joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bcce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
call fcn.1400bd000
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400bce52
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], 0x74
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x43
mov eax, 1
imul rax, rax, 0x10
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0x11
jae 0x1400bcd58
jmp 0x1400bcd5d
call fcn.14001e2b8
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x40], 0
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x40], 0x68
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], 0x72
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], 0x6f
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x40], 0x48
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], 0x79
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x74
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x79
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], 0x70
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x40], 0x61
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], 0x73
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], 0x72
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], 0x44
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x40], 0x73
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400bce47
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x68
ret
Function at 0x1400bce70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 0
call fcn.1400bd000
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400bcfdc
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], 0x73
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], 0x61
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x43
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], 0x61
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], 0x48
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x40], 0x61
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], 0x44
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x79
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], 0x70
mov eax, 1
imul rax, rax, 0xd
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xe
jae 0x1400bcf4b
jmp 0x1400bcf50
call fcn.14001e2b8
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x40], 0
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x74
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], 0x68
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], 0x72
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], 0x74
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400bcfd1
mov r9d, dword [rsp + 0x88]
mov r8d, dword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x68
ret
Function at 0x1400bd930
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, rcx
mov qword [r11 - 0x48], rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx + 4], xmm0
movups xmmword [rcx + 0x14], xmm0
movups xmmword [rcx + 0x24], xmm0
movups xmmword [rcx + 0x34], xmm0
movups xmmword [rcx + 0x44], xmm0
mov qword [rcx + 0x54], rax
mov dword [rcx + 0x5c], eax
mov dword [rcx + 4], 0x67452301
mov dword [rcx + 8], 0xefcdab89
mov dword [rcx + 0xc], 0x98badcfe
mov dword [rcx + 0x10], 0x10325476
xor edi, edi
mov qword [rcx + 0xa0], rdi
mov qword [rcx + 0xb0], rdi
mov qword [rcx + 0xb8], 0xf
mov byte [rcx + 0xa0], al
mov qword [rcx + 0xc0], rdi
mov qword [rcx + 0xd0], rdi
mov qword [rcx + 0xd8], 0xf
mov byte [rcx + 0xc0], dil
mov word [rcx], 0x101
mov word [rsp + 0x20], 0x33
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x18], 0xf
mov byte [rsp + 0x68], dil
lea rax, [r11 - 0x78]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400bda01
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x68]
call fcn.1400190d0
nop
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.1400bd7b0
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x1400bda7e
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bda78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bdaa2
call fcn.14001e44c
nop
mov rax, rbx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
call fcn.140024b1c
nop
int3
Function at 0x1400c31e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], rbx
mov r15d, 1
mov qword [rbp - 0x38], 0
cmp qword [rdx + 0x18], 0x10
jb 0x1400c322e
mov rdx, qword [rdx]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov r9d, 0x20219
call fcn.140016370
test eax, eax
jne 0x1400c3332
mov dword [rbp - 0x3c], r15d
mov dword [rbp - 0x40], 0x800
mov edx, 0x800
mov rcx, rsi
call fcn.14001ae90
mov qword [rbp - 0x30], rax
mov r12, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400c327a
mov r12, qword [rbx]
mov r13, qword [rbp - 0x38]
call fcn.1400d3170
mov r14, rax
test rax, rax
je 0x1400c32f5
mov word [rbp - 0x15], 0x7465
mov word [rbp - 0x12], 0x6c61
mov word [rbp - 0xf], 0x4165
mov word [rbp - 0x17], 0x4748
mov byte [rbp - 0xd], 0
mov byte [rbp - 0x13], 0x56
mov byte [rbp - 0x18], 0x53
mov byte [rbp - 0x10], 0x75
lea rdx, [rbp - 0x18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c32ed
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x3c]
mov r8, r12
lea rdx, [0x1400ea648]
mov rcx, r13
call rax
mov r15d, eax
mov rcx, r14
call fcn.1400c4d80
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1400c3302
mov rcx, qword [rsi]
test rcx, rcx
jne 0x1400c330b
xor eax, eax
jmp 0x1400c331b
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400c3312
movsxd rdx, eax
xor r8d, r8d
mov rcx, rsi
call fcn.14001b160
mov rcx, qword [rbp - 0x38]
call fcn.140016520
test r15d, r15d
sete sil
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x1400c3373
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x1400c336e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400c33f7
mov rcx, r8
call fcn.14001e44c
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400c33bc
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400c33b7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400c33fd
mov rcx, r8
call fcn.14001e44c
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
movzx eax, sil
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140024b1c
nop
call fcn.140024b1c
int3
Function at 0x1400c4d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov dword [rbp - 0x30], 0x65657246
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x28], 0x797261
mov word [rbp - 0x2b], 0x6269
mov byte [rbp - 0x2c], 0x4c
mov byte [rbp - 0x29], 0x72
mov word [rbp - 0x1f], 0x7265
mov dword [rbp - 0x17], 0x6c6c64
mov dword [rbp - 0x1c], 0x32336c65
mov byte [rbp - 0x1d], 0x6e
mov byte [rbp - 0x20], 0x4b
mov byte [rbp - 0x18], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c4dfb
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x1400c4ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
mov word [rbp - 0x3f], 0x6568
mov byte [rbp - 0x40], 0x53
mov word [rbp - 0x36], 0x6c
mov word [rbp - 0x3c], 0x336c
mov word [rbp - 0x39], 0x642e
mov byte [rbp - 0x37], 0x6c
mov byte [rbp - 0x3d], 0x6c
mov byte [rbp - 0x3a], 0x32
mov dword [rbp - 0x1b], 0x61726269
mov dword [rbp - 0x1f], 0x4c64616f
mov word [rbp - 0x16], 0x4179
mov byte [rbp - 0x20], 0x4c
mov byte [rbp - 0x14], 0
mov byte [rbp - 0x17], 0x72
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c4fa3
lea rcx, [rbp - 0x40]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x60
pop rbp
ret
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x60
pop rbp
ret

Function at 0x1400c4fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x3b], 0x6c6c642e
mov dword [rbp - 0x40], 0x33656c4f
mov byte [rbp - 0x37], 0
mov byte [rbp - 0x3c], 0x32
mov dword [rbp - 0x1b], 0x61726269
mov dword [rbp - 0x1f], 0x4c64616f
mov word [rbp - 0x16], 0x4179
mov byte [rbp - 0x20], 0x4c
mov byte [rbp - 0x14], 0
mov byte [rbp - 0x17], 0x72
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c5061
lea rcx, [rbp - 0x40]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x60
pop rbp
ret
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x60
pop rbp
ret
Function at 0x1400c5080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x39], 0x6c6c64
mov word [rbp - 0x3e], 0x7263
mov word [rbp - 0x3b], 0x2e34
mov word [rbp - 0x40], 0x7052
mov byte [rbp - 0x3c], 0x74
mov dword [rbp - 0x1b], 0x61726269
mov dword [rbp - 0x1f], 0x4c64616f
mov word [rbp - 0x16], 0x4179
mov byte [rbp - 0x20], 0x4c
mov byte [rbp - 0x14], 0
mov byte [rbp - 0x17], 0x72
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c5128
lea rcx, [rbp - 0x40]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x60
pop rbp
ret
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x60
pop rbp
ret

Function at 0x1400c5140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x40]
mov word [rbp - 0x21], 0x5332
mov dword [rbp - 0x1b], 0x746f68
mov dword [rbp - 0x30], 0x61657243
mov dword [rbp - 0x2c], 0x6f546574
mov dword [rbp - 0x26], 0x706c6568
mov word [rbp - 0x28], 0x6c6f
mov dword [rbp - 0x1f], 0x7370616e
mov byte [rbp - 0x22], 0x33
mov word [rbp - 0x3f], 0x7265
mov dword [rbp - 0x37], 0x6c6c64
mov dword [rbp - 0x3c], 0x32336c65
mov byte [rbp - 0x3d], 0x6e
mov byte [rbp - 0x40], 0x4b
mov byte [rbp - 0x38], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c51df
xor edx, edx
lea ecx, [rdx + 2]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x60
pop rbp
ret
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x60
pop rbp
ret

Function at 0x1400c5360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x18], 0x6c694665
mov rbx, rdx
mov word [rbp - 0x14], 0x4e65
mov dword [rbp - 0x20], 0x4d746547
mov dword [rbp - 0x1c], 0x6c75646f
mov dword [rbp - 0x11], 0x41656d
mov byte [rbp - 0x12], 0x61
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c53ed
mov r8d, 0x104
mov rdx, rbx
xor ecx, ecx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x1400c5410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r12, qword [rsp + 0xc0]
mov r15, r9
mov r13, qword [rsp + 0xc8]
mov r14, r8
mov rbp, rdx
mov rsi, rcx
mov ebx, 1
call fcn.1400d3170
mov rdi, rax
test rax, rax
je 0x1400c54c3
lea rdx, [rsp + 0x30]
mov word [rsp + 0x33], 0x7465
mov rcx, rax
mov word [rsp + 0x36], 0x6c61
mov word [rsp + 0x39], 0x4165
mov word [rsp + 0x31], 0x4748
mov byte [rsp + 0x3b], 0
mov byte [rsp + 0x35], 0x56
mov byte [rsp + 0x30], 0x53
mov byte [rsp + 0x38], 0x75
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c54bb
mov qword [rsp + 0x28], r13
mov r9, r15
mov r8, r14
mov qword [rsp + 0x20], r12
mov rdx, rbp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400c4d80
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400c5630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, r8
mov ebp, edx
mov rsi, rcx
xor ebx, ebx
call fcn.1400d3240
mov rdi, rax
test rax, rax
je 0x1400c56bb
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2c], 0x6e656b6f
mov rcx, rax
mov word [rsp + 0x24], 0x7250
mov word [rsp + 0x27], 0x6563
mov dword [rsp + 0x20], 0x6e65704f
mov word [rsp + 0x2a], 0x5473
mov byte [rsp + 0x26], 0x6f
mov byte [rsp + 0x30], bl
mov byte [rsp + 0x29], 0x73
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c56b3
mov r8, r14
mov edx, ebp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400c4d80
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400c56e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov dword [rbp - 0x2a], 0x636f6c
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x30], 0x70616548
mov rdi, r8
mov word [rbp - 0x2c], 0x6c41
mov word [rbp - 0x1f], 0x7265
mov dword [rbp - 0x17], 0x6c6c64
mov dword [rbp - 0x1c], 0x32336c65
mov byte [rbp - 0x1d], 0x6e
mov byte [rbp - 0x20], 0x4b
mov byte [rbp - 0x18], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c5763
mov r8, rdi
mov edx, 8
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x1400c5790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
mov word [rbp - 0x13], 0x70
mov dword [rbp - 0x1c], 0x65636f72
mov dword [rbp - 0x18], 0x65487373
mov dword [rbp - 0x20], 0x50746547
mov byte [rbp - 0x14], 0x61
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c5816
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x50
pop rbp
ret
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x50
pop rbp
ret

Function at 0x1400c5920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, r9
mov rbp, r8
mov rsi, rdx
mov ebx, 1
call fcn.1400d3240
mov rdi, rax
test rax, rax
je 0x1400c59b6
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x27], 0x49736569
mov rcx, rax
mov dword [rsp + 0x2c], 0x416c6341
mov word [rsp + 0x21], 0x7465
mov word [rsp + 0x24], 0x746e
mov byte [rsp + 0x20], 0x53
mov byte [rsp + 0x2b], 0x6e
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x26], 0x72
mov byte [rsp + 0x23], 0x45
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c59ae
mov r9, r14
mov r8, rbp
mov rdx, rsi
mov ecx, ebx
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400c4d80
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400c59e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbp, rdx
mov rsi, rcx
xor ebx, ebx
call fcn.1400d3240
mov rdi, rax
test rax, rax
je 0x1400c5a62
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x29], 0x416563
mov rcx, rax
mov dword [rsp + 0x21], 0x536e6570
mov word [rsp + 0x26], 0x7672
mov byte [rsp + 0x25], 0x65
mov byte [rsp + 0x20], 0x4f
mov byte [rsp + 0x28], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c5a5a
mov r8d, 0x60000
mov rdx, rbp
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400c4d80
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c5a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, rcx
xor ebx, ebx
call fcn.1400d3240
mov rdi, rax
test rax, rax
je 0x1400c5b17
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x72655365
mov rcx, rax
mov dword [rsp + 0x2d], 0x6c646e61
mov dword [rsp + 0x29], 0x48656369
mov word [rsp + 0x21], 0x6f6c
mov word [rsp + 0x31], 0x65
mov byte [rsp + 0x20], 0x43
mov byte [rsp + 0x28], 0x76
mov byte [rsp + 0x23], 0x73
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c5b0f
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400c4d80
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400c5b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x20], 0x4c746547
mov dword [rbp - 0x1b], 0x72457473
mov word [rbp - 0x16], 0x726f
mov byte [rbp - 0x17], 0x72
mov byte [rbp - 0x14], 0
mov byte [rbp - 0x1c], 0x61
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c5bc7
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x50
pop rbp
ret
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x50
pop rbp
ret

Function at 0x1400c5c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, qword [rbp + 0x60]
mov rbx, rcx
mov r14, qword [rbp + 0x68]
lea rcx, [rbp - 0x30]
mov rdi, rdx
mov word [rbp - 0x20], 0x7243
mov word [rbp - 0x16], 0x7365
mov dword [rbp - 0x1d], 0x50657461
mov word [rbp - 0x19], 0x6f72
mov word [rbp - 0x13], 0x41
mov byte [rbp - 0x1e], 0x65
mov byte [rbp - 0x14], 0x73
mov byte [rbp - 0x17], 0x63
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c5d65
mov qword [rsp + 0x48], r14
xor r9d, r9d
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov qword [rsp + 0x38], 0
mov rdx, rdi
mov qword [rsp + 0x30], 0
mov rcx, rbx
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], 0
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400c5d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14d, dword [rbp + 0x50]
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x1f], 0x75747269
mov rsi, r8
mov dword [rbp - 0x19], 0x6f6c6c41
mov rdi, rdx
mov dword [rbp - 0x15], 0x784563
mov byte [rbp - 0x20], 0x56
mov word [rbp - 0x1b], 0x6c61
mov word [rbp - 0x2f], 0x7265
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2c], 0x32336c65
mov byte [rbp - 0x2d], 0x6e
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x28], 0x2e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400c5e2a
mov r9d, 0x3000
mov dword [rsp + 0x20], r14d
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e190
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret