joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002d80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002e53
cmp byte [rcx + 0x71], 0
je 0x140002e53
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140002e4f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002e14
sub eax, 1
je 0x140002e18
cmp eax, 2
jne 0x140002e4f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003ad0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002e46
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002e4f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140002dfc
xor al, al
jmp 0x140002dfc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003ad0
add rsp, 0x60
pop rbx
ret

Function at 0x140004464
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400044ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400044ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400044ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400044ae
cmp dword [rcx + 0x84], 0xe
jbe 0x1400044ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400044b0
xor al, al
add rsp, 0x28
ret
Function at 0x140001f68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0xa8
mov word [rsp + 0x20], 0x3f
mov word [rsp + 0x22], 0x35
mov word [rsp + 0x24], 0x48
mov word [rsp + 0x26], 0x4a
mov word [rsp + 0x28], 0x4c
mov word [rsp + 0x2a], 0x56
mov word [rsp + 0x2c], 0x57
mov word [rsp + 0x2e], 0x55
mov word [rsp + 0x30], 0x5c
mov word [rsp + 0x32], 0x3f
mov word [rsp + 0x34], 0x30
mov word [rsp + 0x36], 0x44
mov word [rsp + 0x38], 0x46
mov word [rsp + 0x3a], 0x4b
mov word [rsp + 0x3c], 0x4c
mov word [rsp + 0x3e], 0x51
mov word [rsp + 0x40], 0x48
mov word [rsp + 0x42], 0x3f
mov word [rsp + 0x44], 0x36
mov word [rsp + 0x46], 0x3c
mov word [rsp + 0x48], 0x36
mov word [rsp + 0x4a], 0x37
mov word [rsp + 0x4c], 0x28
mov word [rsp + 0x4e], 0x30
mov word [rsp + 0x50], 0x3f
mov word [rsp + 0x52], 0x26
mov word [rsp + 0x54], 0x58
mov word [rsp + 0x56], 0x55
mov word [rsp + 0x58], 0x55
mov word [rsp + 0x5a], 0x48
mov word [rsp + 0x5c], 0x51
mov word [rsp + 0x5e], 0x57
mov word [rsp + 0x60], 0x26
mov word [rsp + 0x62], 0x52
mov word [rsp + 0x64], 0x51
mov word [rsp + 0x66], 0x57
mov word [rsp + 0x68], 0x55
mov word [rsp + 0x6a], 0x52
mov word [rsp + 0x6c], 0x4f
mov word [rsp + 0x6e], 0x36
mov word [rsp + 0x70], 0x48
mov word [rsp + 0x72], 0x57
mov word [rsp + 0x74], 0x3f
mov word [rsp + 0x76], 0x36
mov word [rsp + 0x78], 0x48
mov word [rsp + 0x7a], 0x55
mov word [rsp + 0x7c], 0x59
mov word [rsp + 0x7e], 0x4c
mov word [rsp + 0x80], 0x46
mov word [rsp + 0x82], 0x48
mov word [rsp + 0x84], 0x56
mov word [rsp + 0x86], 0x3f
mov word [rsp + 0x88], 0x38
mov word [rsp + 0x8a], 0x56
mov word [rsp + 0x8c], 0x52
mov word [rsp + 0x8e], 0x36
mov word [rsp + 0x90], 0x59
mov word [rsp + 0x92], 0x46
mov word [rsp + 0x94], 0xe3
cmp byte [0x14059aae8], 0
jne 0x14000216f
mov byte [0x14059ab76], 1
mov eax, 0
lea rcx, [0x14059ab00]
movzx edx, word [rsp + rax*2 + 0x20]
mov word [rcx + rax*2], dx
add rax, 1
cmp rax, 0x3b
jne 0x140002149
mov byte [0x14059aae8], 1
lea rcx, [0x14000161f]
call fcn.1400014f0
lea rax, [0x14059ab00]
add rsp, 0xa8
ret
Function at 0x14000217e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0xa8
mov word [rsp + 0x20], 0x79
mov word [rsp + 0x22], 0x6f
mov word [rsp + 0x24], 0x82
mov word [rsp + 0x26], 0x84
mov word [rsp + 0x28], 0x86
mov word [rsp + 0x2a], 0x90
mov word [rsp + 0x2c], 0x91
mov word [rsp + 0x2e], 0x8f
mov word [rsp + 0x30], 0x96
mov word [rsp + 0x32], 0x79
mov word [rsp + 0x34], 0x6a
mov word [rsp + 0x36], 0x7e
mov word [rsp + 0x38], pe_nt_image_headers64
mov word [rsp + 0x3a], 0x85
mov word [rsp + 0x3c], 0x86
mov word [rsp + 0x3e], 0x8b
mov word [rsp + 0x40], 0x82
mov word [rsp + 0x42], 0x79
mov word [rsp + 0x44], 0x70
mov word [rsp + 0x46], 0x76
mov word [rsp + 0x48], 0x70
mov word [rsp + 0x4a], 0x71
mov word [rsp + 0x4c], 0x62
mov word [rsp + 0x4e], 0x6a
mov word [rsp + 0x50], 0x79
mov word [rsp + 0x52], 0x60
mov word [rsp + 0x54], 0x92
mov word [rsp + 0x56], 0x8f
mov word [rsp + 0x58], 0x8f
mov word [rsp + 0x5a], 0x82
mov word [rsp + 0x5c], 0x8b
mov word [rsp + 0x5e], 0x91
mov word [rsp + 0x60], 0x60
mov word [rsp + 0x62], 0x8c
mov word [rsp + 0x64], 0x8b
mov word [rsp + 0x66], 0x91
mov word [rsp + 0x68], 0x8f
mov word [rsp + 0x6a], 0x8c
mov word [rsp + 0x6c], 0x89
mov word [rsp + 0x6e], 0x70
mov word [rsp + 0x70], 0x82
mov word [rsp + 0x72], 0x91
mov word [rsp + 0x74], 0x79
mov word [rsp + 0x76], 0x70
mov word [rsp + 0x78], 0x82
mov word [rsp + 0x7a], 0x8f
mov word [rsp + 0x7c], 0x93
mov word [rsp + 0x7e], 0x86
mov word [rsp + pe_nt_image_headers64], 0x80
mov word [rsp + 0x82], 0x82
mov word [rsp + 0x84], 0x90
mov word [rsp + 0x86], 0x79
mov word [rsp + 0x88], 0x94
mov word [rsp + 0x8a], 0x92
mov word [rsp + 0x8c], 0x7e
mov word [rsp + 0x8e], 0x92
mov word [rsp + 0x90], 0x90
mov word [rsp + 0x92], 0x82
mov word [rsp + 0x94], 0x8f
mov word [rsp + 0x96], 0x93
mov word [rsp + 0x98], 0x1d
cmp byte [0x14059a940], 0
jne 0x140002399
mov byte [0x14059a9da], 1
mov eax, 0
lea rcx, [0x14059a960]
movzx edx, word [rsp + rax*2 + 0x20]
mov word [rcx + rax*2], dx
add rax, 1
cmp rax, 0x3d
jne 0x140002373
mov byte [0x14059a940], 1
lea rcx, [0x14000168a]
call fcn.1400014f0
lea rax, [0x14059a960]
add rsp, 0xa8
ret

Function at 0x1400025b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x67
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x64
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059a610], 0
jne 0x140002644
mov byte [0x14059a62f], 1
mov eax, 0
lea rcx, [0x14059a620]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x14000261f
mov byte [0x14059a610], 1
lea rcx, [0x140001775]
call fcn.1400014f0
lea rax, [0x14059a620]
add rsp, 0x38
ret
Function at 0x140002650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x64
mov byte [rsp + 0x23], 0x54
mov byte [rsp + 0x24], 0x52
mov byte [rsp + 0x25], 0x5f
mov byte [rsp + 0x26], 0x58
mov byte [rsp + 0x27], 0x66
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x55
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059a5b8], 0
jne 0x1400026e0
mov byte [0x14059a5cf], 1
mov eax, 0
lea rcx, [0x14059a5c0]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x1400026bb
mov byte [0x14059a5b8], 1
lea rcx, [0x1400017bd]
call fcn.1400014f0
lea rax, [0x14059a5c0]
add rsp, 0x38
ret

Function at 0x1400026ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x61
mov byte [rsp + 0x23], 0x54
mov byte [rsp + 0x24], 0x61
mov byte [rsp + 0x25], 0x63
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x65
mov byte [rsp + 0x28], 0x56
mov byte [rsp + 0x29], 0x54
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059a538], 0
jne 0x14000277c
mov byte [0x14059a54f], 1
mov eax, 0
lea rcx, [0x14059a540]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002757
mov byte [0x14059a538], 1
lea rcx, [0x14000181d]
call fcn.1400014f0
lea rax, [0x14059a540]
add rsp, 0x38
ret

Function at 0x140002788
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x66
mov byte [rsp + 0x23], 0x64
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x5f
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x63
mov byte [rsp + 0x28], 0x65
mov byte [rsp + 0x29], 0x60
mov byte [rsp + 0x2a], 0x5f
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059a478], 0
jne 0x140002818
mov byte [0x14059a48f], 1
mov eax, 0
lea rcx, [0x14059a480]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x1400027f3
mov byte [0x14059a478], 1
lea rcx, [0x1400018ad]
call fcn.1400014f0
lea rax, [0x14059a480]
add rsp, 0x38
ret
Function at 0x140002824
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x64
mov byte [rsp + 0x23], 0x66
mov byte [rsp + 0x24], 0x63
mov byte [rsp + 0x25], 0x57
mov byte [rsp + 0x26], 0x64
mov byte [rsp + 0x27], 0x59
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x5c
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059a388], 0
jne 0x1400028b4
mov byte [0x14059a39f], 1
mov eax, 0
lea rcx, [0x14059a390]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x14000288f
mov byte [0x14059a388], 1
lea rcx, [0x14000196d]
call fcn.1400014f0
lea rax, [0x14059a390]
add rsp, 0x38
ret

Function at 0x1400028c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x67
mov byte [rsp + 0x28], 0x5a
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x52
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059a330], 0
jne 0x140002950
mov byte [0x14059a34f], 1
mov eax, 0
lea rcx, [0x14059a340]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x14000292b
mov byte [0x14059a330], 1
lea rcx, [0x1400019b5]
call fcn.1400014f0
lea rax, [0x14059a340]
add rsp, 0x38
ret

Function at 0x14000295c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x5c
mov byte [rsp + 0x23], 0x52
mov byte [rsp + 0x24], 0x64
mov byte [rsp + 0x25], 0x61
mov byte [rsp + 0x26], 0x56
mov byte [rsp + 0x27], 0x63
mov byte [rsp + 0x28], 0x64
mov byte [rsp + 0x29], 0x5c
mov byte [rsp + 0x2a], 0x6a
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059a268], 0
jne 0x1400029ec
mov byte [0x14059a27f], 1
mov eax, 0
lea rcx, [0x14059a270]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x1400029c7
mov byte [0x14059a268], 1
lea rcx, [0x140001a5d]
call fcn.1400014f0
lea rax, [0x14059a270]
add rsp, 0x38
ret
Function at 0x1400029f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x67
mov byte [rsp + 0x28], 0x5a
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x52
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059a0b0], 0
jne 0x140002a88
mov byte [0x14059a0cf], 1
mov eax, 0
lea rcx, [0x14059a0c0]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002a63
mov byte [0x14059a0b0], 1
lea rcx, [0x140001bad]
call fcn.1400014f0
lea rax, [0x14059a0c0]
add rsp, 0x38
ret

Function at 0x140002a94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x53
mov byte [rsp + 0x23], 0x66
mov byte [rsp + 0x24], 0x5d
mov byte [rsp + 0x25], 0x5d
mov byte [rsp + 0x26], 0x58
mov byte [rsp + 0x27], 0x66
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x55
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x14059a050], 0
jne 0x140002b24
mov byte [0x14059a06f], 1
mov eax, 0
lea rcx, [0x14059a060]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002aff
mov byte [0x14059a050], 1
lea rcx, [0x140001bf5]
call fcn.1400014f0
lea rax, [0x14059a060]
add rsp, 0x38
ret

Function at 0x140002b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x55
mov byte [rsp + 0x27], 0x63
mov byte [rsp + 0x28], 0x68
mov byte [rsp + 0x29], 0x56
mov byte [rsp + 0x2a], 0x53
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x140599ff8], 0
jne 0x140002bc0
mov byte [0x14059a00f], 1
mov eax, 0
lea rcx, [0x14059a000]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002b9b
mov byte [0x140599ff8], 1
lea rcx, [0x140001c3d]
call fcn.1400014f0
lea rax, [0x14059a000]
add rsp, 0x38
ret
Function at 0x140002bcc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x6b
mov byte [rsp + 0x23], 0x60
mov byte [rsp + 0x24], 0x5f
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x5d
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x5e
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x140599ee8], 0
jne 0x140002c5c
mov byte [0x140599eff], 1
mov eax, 0
lea rcx, [0x140599ef0]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002c37
mov byte [0x140599ee8], 1
lea rcx, [0x140001d15]
call fcn.1400014f0
lea rax, [0x140599ef0]
add rsp, 0x38
ret

Function at 0x140002c68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x65
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x65
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x5d
mov byte [rsp + 0x2a], 0x52
mov byte [rsp + 0x2b], 0x67
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x14059a5d0], 0
jne 0x140002d02
mov byte [0x14059a5f1], 1
mov eax, 0
lea rcx, [0x14059a5e0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140002cdd
mov byte [0x14059a5d0], 1
lea rcx, [0x1400017a5]
call fcn.1400014f0
lea rax, [0x14059a5e0]
add rsp, 0x48
ret

Function at 0x140002d0e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x53
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x65
mov byte [rsp + 0x24], 0x55
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x57
mov byte [rsp + 0x27], 0x56
mov byte [rsp + 0x28], 0x5f
mov byte [rsp + 0x29], 0x55
mov byte [rsp + 0x2a], 0x56
mov byte [rsp + 0x2b], 0x63
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x14059a4b8], 0
jne 0x140002da8
mov byte [0x14059a4d1], 1
mov eax, 0
lea rcx, [0x14059a4c0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140002d83
mov byte [0x14059a4b8], 1
lea rcx, [0x14000187d]
call fcn.1400014f0
lea rax, [0x14059a4c0]
add rsp, 0x48
ret
Function at 0x140002db4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x55
mov byte [rsp + 0x26], 0x61
mov byte [rsp + 0x27], 0x53
mov byte [rsp + 0x28], 0x60
mov byte [rsp + 0x29], 0x5d
mov byte [rsp + 0x2a], 0x67
mov byte [rsp + 0x2b], 0x68
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x5f
mov byte [rsp + 0x2e], 0x56
mov byte [rsp + 0x2f], 0x65
mov byte [rsp + 0x30], 0xf1
cmp byte [0x14059a1c0], 0
jne 0x140002e4e
mov byte [0x14059a1e1], 1
mov eax, 0
lea rcx, [0x14059a1d0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140002e29
mov byte [0x14059a1c0], 1
lea rcx, [0x140001ad5]
call fcn.1400014f0
lea rax, [0x14059a1d0]
add rsp, 0x48
ret

Function at 0x140002e5a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x59
mov byte [rsp + 0x22], 0x60
mov byte [rsp + 0x23], 0x5e
mov byte [rsp + 0x24], 0x56
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x64
mov byte [rsp + 0x27], 0x60
mov byte [rsp + 0x28], 0x61
mov byte [rsp + 0x29], 0x59
mov byte [rsp + 0x2a], 0x60
mov byte [rsp + 0x2b], 0x64
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x14059a168], 0
jne 0x140002ef4
mov byte [0x14059a181], 1
mov eax, 0
lea rcx, [0x14059a170]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140002ecf
mov byte [0x14059a168], 1
lea rcx, [0x140001b1d]
call fcn.1400014f0
lea rax, [0x14059a170]
add rsp, 0x48
ret

Function at 0x140002f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x52
mov byte [rsp + 0x26], 0x55
mov byte [rsp + 0x27], 0x52
mov byte [rsp + 0x28], 0x68
mov byte [rsp + 0x29], 0x52
mov byte [rsp + 0x2a], 0x63
mov byte [rsp + 0x2b], 0x56
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x14059a120], 0
jne 0x140002f9a
mov byte [0x14059a141], 1
mov eax, 0
lea rcx, [0x14059a130]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140002f75
mov byte [0x14059a120], 1
lea rcx, [0x140001b4d]
call fcn.1400014f0
lea rax, [0x14059a130]
add rsp, 0x48
ret
Function at 0x140002fa6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x64
mov byte [rsp + 0x26], 0x54
mov byte [rsp + 0x27], 0x52
mov byte [rsp + 0x28], 0x5f
mov byte [rsp + 0x29], 0x58
mov byte [rsp + 0x2a], 0x66
mov byte [rsp + 0x2b], 0x52
mov byte [rsp + 0x2c], 0x63
mov byte [rsp + 0x2d], 0x55
mov byte [rsp + 0x2e], 0x1f
mov byte [rsp + 0x2f], 0x54
mov byte [rsp + 0x30], 0x60
mov byte [rsp + 0x31], 0x5e
mov byte [rsp + 0x32], 0xf1
cmp byte [0x14059a598], 0
jne 0x14000304a
mov byte [0x14059a5b3], 1
mov eax, 0
lea rcx, [0x14059a5a0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x13
jne 0x140003025
mov byte [0x14059a598], 1
lea rcx, [0x1400017d5]
call fcn.1400014f0
lea rax, [0x14059a5a0]
add rsp, 0x48
ret

Function at 0x140003056
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x61
mov byte [rsp + 0x26], 0x54
mov byte [rsp + 0x27], 0x61
mov byte [rsp + 0x28], 0x63
mov byte [rsp + 0x29], 0x60
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x2b], 0x56
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x65
mov byte [rsp + 0x2e], 0x1f
mov byte [rsp + 0x2f], 0x54
mov byte [rsp + 0x30], 0x60
mov byte [rsp + 0x31], 0x5e
mov byte [rsp + 0x32], 0xf1
cmp byte [0x14059a510], 0
jne 0x1400030fa
mov byte [0x14059a533], 1
mov eax, 0
lea rcx, [0x14059a520]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x13
jne 0x1400030d5
mov byte [0x14059a510], 1
lea rcx, [0x140001835]
call fcn.1400014f0
lea rax, [0x14059a520]
add rsp, 0x48
ret

Function at 0x140003106
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x66
mov byte [rsp + 0x26], 0x64
mov byte [rsp + 0x27], 0x1f
mov byte [rsp + 0x28], 0x5f
mov byte [rsp + 0x29], 0x60
mov byte [rsp + 0x2a], 0x63
mov byte [rsp + 0x2b], 0x65
mov byte [rsp + 0x2c], 0x60
mov byte [rsp + 0x2d], 0x5f
mov byte [rsp + 0x2e], 0x1f
mov byte [rsp + 0x2f], 0x54
mov byte [rsp + 0x30], 0x60
mov byte [rsp + 0x31], 0x5e
mov byte [rsp + 0x32], 0xf1
cmp byte [0x14059a458], 0
jne 0x1400031aa
mov byte [0x14059a473], 1
mov eax, 0
lea rcx, [0x14059a460]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x13
jne 0x140003185
mov byte [0x14059a458], 1
lea rcx, [0x1400018c5]
call fcn.1400014f0
lea rax, [0x14059a460]
add rsp, 0x48
ret