + 0x39], 0x65727275
lea r9, [rbp - 0x11]
mov dword [rbp + 0x31], 0x4e207377
lea r8, [rbp - 9]
mov word [rbp + 0x1f], 0x5c5c
lea rdx, [rbp + 0x17]
mov word [rbp + 0x22], 0x6369
lea eax, [rbx + 4]
mov word [rbp + 0x42], 0x6973
mov dword [rbp - 0x11], eax
mov rcx, 0xffffffff80000002
mov dword [rbp - 0x19], eax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x15]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x3e], 0x72655674
mov word [rbp + 0x2a], 0x5c5c
mov word [rbp + 0x1a], 0x5754
mov dword [rbp + 0x2d], 0x6f646e69
mov word [rbp + 0x45], 0x6e
mov dword [rbp + 0x25], 0x666f736f
mov byte [rbp + 0x24], 0x72
mov word [rbp + 0x36], 0x5c5c
mov word [rbp + 0x17], 0x4f53
mov byte [rbp + 0x3d], 0x6e
mov byte [rbp + 0x35], 0x54
mov word [rbp + 0x1d], 0x4552
mov byte [rbp + 0x29], 0x74
mov byte [rbp + 0x19], 0x46
mov byte [rbp + 0x21], 0x4d
mov byte [rbp + 0x44], 0x6f
mov byte [rbp + 0x1c], 0x41
mov byte [rbp + 0x2c], 0x57
mov byte [rbp + 0x38], 0x43
mov dword [rbp - 1], 0x726f6a61
mov word [rbp + 0xf], 0x72
mov word [rbp - 9], 0x7543
mov word [rbp - 6], 0x6572
mov word [rbp - 3], 0x4d74
mov word [rbp + 0xc], 0x626d
mov dword [rbp + 5], 0x6f697372
mov word [rbp + 9], 0x4e6e
mov byte [rbp - 4], 0x6e
mov word [rbp + 3], 0x6556
mov byte [rbp - 7], 0x72
mov byte [rbp + 0xb], 0x75
mov byte [rbp + 0xe], 0x65
mov dword [rbp - 0x15], ebx
call fcn.140014a10
test eax, eax
movzx ecx, bl
lea edx, [rbx + 1]
cmove ecx, edx
mov al, cl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140058060
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
Function at 0x1400122a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], rdx
mov word [rsp + 0x21], 0x312e
mov byte [rsp + 0x23], 0
mov byte [rsp + 0x20], 0x35
lea rdx, [rsp + 0x20]
mov rcx, qword [r14]
call fcn.140063d78
neg eax
sbb ebx, ebx
and ebx, 8
mov dword [rsp + 0x24], 0x322e35
lea rdx, [rsp + 0x24]
mov rcx, qword [r14]
call fcn.140063d78
mov edi, 1
test eax, eax
cmove ebx, edi
mov word [rsp + 0x29], 0x302e
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x28], 0x36
lea rdx, [rsp + 0x28]
mov rcx, qword [r14]
call fcn.140063d78
lea ecx, [rdi + 1]
test eax, eax
cmove ebx, ecx
mov dword [rsp + 0x2c], 0x312e36
lea rdx, [rsp + 0x2c]
mov rcx, qword [r14]
call fcn.140063d78
lea ecx, [rdi + 2]
test eax, eax
cmove ebx, ecx
mov word [rsp + 0x31], 0x322e
mov byte [rsp + 0x30], 0x36
mov byte [rsp + 0x33], 0
lea rdx, [rsp + 0x30]
mov rcx, qword [r14]
call fcn.140063d78
lea r13d, [rdi + 3]
test eax, eax
cmove ebx, r13d
mov word [rsp + 0x35], 0x332e
mov byte [rsp + 0x37], 0
mov byte [rsp + 0x34], 0x36
lea rdx, [rsp + 0x34]
mov rcx, qword [r14]
call fcn.140063d78
lea ecx, [rdi + 4]
test eax, eax
cmove ebx, ecx
mov dword [rsp + 0x41], 0x302e30
mov byte [rsp + 0x40], 0x31
lea rdx, [rsp + 0x40]
mov rcx, qword [r14]
call fcn.140063d78
lea r12d, [rdi + 5]
test eax, eax
jne 0x1400123e6
mov ebx, r12d
jmp 0x1400123ee
test ebx, ebx
je 0x1400123f1
cmp ebx, edi
je 0x1400123f1
xor dil, dil
mov cl, dil
call fcn.14000b318
cmp eax, r13d
jne 0x140012405
cmp ebx, r12d
cmovne ebx, r12d
lea ebx, [rax + rbx*4]
mov edi, 0x400
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14005a5d0
mov dword [rsp + 0x48], 0x31333138
mov word [rsp + 0x4c], 0x6425
mov byte [rsp + 0x4e], 0
lea r9d, [rbx + 0x27]
lea r8, [rsp + 0x48]
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140055aa0
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140050e54
nop
mov rdx, qword [r14]
sub rdx, 0x18
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140012471
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, rsi
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140058060
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x14001251c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rdi
push r12
push r15
lea rbp, [rsp - 0x1040]
mov eax, 0x1140
call fcn.140058680
sub rsp, rax
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp + 0x1030], rax
movsxd rdi, r8d
mov rbx, rcx
mov qword [rbp + 0x418], rcx
and qword [rsp + 0x48], 0
and qword [rsp + 0x58], 0
mov r15d, 0xf
mov qword [rsp + 0x60], r15
mov byte [rsp + 0x48], 0
lea rcx, [rsp + 0x48]
call fcn.14004ddf8
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.140017358
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400125cb
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400125c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400127d8
call fcn.1400580c4
and qword [rsp + 0x58], 0
mov qword [rsp + 0x60], r15
mov byte [rsp + 0x48], 0
mov r12d, 0x400
mov r8d, r12d
xor edx, edx
lea rcx, [rbp + 0x430]
call fcn.14005a5d0
xor r9d, r9d
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
sub r8, rdx
je 0x140012628
lea rcx, [rbp + 0x430]
lea rax, [rbp + 0x430]
sub rdx, rax
mov al, byte [rdx + rcx]
mov byte [rcx], al
inc r9d
inc rcx
movsxd rax, r9d
cmp rax, r8
jb 0x140012615
mov r8, r12
xor edx, edx
lea rcx, [rbp + 0xc30]
call fcn.14005a5d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x418], xmm0
mov r8, r12
xor edx, edx
lea rcx, [rbp + 0x830]
call fcn.14005a5d0
mov word [rbp + 0x40e], 0x3939
mov dword [rbp + 0x3f0], 0x37383843
mov dword [rbp + 0x3ff], 0x42324436
mov dword [rbp + 0x3f5], 0x44433234
mov word [rbp + 0x408], 0x4342
mov dword [rbp + 0x403], 0x42413436
mov word [rbp + 0x3fc], 0x3945
mov word [rbp + 0x3f9], 0x4132
mov byte [rbp + 0x410], 0
mov byte [rbp + 0x3fb], 0x37
mov byte [rbp + 0x3f4], 0x44
mov word [rbp + 0x40b], 0x3836
mov byte [rbp + 0x40a], 0x46
mov byte [rbp + 0x407], 0x43
mov byte [rbp + 0x3fe], 0x46
mov byte [rbp + 0x40d], 0x46
lea r8, [rbp + 0x3f0]
mov rdx, r12
lea rcx, [rbp + 0x830]
call fcn.1400632b0
lea rcx, [rsp + 0x70]
call fcn.140017e24
nop
mov dword [rsp + 0x20], 0x10
mov r9d, 0x20
lea r8, [rbp + 0x418]
lea rdx, [rbp + 0x830]
lea rcx, [rsp + 0x70]
call fcn.14000c3d4
mov r9, qword [rsp + 0x38]
sub r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], 1
lea r8, [rbp + 0xc30]
lea rdx, [rbp + 0x430]
lea rcx, [rsp + 0x70]
call fcn.140006250
and qword [rbx], 0
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], r15
mov byte [rbx], 0
lea rdx, [rbp + 0xc30]
add rdx, rdi
mov rcx, rbx
call fcn.14004ddf8
nop
lea rcx, [rsp + 0x70]
call fcn.14000c3c0
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400127b1
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400127ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400127d2
call fcn.1400580c4
mov rax, rbx
mov rcx, qword [rbp + 0x1030]
xor rcx, rsp
call fcn.140058060
add rsp, 0x1140
pop r15
pop r12
pop rdi
pop rbx
pop rbp
ret
call fcn.14005e72c
nop
call fcn.14005e72c
nop
int3
Function at 0x1400145ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x6c6c642e
mov word [rbp - 0x1c], 0x6970
mov word [rbp - 0x1f], 0x7664
mov byte [rbp - 0x14], 0
mov word [rbp - 0x1a], 0x3233
mov byte [rbp - 0x20], 0x41
mov byte [rbp - 0x1d], 0x61
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
add rsp, 0x40
pop rbp
ret

Function at 0x1400146a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
mov word [rbp - 0x1f], 0x6568
mov byte [rbp - 0x20], 0x53
mov word [rbp - 0x16], 0x6c
mov word [rbp - 0x1c], 0x336c
mov word [rbp - 0x19], 0x642e
mov byte [rbp - 0x17], 0x6c
mov byte [rbp - 0x1d], 0x6c
mov byte [rbp - 0x1a], 0x32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
add rsp, 0x40
pop rbp
ret

Function at 0x140014794
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov word [rbp - 0x15], 0x7478
mov byte [rbp - 0x13], bl
mov rsi, rdx
mov rdi, rcx
mov dword [rbp - 0x1f], 0x65636f72
mov dword [rbp - 0x1a], 0x4e323373
mov byte [rbp - 0x20], 0x50
mov byte [rbp - 0x1b], 0x73
mov byte [rbp - 0x16], 0x65
call fcn.14000655c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400147fd
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140014820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov word [rbp - 0x19], 0x6d65
mov word [rbp - 0x16], 0x6d69
mov dword [rbp - 0xe], 0x6d695465
mov word [rbp - 0xa], 0x65
mov word [rbp - 0x1b], 0x7473
mov dword [rbp - 0x20], 0x53746547
mov dword [rbp - 0x13], 0x69467341
mov byte [rbp - 0x14], 0x65
mov byte [rbp - 0x17], 0x54
mov byte [rbp - 0x1c], 0x79
mov byte [rbp - 0xf], 0x6c
call fcn.14000655c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014897
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140058060
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x1400148b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14d, edx
mov rsi, rcx
xor ebx, ebx
call fcn.1400145ec
mov rdi, rax
test rax, rax
je 0x140014958
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x74696e49
mov rcx, rax
mov word [rbp - 0x16], 0x726f
mov dword [rbp - 0x20], 0x65447974
mov dword [rbp - 0x2c], 0x696c6169
mov dword [rbp - 0x24], 0x69727563
mov word [rbp - 0x27], 0x5365
mov word [rbp - 0x19], 0x7069
mov byte [rbp - 0x17], 0x74
mov byte [rbp - 0x14], bl
mov word [rbp - 0x1c], 0x6373
mov byte [rbp - 0x28], 0x7a
mov byte [rbp - 0x1a], 0x72
mov byte [rbp - 0x25], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001494f
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140014984
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 8], rax
mov esi, edx
mov dword [rbp - 0x1a], 0x50657461
mov rdi, rcx
mov dword [rbp - 0x13], 0x737365
xor ebx, ebx
mov dword [rbp - 0x20], 0x6d726554
mov word [rbp - 0x1c], 0x6e69
mov word [rbp - 0x15], 0x636f
mov byte [rbp - 0x16], 0x72
call fcn.14000655c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400149ed
mov edx, esi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140058060
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140014a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x1400b7088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x70]
mov r12, r9
mov r13, qword [rbp + 0x68]
mov r15, r8
mov qword [rbp - 0x28], rax
mov r14, rdx
mov rsi, rcx
mov edi, 1
call fcn.140006500
mov rbx, rax
test rax, rax
je 0x140014abd
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1d], 0x7465
mov rcx, rax
mov word [rbp - 0x1a], 0x6c61
mov word [rbp - 0x17], 0x4165
mov word [rbp - 0x1f], 0x4748
mov byte [rbp - 0x15], 0
mov byte [rbp - 0x1b], 0x56
mov byte [rbp - 0x20], 0x53
mov byte [rbp - 0x18], 0x75
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014ab4
mov rcx, qword [rbp - 0x28]
mov r9, r12
mov qword [rsp + 0x28], rcx
mov r8, r15
mov rcx, rsi
mov qword [rsp + 0x20], r13
mov rdx, r14
call rax
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058060
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret