joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x30], rax
mov eax, 8
imul rax, rax, 5
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov dword [rsp + 0x14], eax
mov eax, 8
imul rax, rax, 5
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax + 0x8c]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x14], 0
jne 0x1400035c7
mov eax, 1
jmp 0x140003738
mov dword [rsp + 0x10], 0
mov eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov eax, dword [rsp + 0x10]
cmp dword [rsp + 0x20], eax
jbe 0x140003733
mov rax, qword [rsp + 8]
cmp dword [rax + 4], 0
je 0x140003733
mov rax, qword [rsp + 8]
mov eax, dword [rax + 4]
sub rax, 8
xor edx, edx
mov ecx, 2
div rcx
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 8]
add rax, 8
mov qword [rsp + 0x18], rax
mov dword [rsp + 4], 0
jmp 0x14000363c
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 4], eax
jae 0x140003702
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x18]
movzx eax, word [rcx + rax*2]
test eax, eax
jle 0x1400036fd
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x18]
movzx eax, word [rcx + rax*2]
and eax, 0xf000
sar eax, 0xc
mov word [rsp], ax
movzx eax, word [rsp]
cmp eax, 0xa
je 0x140003690
movzx eax, word [rsp]
test eax, eax
je 0x140003690
xor eax, eax
jmp 0x140003738
movzx eax, word [rsp]
cmp eax, 0xa
jne 0x1400036fd
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x18]
movzx eax, word [rcx + rax*2]
and eax, 0xfff
mov rcx, qword [rsp + 8]
mov ecx, dword [rcx]
add ecx, eax
mov eax, ecx
mov eax, eax
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
mov rcx, rdx
mov rdx, qword [rsp + 0x50]
add rcx, qword [rdx + rax]
mov rax, rcx
mov ecx, dword [rsp + 4]
mov rdx, qword [rsp + 0x18]
movzx ecx, word [rdx + rcx*2]
and ecx, 0xfff
mov rdx, qword [rsp + 8]
mov edx, dword [rdx]
add edx, ecx
mov ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x50]
mov qword [rdx + rcx], rax
jmp 0x140003632
mov rax, qword [rsp + 8]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 4]
mov ecx, dword [rsp + 0x10]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x10], eax
jmp 0x1400035e3
mov eax, 1
add rsp, 0x48
ret
Function at 0x140003740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 4], 0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax + 0x88]
mov dword [rsp + 8], eax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax + 0x8c]
mov dword [rsp + 0x18], eax
cmp dword [rsp + 8], 0
je 0x1400038af
mov eax, dword [rsp + 8]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
cmp dword [rax + 0x1c], 0
je 0x1400037e0
mov rax, qword [rsp + 0x10]
cmp dword [rax + 0x24], 0
je 0x1400037e0
mov rax, qword [rsp + 0x10]
cmp dword [rax + 0x20], 0
jne 0x1400037e7
xor eax, eax
jmp 0x1400038e2
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov dword [rsp], 0
jmp 0x140003840
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x10]
mov eax, dword [rax + 0x18]
cmp dword [rsp], eax
jae 0x1400038ad
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x140003888
inc rax
test dl, dl
jne 0x140003875
xor eax, eax
jmp 0x14000388d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1400038ab
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 4], eax
jmp 0x1400038ad
jmp 0x140003838
jmp 0x1400038b3
xor eax, eax
jmp 0x1400038e2
cmp dword [rsp + 4], 0
je 0x1400038e0
mov eax, dword [rsp + 8]
cmp dword [rsp + 4], eax
jbe 0x1400038da
mov eax, dword [rsp + 0x18]
mov ecx, dword [rsp + 8]
add ecx, eax
mov eax, ecx
cmp dword [rsp + 4], eax
jae 0x1400038da
xor eax, eax
jmp 0x1400038e2
mov eax, dword [rsp + 4]
jmp 0x1400038e2
xor eax, eax
add rsp, 0x58
ret
Function at 0x140004170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x30], 0x6e
mov byte [rsp + 0x31], 0x74
mov byte [rsp + 0x32], 0x64
mov byte [rsp + 0x33], 0x6c
mov byte [rsp + 0x34], 0x6c
mov byte [rsp + 0x35], 0x2e
mov byte [rsp + 0x36], 0x64
mov byte [rsp + 0x37], 0x6c
mov byte [rsp + 0x38], 0x6c
mov byte [rsp + 0x39], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400041db
xor eax, eax
jmp 0x140004224
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400041fc
xor eax, eax
jmp 0x140004224
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 3]
cmp eax, 0xb8
jne 0x140004222
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 4]
mov dword [rax], ecx
mov eax, 1
jmp 0x140004224
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140006fe0
add rsp, 0x58
ret
Function at 0x140004240
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
cmp qword [0x14002f950], 0
je 0x140004282
cmp qword [0x14002f9b0], 0
jne 0x140004289
xor eax, eax
jmp 0x1400043de
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xa0]
call fcn.140004170
test eax, eax
jne 0x1400042a6
xor eax, eax
jmp 0x1400043de
mov rax, qword [0x14002f950]
mov eax, dword [rax + 0x3c]
mov rcx, qword [0x14002f950]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x24], 0
jmp 0x1400042ee
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x24], eax
jae 0x1400043d9
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
and eax, 0x20000000
test eax, eax
je 0x1400043c6
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
and eax, 0x2000000
test eax, eax
jne 0x1400043c6
mov dword [rsp + 0x20], 0
jmp 0x14000433f
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 8]
sub eax, 0x100
cmp dword [rsp + 0x20], eax
jae 0x1400043c6
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
add eax, dword [rsp + 0x20]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x50]
lea rcx, [0x1400222b8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1f
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x65], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [0x14002f950]
add rcx, rax
mov rax, rcx
mov r8d, 0x1e
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400040f0
test eax, eax
je 0x1400043c1
mov eax, dword [rsp + 0x30]
mov rcx, qword [0x14002f9b0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x140004335
mov rax, qword [rsp + 0x28]
add rax, 0x28
mov qword [rsp + 0x28], rax
jmp 0x1400042e4
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140006fe0
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x140005880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x30], 0x50
mov byte [rsp + 0x31], 0x73
mov byte [rsp + 0x32], 0x52
mov byte [rsp + 0x33], 0x65
mov byte [rsp + 0x34], 0x6d
mov byte [rsp + 0x35], 0x6f
mov byte [rsp + 0x36], 0x76
mov byte [rsp + 0x37], 0x65
mov byte [rsp + 0x38], 0x4c
mov byte [rsp + 0x39], 0x6f
mov byte [rsp + 0x3a], 0x61
mov byte [rsp + 0x3b], 0x64
mov byte [rsp + 0x3c], 0x49
mov byte [rsp + 0x3d], 0x6d
mov byte [rsp + 0x3e], 0x61
mov byte [rsp + 0x3f], 0x67
mov byte [rsp + 0x40], 0x65
mov byte [rsp + 0x41], 0x4e
mov byte [rsp + 0x42], 0x6f
mov byte [rsp + 0x43], 0x74
mov byte [rsp + 0x44], 0x69
mov byte [rsp + 0x45], 0x66
mov byte [rsp + 0x46], 0x79
mov byte [rsp + 0x47], 0x52
mov byte [rsp + 0x48], 0x6f
mov byte [rsp + 0x49], 0x75
mov byte [rsp + 0x4a], 0x74
mov byte [rsp + 0x4b], 0x69
mov byte [rsp + 0x4c], 0x6e
mov byte [rsp + 0x4d], 0x65
mov byte [rsp + 0x4e], 0
lea r9, [rsp + 0x20]
mov r8d, 1
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1400051e0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140006fe0
add rsp, 0x68
ret
Function at 0x140005970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0xc0
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x78]
mov rdi, rax
xor eax, eax
mov ecx, 0x32
rep stosb byte [rdi], al
mov dword [rsp + 0x24], 0
mov byte [rsp + 0x58], 0x50
mov byte [rsp + 0x59], 0x73
mov byte [rsp + 0x5a], 0x52
mov byte [rsp + 0x5b], 0x65
mov byte [rsp + 0x5c], 0x6d
mov byte [rsp + 0x5d], 0x6f
mov byte [rsp + 0x5e], 0x76
mov byte [rsp + 0x5f], 0x65
mov byte [rsp + 0x60], 0x4c
mov byte [rsp + 0x61], 0x6f
mov byte [rsp + 0x62], 0x61
mov byte [rsp + 0x63], 0x64
mov byte [rsp + 0x64], 0x49
mov byte [rsp + 0x65], 0x6d
mov byte [rsp + 0x66], 0x61
mov byte [rsp + 0x67], 0x67
mov byte [rsp + 0x68], 0x65
mov byte [rsp + 0x69], 0x4e
mov byte [rsp + 0x6a], 0x6f
mov byte [rsp + 0x6b], 0x74
mov byte [rsp + 0x6c], 0x69
mov byte [rsp + 0x6d], 0x66
mov byte [rsp + 0x6e], 0x79
mov byte [rsp + 0x6f], 0x52
mov byte [rsp + 0x70], 0x6f
mov byte [rsp + 0x71], 0x75
mov byte [rsp + 0x72], 0x74
mov byte [rsp + 0x73], 0x69
mov byte [rsp + 0x74], 0x6e
mov byte [rsp + 0x75], 0x65
mov byte [rsp + 0x76], 0
lea rcx, [rsp + 0x58]
call fcn.140003a30
mov qword [rsp + 0x38], rax
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x78], 0x48
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x78], 0x8d
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x78], 0xd
mov dword [rsp + 0x24], 3
mov rax, qword [rsp + 0x38]
add rax, 0xff
mov r9d, dword [rsp + 0x24]
lea r8, [rsp + 0x78]
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call fcn.1400052a0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140005abe
xor eax, eax
jmp 0x140005ba3
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 4]
sub rax, qword [0x14002f978]
mov qword [rsp + 0x48], rax
call fcn.140003100
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140005b08
xor eax, eax
jmp 0x140005ba3
mov dword [rsp + 0x20], 0
jmp 0x140005b1c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x40
jge 0x140005b9e
mov qword [rsp + 0x50], 0
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax*8]
mov r9b, 1
lea r8, [rsp + 0x50]
mov edx, 8
mov rcx, rax
call fcn.1400028f0
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jl 0x140005b99
cmp qword [rsp + 0x50], 0
je 0x140005b99
mov rax, qword [rsp + 0x50]
and rax, 0xfffffffffffffff8
mov qword [rsp + 0x50], rax
mov r9b, 1
lea r8, [rsp + 0x50]
mov edx, 8
mov rcx, qword [rsp + 0x50]
call fcn.1400028f0
cmp qword [rsp + 0x50], 0
je 0x140005b99
mov rcx, qword [rsp + 0x50]
call fcn.140005880
jmp 0x140005b12
mov eax, 1
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140006fe0
add rsp, 0xc0
pop rdi
ret
Function at 0x140005bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x30], 0x50
mov byte [rsp + 0x31], 0x73
mov byte [rsp + 0x32], 0x52
mov byte [rsp + 0x33], 0x65
mov byte [rsp + 0x34], 0x6d
mov byte [rsp + 0x35], 0x6f
mov byte [rsp + 0x36], 0x76
mov byte [rsp + 0x37], 0x65
mov byte [rsp + 0x38], 0x43
mov byte [rsp + 0x39], 0x72
mov byte [rsp + 0x3a], 0x65
mov byte [rsp + 0x3b], 0x61
mov byte [rsp + 0x3c], 0x74
mov byte [rsp + 0x3d], 0x65
mov byte [rsp + 0x3e], 0x54
mov byte [rsp + 0x3f], 0x68
mov byte [rsp + 0x40], 0x72
mov byte [rsp + 0x41], 0x65
mov byte [rsp + 0x42], 0x61
mov byte [rsp + 0x43], 0x64
mov byte [rsp + 0x44], 0x4e
mov byte [rsp + 0x45], 0x6f
mov byte [rsp + 0x46], 0x74
mov byte [rsp + 0x47], 0x69
mov byte [rsp + 0x48], 0x66
mov byte [rsp + 0x49], 0x79
mov byte [rsp + 0x4a], 0x52
mov byte [rsp + 0x4b], 0x6f
mov byte [rsp + 0x4c], 0x75
mov byte [rsp + 0x4d], 0x74
mov byte [rsp + 0x4e], 0x69
mov byte [rsp + 0x4f], 0x6e
mov byte [rsp + 0x50], 0x65
mov byte [rsp + 0x51], 0
lea r9, [rsp + 0x20]
mov r8d, 1
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1400051e0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140006fe0
add rsp, 0x68
ret
Function at 0x140005cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0xc0
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 0x32
rep stosb byte [rdi], al
mov dword [rsp + 0x24], 0
mov byte [rsp + 0x58], 0x50
mov byte [rsp + 0x59], 0x73
mov byte [rsp + 0x5a], 0x52
mov byte [rsp + 0x5b], 0x65
mov byte [rsp + 0x5c], 0x6d
mov byte [rsp + 0x5d], 0x6f
mov byte [rsp + 0x5e], 0x76
mov byte [rsp + 0x5f], 0x65
mov byte [rsp + 0x60], 0x43
mov byte [rsp + 0x61], 0x72
mov byte [rsp + 0x62], 0x65
mov byte [rsp + 0x63], 0x61
mov byte [rsp + 0x64], 0x74
mov byte [rsp + 0x65], 0x65
mov byte [rsp + 0x66], 0x54
mov byte [rsp + 0x67], 0x68
mov byte [rsp + 0x68], 0x72
mov byte [rsp + 0x69], 0x65
mov byte [rsp + 0x6a], 0x61
mov byte [rsp + 0x6b], 0x64
mov byte [rsp + 0x6c], 0x4e
mov byte [rsp + 0x6d], 0x6f
mov byte [rsp + 0x6e], 0x74
mov byte [rsp + 0x6f], 0x69
mov byte [rsp + 0x70], 0x66
mov byte [rsp + 0x71], 0x79
mov byte [rsp + 0x72], 0x52
mov byte [rsp + 0x73], 0x6f
mov byte [rsp + 0x74], 0x75
mov byte [rsp + 0x75], 0x74
mov byte [rsp + 0x76], 0x69
mov byte [rsp + 0x77], 0x6e
mov byte [rsp + 0x78], 0x65
mov byte [rsp + 0x79], 0
lea rcx, [rsp + 0x58]
call fcn.140003a30
mov qword [rsp + 0x38], rax
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x80], 0x48
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x80], 0x8d
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x80], 0xd
mov dword [rsp + 0x24], 3
mov rax, qword [rsp + 0x38]
add rax, 0xff
mov r9d, dword [rsp + 0x24]
lea r8, [rsp + 0x80]
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call fcn.1400052a0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140005e2c
xor eax, eax
jmp 0x140005f11
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 4]
sub rax, qword [0x14002f978]
mov qword [rsp + 0x48], rax
call fcn.140003100
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140005e76
xor eax, eax
jmp 0x140005f11
mov dword [rsp + 0x20], 0
jmp 0x140005e8a
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x40
jge 0x140005f0c
mov qword [rsp + 0x50], 0
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax*8]
mov r9b, 1
lea r8, [rsp + 0x50]
mov edx, 8
mov rcx, rax
call fcn.1400028f0
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jl 0x140005f07
cmp qword [rsp + 0x50], 0
je 0x140005f07
mov rax, qword [rsp + 0x50]
and rax, 0xfffffffffffffff8
mov qword [rsp + 0x50], rax
mov r9b, 1
lea r8, [rsp + 0x50]
mov edx, 8
mov rcx, qword [rsp + 0x50]
call fcn.1400028f0
cmp qword [rsp + 0x50], 0
je 0x140005f07
mov rcx, qword [rsp + 0x50]
call fcn.140005bc0
jmp 0x140005e80
mov eax, 1
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140006fe0
add rsp, 0xc0
pop rdi
ret
Function at 0x140005f30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x30], 0x4f
mov byte [rsp + 0x31], 0x62
mov byte [rsp + 0x32], 0x55
mov byte [rsp + 0x33], 0x6e
mov byte [rsp + 0x34], 0x52
mov byte [rsp + 0x35], 0x65
mov byte [rsp + 0x36], 0x67
mov byte [rsp + 0x37], 0x69
mov byte [rsp + 0x38], 0x73
mov byte [rsp + 0x39], 0x74
mov byte [rsp + 0x3a], 0x65
mov byte [rsp + 0x3b], 0x72
mov byte [rsp + 0x3c], 0x43
mov byte [rsp + 0x3d], 0x61
mov byte [rsp + 0x3e], 0x6c
mov byte [rsp + 0x3f], 0x6c
mov byte [rsp + 0x40], 0x62
mov byte [rsp + 0x41], 0x61
mov byte [rsp + 0x42], 0x63
mov byte [rsp + 0x43], 0x6b
mov byte [rsp + 0x44], 0x73
mov byte [rsp + 0x45], 0
lea r9, [rsp + 0x20]
mov r8d, 1
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1400051e0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140006fe0
add rsp, 0x58
ret
Function at 0x1400063d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x30], 0x43
mov byte [rsp + 0x31], 0x6d
mov byte [rsp + 0x32], 0x55
mov byte [rsp + 0x33], 0x6e
mov byte [rsp + 0x34], 0x52
mov byte [rsp + 0x35], 0x65
mov byte [rsp + 0x36], 0x67
mov byte [rsp + 0x37], 0x69
mov byte [rsp + 0x38], 0x73
mov byte [rsp + 0x39], 0x74
mov byte [rsp + 0x3a], 0x65
mov byte [rsp + 0x3b], 0x72
mov byte [rsp + 0x3c], 0x43
mov byte [rsp + 0x3d], 0x61
mov byte [rsp + 0x3e], 0x6c
mov byte [rsp + 0x3f], 0x6c
mov byte [rsp + 0x40], 0x62
mov byte [rsp + 0x41], 0x61
mov byte [rsp + 0x42], 0x63
mov byte [rsp + 0x43], 0x6b
mov byte [rsp + 0x44], 0
lea r9, [rsp + 0x20]
mov r8d, 1
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1400051e0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140006fe0
add rsp, 0x58
ret
Function at 0x140006de0
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov edx, 1
lea rcx, str.SeDebugPrivilege
call fcn.140001890
call fcn.140001b80
movzx eax, al
test eax, eax
jne 0x140006e21
jmp 0x140006ecb
call fcn.140001620
test eax, eax
jne 0x140006e34
call fcn.140001780
jmp 0x140006ecb
call fcn.140001a00
movzx eax, al
test eax, eax
je 0x140006e84
call fcn.140002150
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140006e7f
mov rcx, qword [rsp + 0x20]
call fcn.1400024f0
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.1400028d0
mov rcx, qword [rsp + 0x20]
call fcn.1400028b0
call fcn.140003b80
mov qword [rsp + 0x30], rax
call fcn.140001ad0
call fcn.140001780
cmp qword [rsp + 0x20], 0
jne 0x140006e93
jmp 0x140006ecb
mov rcx, qword [rsp + 0x30]
call fcn.140004400
test eax, eax
jne 0x140006ea3
jmp 0x140006ecb
call fcn.1400053d0
call fcn.140005970
call fcn.140005cc0
call fcn.140006000
call fcn.140006490
call fcn.140006840
xor eax, eax
test eax, eax
jne 0x140006e10
lea rcx, str.pause
call fcn.14000a034
xor eax, eax
add rsp, 0x48
ret

Function at 0x14000afc0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000adec
Function at 0x14000c980
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x14000c9a0
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x14000c9a0
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret