joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140052d28
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 0x61
call fcn.140029ab4
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
xor r14d, r14d
cmp rax, rbx
cmove rbx, r14
test rbx, rbx
je 0x140052d7f
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.ntoskrnl.exe_KeStackAttachProcess
mov ecx, 0x42
call fcn.140029ab4
mov rsi, rax
test eax, eax
je 0x140052de9
imul ecx, esi, 0x58
mov ebp, ecx
mov edx, ecx
mov ecx, 1
call fcn.140077530
mov rdi, rax
test rax, rax
je 0x140052de9
mov r8d, ebp
xor edx, edx
mov rcx, rax
call fcn.1400013f0
mov edx, esi
mov rcx, rdi
call fcn.140051de4
cmp al, 1
jne 0x140052de1
mov edx, esi
mov rcx, rdi
call fcn.1400521ac
cmp al, 1
jne 0x140052de1
mov rdx, rdi
mov ecx, 0x23c
call fcn.140029bac
jmp 0x140052de9
mov rcx, rdi
call fcn.140077564
test rbx, rbx
je 0x140052df8
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x1400532c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x630054
mov dword [rsp + 0x34], 0x690070
mov dword [rsp + 0x38], 0x70
call fcn.140078a80
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret

Function at 0x140053968
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x640074
mov dword [rsp + 0x34], 0x78
call fcn.140078a80
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x48
ret
Function at 0x140054114
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov edi, 0x29e
mov ecx, edi
call fcn.140029ab4
xor r14d, r14d
mov rbx, rax
test eax, eax
jne 0x140054171
call fcn.140054594
mov ecx, edi
call fcn.140029ab4
mov ebx, eax
test eax, eax
je 0x1400542d8
mov ecx, 0x61
call fcn.140029ab4
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, rdi
cmove rdi, r14
test rdi, rdi
je 0x14005419d
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sub.ntoskrnl.exe_KeStackAttachProcess
mov ecx, 0x20
call fcn.140029ab4
mov ecx, 0x21
mov rbp, rax
call fcn.140029ab4
mov ecx, 3
mov rsi, rax
call fcn.140029ab4
mov ecx, 0x41c5
mov r13, rax
call fcn.140029ab4
mov qword [rsp + 0x38], rax
test rbp, rbp
je 0x1400542c9
test esi, esi
je 0x1400542c9
test r13, r13
je 0x1400542c9
test eax, eax
je 0x1400542c9
cmp ebx, esi
jae 0x1400542c9
movsxd rax, dword [rbp + 0x3c]
mov ebx, ebx
mov r12d, esi
mov r15, qword [rax + rbp + 0x30]
add rbx, rbp
mov qword [rsp + 0x30], r14
add r12, rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x40]
mov rdx, r12
mov rcx, rbx
call fcn.140010e58
test al, al
je 0x1400542c9
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x58]
add rbx, rax
mov rax, qword [rsp + 0x68]
cmp dword [rax], 0x10cd
jne 0x140054278
mov eax, ebx
sub eax, ebp
add eax, dword [rsp + 0x4c]
cmp eax, dword [rsp + 0x38]
je 0x140054286
inc r14d
cmp r14d, 0x100
jae 0x1400542c9
jmp 0x140054220
test rcx, rcx
je 0x1400542c9
lea r8, [rsp + 0x40]
mov rdx, r12
call fcn.140010e58
cmp al, 1
jne 0x1400542c9
mov rax, qword [rsp + 0x68]
cmp dword [rax], 0x11b6
jne 0x1400542c9
movsxd rax, dword [rsp + 0x4c]
cmp rax, r15
jbe 0x1400542c9
sub eax, r15d
cmp eax, esi
jae 0x1400542c9
mov edx, eax
mov ecx, 0x29c
add rdx, r13
call fcn.140029bac
test rdi, rdi
je 0x1400542d8
lea rcx, [rsp + 0x70]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140054594
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 0x61
call fcn.140029ab4
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
xor r13d, r13d
cmp rax, rbx
cmove rbx, r13
test rbx, rbx
je 0x1400545ee
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.ntoskrnl.exe_KeStackAttachProcess
mov ecx, 0x20
call fcn.140029ab4
mov ecx, 0x21
mov rdi, rax
call fcn.140029ab4
mov ecx, 0x42
mov rbp, rax
call fcn.140029ab4
mov ecx, 3
mov r12, rax
call fcn.140029ab4
mov esi, 0x62
mov ecx, esi
mov r15, rax
call fcn.140029ab4
mov r14, rax
test rax, rax
jne 0x140054645
call fcn.1400526b8
mov ecx, esi
call fcn.140029ab4
mov r14, rax
test rdi, rdi
je 0x1400546c0
test ebp, ebp
je 0x1400546c0
test r15, r15
je 0x1400546c0
test r14, r14
je 0x1400546c0
movsxd rax, dword [rdi + 0x3c]
mov ecx, 0x42be
mov rsi, qword [rax + rdi + 0x30]
call fcn.140029ab4
inc eax
cmp eax, 1
jbe 0x1400546c0
lea rcx, [rax + 4]
mov edx, eax
mov eax, ebp
cmp rcx, rax
jae 0x1400546c0
mov eax, dword [rdx + rdi]
test eax, eax
je 0x1400546c0
cmp eax, r12d
jae 0x1400546c0
mov rcx, qword [r14 + rax*8]
cmp rcx, rsi
jbe 0x1400546c0
mov eax, ecx
sub eax, esi
cmp eax, ebp
jae 0x1400546c0
mov edi, eax
add rax, rsi
cmp rcx, rax
jne 0x1400546c0
mov edx, edi
mov ecx, 0x29e
call fcn.140029bac
lea rdx, [rdi + r15]
mov ecx, 0x29f
call fcn.140029bac
test rbx, rbx
je 0x1400546cf
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400551b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov r13, rcx
mov ecx, 0x8da
mov r15, r8
mov esi, edx
xor r12b, r12b
call fcn.140029ab4
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400553e1
mov eax, 0x50425355
lea r8, [rbp + 0xc0]
xor r9d, r9d
mov edx, esi
mov rcx, r13
mov dword [rbp + 0xc4], 0x5f54524f
mov dword [rbp + 0xc0], eax
mov dword [rbp + 0xc8], 0x69676552
mov dword [rbp + 0xcc], 0x72657473
mov dword [rbp + 0xd0], eax
mov dword [rbp + 0xd4], 0x4474726f
mov dword [rbp + 0xd8], 0x65766972
mov dword [rbp + 0xdc], 0x72
call fcn.140005484
test eax, eax
je 0x1400553e1
cmp eax, esi
jae 0x1400553e1
mov ecx, eax
mov edx, r13d
xor r9d, r9d
add rcx, r13
lea rax, [rsp + 0x50]
lea r8d, [r9 + 2]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
or dword [rsp + 0x20], 0xffffffff
sub edx, ecx
add edx, esi
call fcn.14008a254
xor edx, edx
lea rcx, [rbp + 0xe0]
lea r8d, [rdx + 0x40]
call fcn.1400013f0
xor r14d, r14d
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.140089fbc
test eax, eax
jne 0x1400553e1
mov eax, dword [rbp + 0x90]
mov rdx, qword [rsp + 0x58]
add rdx, rax
mov rax, qword [rbp + 0xb8]
mov qword [rsp + 0x58], rdx
movzx ebx, word [rax + 6]
mov eax, 0x545
cmp ax, bx
je 0x1400553e1
mov eax, 0x512
cmp ax, bx
jne 0x140055339
cmp qword [rbp + 0x28], 0x40000
jne 0x140055339
mov ecx, dword [rbp + 0x18]
test ecx, ecx
je 0x140055339
cmp qword [rbp - 0x10], 0x40
jne 0x140055339
sub ecx, r13d
add ecx, edx
je 0x140055339
cmp ecx, esi
jae 0x140055339
mov eax, dword [rbp - 8]
mov dword [rbp + rax*4 + 0xe0], ecx
mov eax, 0x473
cmp ax, bx
jne 0x140055355
xor edx, edx
lea rcx, [rbp + 0xe0]
lea r8d, [rdx + 0x40]
call fcn.1400013f0
mov eax, 0x50e
cmp ax, bx
jne 0x1400553d1
test qword [rbp - 0x10], 0x14000
je 0x1400553d1
test byte [rbp - 0x10], 0x40
je 0x1400553d1
mov eax, dword [rbp + 0x7c]
and eax, 0xf
cmp al, 4
je 0x1400553d1
cmp qword [rbp + 0x28], 0x40
jne 0x1400553d1
mov eax, dword [rbp - 0x20]
lea ecx, [rax - 0x70]
cmp ecx, 0xd8
ja 0x1400553d1
and eax, 7
test al, al
jne 0x1400553d1
shr ecx, 3
cmp ecx, 0x1b
ja 0x1400553d1
mov eax, dword [rbp + 0x30]
mov r8d, dword [rbp + rax*4 + 0xe0]
test r8d, r8d
je 0x1400553d1
lea rdx, [rcx + rcx*2]
add rdx, rdx
cmp dword [r15 + rdx*8 + 4], 0
jne 0x1400553d1
mov ecx, r8d
mov r12b, 1
mov dword [r15 + rdx*8 + 4], r8d
add rcx, qword [rsp + 0x40]
mov qword [r15 + rdx*8 + 8], rcx
inc r14d
cmp r14d, 0x1f4
jb 0x1400552c0
mov al, r12b
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
Function at 0x14005544c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x730075
mov dword [rsp + 0x34], 0x650062
mov dword [rsp + 0x38], 0x630068
mov dword [rsp + 0x3c], 0x69
call fcn.140078a80
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret

Function at 0x1400556f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov eax, 0x730079
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x31]
lea r14d, [rbx + 1]
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x53005c
mov r9b, r14b
mov dword [rbp - 0x25], eax
mov dword [rbp - 0x21], 0x650074
mov dword [rbp - 0x1d], 0x52006d
mov dword [rbp - 0x19], 0x6f006f
mov dword [rbp - 0x15], 0x5c0074
mov dword [rbp - 0x11], 0x790073
mov dword [rbp - 0xd], 0x740073
mov dword [rbp - 9], 0x6d0065
mov dword [rbp - 5], 0x320033
mov dword [rbp - 1], 0x64005c
mov dword [rbp + 3], 0x690072
mov dword [rbp + 7], 0x650076
mov dword [rbp + 0xb], 0x730072
mov dword [rbp + 0xf], 0x75005c
mov dword [rbp + 0x13], 0x620073
mov dword [rbp + 0x17], 0x6f0070
mov dword [rbp + 0x1b], 0x740072
mov dword [rbp + 0x1f], 0x73002e
mov qword [rbp + 0x23], rax
call fcn.14002f234
test eax, eax
jne 0x1400557f7
mov edx, dword [rbp - 0x39]
mov rcx, qword [rbp - 0x31]
mov r9, rsi
mov r8, rdi
mov dword [rsp + 0x20], ebx
call fcn.140005d4c
mov rcx, qword [rbp - 0x31]
movzx ebx, bl
cmp al, r14b
cmove ebx, r14d
call fcn.140077564
mov al, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140056c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x6f0056
mov dword [rsp + 0x34], 0x73006c
mov dword [rsp + 0x38], 0x61006e
mov dword [rsp + 0x3c], 0x70
call fcn.140078a80
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret

Function at 0x140056eac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov eax, 0x730079
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x31]
lea r14d, [rbx + 1]
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x53005c
mov r9b, r14b
mov dword [rbp - 0x25], eax
mov dword [rbp - 0x21], 0x650074
mov dword [rbp - 0x1d], 0x52006d
mov dword [rbp - 0x19], 0x6f006f
mov dword [rbp - 0x15], 0x5c0074
mov dword [rbp - 0x11], 0x790073
mov dword [rbp - 0xd], 0x740073
mov dword [rbp - 9], 0x6d0065
mov dword [rbp - 5], 0x320033
mov dword [rbp - 1], 0x64005c
mov dword [rbp + 3], 0x690072
mov dword [rbp + 7], 0x650076
mov dword [rbp + 0xb], 0x730072
mov dword [rbp + 0xf], 0x76005c
mov dword [rbp + 0x13], 0x6c006f
mov dword [rbp + 0x17], 0x6e0073
mov dword [rbp + 0x1b], 0x700061
mov dword [rbp + 0x1f], 0x73002e
mov qword [rbp + 0x23], rax
call fcn.14002f234
test eax, eax
jne 0x140056fab
mov edx, dword [rbp - 0x39]
mov rcx, qword [rbp - 0x31]
mov r9, rsi
mov r8, rdi
mov dword [rsp + 0x20], ebx
call fcn.140005d4c
mov rcx, qword [rbp - 0x31]
movzx ebx, bl
cmp al, r14b
cmove ebx, r14d
call fcn.140077564
mov al, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1400575f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x40], rax
and dword [rsp + 0x20], 0
mov rdi, rcx
mov ecx, 0x8fb
mov ebx, edx
mov dword [rsp + 0x28], 0x63746150
mov dword [rsp + 0x2c], 0x72685468
mov dword [rsp + 0x30], 0x57646165
mov dword [rsp + 0x34], 0x6f646e69
mov dword [rsp + 0x38], 0x7377
call fcn.140029ab4
test eax, eax
jne 0x140057679
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
mov edx, ebx
mov rcx, rdi
call fcn.140005ac8
cmp al, 1
jne 0x140057679
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x140057679
cmp eax, ebx
jae 0x140057679
mov edx, eax
mov ecx, 0x90e
call fcn.140029bac
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008c320
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14005864c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r13d, 0xc0000001
mov rsi, r8
mov r14, rdx
mov ebx, r13d
mov rdi, rcx
call fcn.14007d45c
cmp eax, 2
jbe 0x14005886d
mov eax, 0x3a
xor r15d, r15d
mov dword [rbp - 0x11], 0x3f005c
lea ebx, [rax - 0xa]
mov dword [rbp - 0xd], 0x5c003f
mov dword [rbp - 7], eax
cmp word [rdi + 2], ax
jne 0x140058748
movzx eax, word [rdi]
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x61]
mov word [rbp - 9], ax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x68], pe_nt_image_headers64
xorps xmm0, xmm0
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], r15d
movdqu xmmword [rbp - 0x31], xmm0
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], 1
lea rax, [rbp - 0x61]
mov dword [rsp + 0x30], 3
lea r9, [rbp - 0x21]
lea r8, [rbp - 0x51]
mov edx, 0xc0000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rbp - 0x51], ebx
mov qword [rbp - 0x49], r15
mov qword [rsp + 0x20], r15
mov dword [rbp - 0x39], 0x240
mov qword [rbp - 0x41], rax
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
mov ebx, eax
test eax, eax
jns 0x14005886d
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
lea rax, [rbp - 0x69]
xor r9d, r9d
mov r8, qword [r8]
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
js 0x14005886a
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x14005886a
mov r14, qword [rcx + 8]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
movabs rdi, 0xfffff78000000030
mov rcx, rdi
mov ebx, r13d
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x1400587e9
movabs rax, 0xfffff78000000032
mov ecx, 0x3a
cmp cx, word [rax]
jne 0x1400587e9
lea r13d, [rcx + 0x22]
movabs rax, 0xfffff78000000034
cmp r13w, word [rax]
jne 0x1400587e9
movzx eax, word [rdi]
lea rcx, [rbp - 0x11]
mov r8, rsi
mov rdx, r14
mov word [rbp - 9], ax
call fcn.140058d98
cmp al, 1
je 0x140058865
mov edi, r15d
mov eax, 0x30
lea rcx, [rbp - 0x11]
mov r8, rsi
add eax, edi
mov rdx, r14
mov dword [rbp - 0x11], 0x44005c
mov dword [rbp - 0xd], 0x760065
mov dword [rbp - 9], 0x630069
mov dword [rbp - 5], 0x5c0065
mov word [rbp + 0x1b], ax
mov dword [rbp - 1], 0x610048
mov dword [rbp + 3], 0x640072
mov dword [rbp + 7], 0x690064
mov dword [rbp + 0xb], 0x6b0073
mov dword [rbp + 0xf], 0x6f0056
mov dword [rbp + 0x13], 0x75006c
mov dword [rbp + 0x17], 0x65006d
mov word [rbp + 0x1d], r15w
call fcn.140058d98
cmp al, 1
je 0x140058865
inc edi
cmp edi, 0x1a
jb 0x1400587ec
jmp 0x14005886d
mov ebx, r15d
jmp 0x14005886d
mov ebx, r13d
mov eax, ebx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x100
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14005985c
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x58]
call fcn.1400013f0
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
add rsp, 0x20
pop rbx
ret

Function at 0x1400609e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, rcx
xor ebx, ebx
mov ecx, 0x361
mov dword [rsp + 0x20], ebx
mov edi, edx
call fcn.140029ab4
mov rsi, rax
test rax, rax
je 0x140060a8b
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
mov edx, edi
mov rcx, rbp
mov dword [rsp + 0x28], 0x7369644e
mov dword [rsp + 0x2c], 0x65726544
mov dword [rsp + 0x30], 0x74736967
mov dword [rsp + 0x34], 0x72507265
mov dword [rsp + 0x38], 0x636f746f
mov dword [rsp + 0x3c], 0x6c6f
call fcn.140005ac8
cmp al, 1
jne 0x140060a8b
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x140060a8b
cmp eax, edi
jae 0x140060a8b
mov edx, eax
mov ecx, 0x364
call fcn.140029bac
mov edx, dword [rsp + 0x20]
mov ecx, 0x365
add rdx, rsi
call fcn.140029bac
mov bl, 1
mov al, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008c320
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140060aac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, rcx
xor ebx, ebx
mov ecx, 0x361
mov dword [rbp - 0x30], ebx
mov edi, edx
call fcn.140029ab4
mov rsi, rax
test rax, rax
je 0x140060b5b
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x28]
mov edx, edi
mov rcx, r14
mov dword [rbp - 0x28], 0x7369644e
mov dword [rbp - 0x24], 0x67655246
mov dword [rbp - 0x20], 0x65747369
mov dword [rbp - 0x1c], 0x6c694672
mov dword [rbp - 0x18], 0x44726574
mov dword [rbp - 0x14], 0x65766972
mov dword [rbp - 0x10], 0x72
call fcn.140005ac8
cmp al, 1
jne 0x140060b5b
mov eax, dword [rbp - 0x30]
test eax, eax
je 0x140060b5b
cmp eax, edi
jae 0x140060b5b
mov edx, eax
mov ecx, 0x367
call fcn.140029bac
mov edx, dword [rbp - 0x30]
mov ecx, 0x368
add rdx, rsi
call fcn.140029bac
mov bl, 1
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140060b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rcx
xor ebx, ebx
mov ecx, 0x361
mov dword [rbp - 0x40], ebx
mov edi, edx
call fcn.140029ab4
mov rsi, rax
test rax, rax
je 0x140060c37
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x38]
mov edx, edi
mov rcx, r14
mov dword [rbp - 0x38], 0x7369644e
mov dword [rbp - 0x34], 0x6e494d49
mov dword [rbp - 0x30], 0x61697469
mov dword [rbp - 0x2c], 0x657a696c
mov dword [rbp - 0x28], 0x69766544
mov dword [rbp - 0x24], 0x6e496563
mov dword [rbp - 0x20], 0x6e617473
mov qword [rbp - 0x1c], 0x78456563
call fcn.140005ac8
cmp al, 1
jne 0x140060c37
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x140060c37
cmp eax, edi
jae 0x140060c37
mov edx, eax
mov ecx, 0x36a
call fcn.140029bac
mov edx, dword [rbp - 0x40]
mov ecx, 0x36b
add rdx, rsi
call fcn.140029bac
mov bl, 1
mov al, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140060c5c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, rcx
xor ebx, ebx
mov ecx, 0x361
mov dword [rbp - 0x30], ebx
mov edi, edx
call fcn.140029ab4
mov rsi, rax
test rax, rax
je 0x140060d0b
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x28]
mov edx, edi
mov rcx, r14
mov dword [rbp - 0x28], 0x7369644e
mov dword [rbp - 0x24], 0x65446649
mov dword [rbp - 0x20], 0x69676572
mov dword [rbp - 0x1c], 0x72657473
mov dword [rbp - 0x18], 0x65746e49
mov dword [rbp - 0x14], 0x63616672
mov dword [rbp - 0x10], 0x65
call fcn.140005ac8
cmp al, 1
jne 0x140060d0b
mov eax, dword [rbp - 0x30]
test eax, eax
je 0x140060d0b
cmp eax, edi
jae 0x140060d0b
mov edx, eax
mov ecx, 0x380
call fcn.140029bac
mov edx, dword [rbp - 0x30]
mov ecx, 0x381
add rdx, rsi
call fcn.140029bac
mov bl, 1
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140060d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, rcx
xor ebx, ebx
mov ecx, 0x361
mov dword [rbp - 0x30], ebx
mov edi, edx
call fcn.140029ab4
mov rsi, rax
test rax, rax
je 0x140060dd9
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x28]
mov edx, edi
mov rcx, r14
mov dword [rbp - 0x28], 0x7369644e
mov dword [rbp - 0x24], 0x65446649
mov dword [rbp - 0x20], 0x69676572
mov dword [rbp - 0x1c], 0x72657473
mov dword [rbp - 0x18], 0x766f7250
mov qword [rbp - 0x14], 0x72656469
call fcn.140005ac8
cmp al, 1
jne 0x140060dd9
mov eax, dword [rbp - 0x30]
test eax, eax
je 0x140060dd9
cmp eax, edi
jae 0x140060dd9
mov edx, eax
mov ecx, 0x37a
call fcn.140029bac
mov edx, dword [rbp - 0x30]
mov ecx, 0x37b
add rdx, rsi
call fcn.140029bac
mov bl, 1
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1400613bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, rcx
xor ebx, ebx
mov ecx, 0x361
mov dword [rsp + 0x20], ebx
mov edi, edx
call fcn.140029ab4
mov rsi, rax
test rax, rax
je 0x140061467
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
mov edx, edi
mov rcx, rbp
mov dword [rsp + 0x28], 0x7369644e
mov dword [rsp + 0x2c], 0x65526649
mov dword [rsp + 0x30], 0x74736967
mov dword [rsp + 0x34], 0x6e497265
mov dword [rsp + 0x38], 0x66726574
mov dword [rsp + 0x3c], 0x656361
call fcn.140005ac8
cmp al, 1
jne 0x140061467
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x140061467
cmp eax, edi
jae 0x140061467
mov edx, eax
mov ecx, 0x37c
call fcn.140029bac
mov edx, dword [rsp + 0x20]
mov ecx, 0x37d
add rdx, rsi
call fcn.140029bac
mov bl, 1
mov al, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008c320
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret