joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x140027678]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x180039
mov dword [rbp - 0x1c], 0x190028
mov dword [rbp - 0x18], 0x42000f
mov dword [rbp - 0x14], 0x4b007a
mov dword [rbp - 0x10], 0x280036
mov dword [rbp - 0xc], 0x46002e
call fcn.140003670
mov rcx, rax
call rbx
mov rbx, qword [0x140027678]
lea rcx, [rbp - 0x20]
mov qword [0x140027658], rax
mov dword [rbp - 0x20], 0x19003d
mov dword [rbp - 0x1c], 0x1c0023
mov dword [rbp - 0x18], 0x14000d
mov dword [rbp - 0x14], 0x4b003c
mov dword [rbp - 0x10], 0x280036
mov dword [rbp - 0xc], 0x46002e
call fcn.140003670
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x140010540]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140027648]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x140027668], rax
mov word [rbp - 0x10], 0x40c
mov byte [rbp - 0xe], 0x56
call fcn.140005550
mov rcx, qword [0x140027658]
mov rdx, rax
call rbx
mov rbx, qword [0x140027648]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x19281839
mov dword [rbp - 0x1c], 0x30340f
mov dword [rbp - 0x18], 0x23363131
mov word [rbp - 0x14], 0x5318
call fcn.140003de0
mov rcx, qword [0x140027658]
mov rdx, rax
call rbx
mov rbx, qword [0x140027648]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x10391e23
mov dword [rbp - 0x1c], 0x112d1f11
mov dword [rbp - 0x18], 0x2827341d
mov word [rbp - 0x14], 0x530e
call fcn.140003de0
mov rcx, qword [0x140027668]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140010600]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140027648]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400275f8], rax
mov byte [rbp - 0x10], 0x7a
call fcn.140005260
mov rcx, qword [0x140027668]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400105a0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140027648]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x140027600], rax
mov dword [rbp - 0x10], 0x66333f1e
call fcn.140003310
mov rcx, qword [0x140027668]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140010510]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140027648]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400275f0], rax
mov byte [rbp - 0x10], 0x7a
call fcn.140005260
mov rcx, qword [0x140027668]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400104b0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140027648]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400275e8], rax
mov dword [rbp - 0x10], 0x27383c13
mov byte [rbp - 0xc], 0x71
call fcn.140004060
mov rcx, qword [0x140027668]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140010570]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140027648]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x1214
mov byte [rbp - 0xe], 0x56
call fcn.140005550
mov rcx, qword [0x140027668]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x14000e420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0xf8
call fcn.14000d1d0
movdqa xmm0, xmmword [str.9__v_40]
lea rcx, [rbp - 0x59]
movdqa xmm1, xmmword [0x140010620]
xor ebx, ebx
movdqu xmmword [rbp - 0x59], xmm0
mov qword [rbp + 0x6f], rbx
movdqa xmm0, xmmword [0x1400105c0]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp + 0x67], ebx
movdqu xmmword [rbp - 0x49], xmm1
mov word [rbp - 0x29], 0x3d30
mov byte [rbp - 0x27], 0x58
call fcn.140002230
mov rdx, rax
xor r9d, r9d
lea rax, [rbp + 0x67]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rcx, 0xffffffff80000001
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000a4d3
mov rcx, qword [rbp + 0x6f]
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xe8], r12
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xd0], r15
call fcn.14000a780
mov eax, 0x56
mov dword [rbp - 0x59], 0x14002b
lea rcx, [rbp - 0x59]
mov word [rbp - 0x35], ax
mov dword [rbp - 0x55], 0x170022
mov dword [rbp - 0x51], 0x510006
mov dword [rbp - 0x4d], 0xa000e
mov dword [rbp - 0x49], 0x30003c
mov dword [rbp - 0x45], 0x160062
mov dword [rbp - 0x41], 0x30002e
mov dword [rbp - 0x3d], 0x100001
mov dword [rbp - 0x39], 0x36001d
call fcn.140001b30
lea rcx, [rbp - 0x25]
mov dword [rbp - 0x25], 0x18003e
mov rbx, rax
mov dword [rbp - 0x21], 0x550028
mov dword [rbp - 0x1d], 0x1e0005
mov dword [rbp - 0x19], 0x110026
mov dword [rbp - 0x15], 0x640021
mov dword [rbp - 0x11], 0x270035
mov dword [rbp - 0xd], 0x73003c
mov dword [rbp - 9], 0x40019
mov dword [rbp - 5], 0x300019
mov dword [rbp - 1], 0x150033
mov dword [rbp + 3], 0x170002
mov dword [rbp + 7], 0x2f003d
mov dword [rbp + 0xb], 0x360016
mov dword [rbp + 0xf], 0x300045
mov dword [rbp + 0x13], 0x36000c
mov dword [rbp + 0x17], 0x220026
mov dword [rbp + 0x1b], 0x38003b
mov dword [rbp + 0x1f], 0x20002
mov dword [rbp + 0x23], 0x47004d
call fcn.140001eb0
mov r9d, 0x40
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r15, qword [rsp + 0xd0]
mov al, 1
mov r14, qword [rsp + 0xd8]
mov r13, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0x120]
add rsp, 0xf8
pop rbx
pop rbp
ret
xor al, al
add rsp, 0xf8
pop rbx
pop rbp
ret
jmp 0x14000a2d0
Function at 0x14000af50
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.14000d360
movzx eax, al
test eax, eax
je 0x14000af85
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.140009740
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400159a0
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14005c678]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], 0x23
mov byte [rsp + 0x38], 0xae
mov byte [rsp + 0x39], 0xc7
mov byte [rsp + 0x3a], 0xec
mov byte [rsp + 0x3b], 0xd
mov byte [rsp + 0x3c], 0xa
mov byte [rsp + 0x3d], 0x88
mov byte [rsp + 0x3e], 0x4d
mov byte [rsp + 0x3f], 0x52
mov byte [rsp + 0x40], 0xa9
mov byte [rsp + 0x41], 0xdb
mov byte [rsp + 0x42], 0xe8
mov byte [rsp + 0x43], 0x11
mov byte [rsp + 0x44], 0x65
mov byte [rsp + 0x45], 0x96
mov byte [rsp + 0x46], 0x23
mov byte [rsp + 0x47], 0x37
mov byte [rsp + 0x48], 0xb8
mov byte [rsp + 0x49], 0xdb
mov byte [rsp + 0x4a], 0xe2
mov byte [rsp + 0x4b], 2
mov byte [rsp + 0x4c], 0x11
mov byte [rsp + 0x4d], 0x9a
mov byte [rsp + 0x4e], 0x4d
mov byte [rsp + 0x4f], 0x54
mov byte [rsp + 0x50], 0xb4
mov byte [rsp + 0x51], 0xc7
mov byte [rsp + 0x52], 0xe1
mov byte [rsp + 0x53], 0xa
mov byte [rsp + 0x54], 2
mov byte [rsp + 0x55], 0xff
mov byte [rsp + 0x56], 0x2b
mov byte [rsp + 0x57], 0x42
mov byte [rsp + 0x58], 0xb5
mov byte [rsp + 0x59], 0xca
mov byte [rsp + 0x5a], 0xa7
mov eax, 0x4dc
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x140015b18
mov eax, 0x4dc
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x14005e460]
mov rcx, qword gs:[0x58]
mov edx, 0x4dc
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x4b8
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.140011d80
lea rcx, [0x140036fb0]
call fcn.140031990
nop
mov eax, 0x4b8
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400317d0
add rsp, 0x78
ret
Function at 0x140015cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14005c678]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0x11
mov byte [rsp + 0x38], 0x2c
mov byte [rsp + 0x39], 0x68
mov byte [rsp + 0x3a], 0x2d
mov byte [rsp + 0x3b], 0x85
mov byte [rsp + 0x3c], 0xb7
mov byte [rsp + 0x3d], 0x7f
mov byte [rsp + 0x3e], 0x56
mov byte [rsp + 0x3f], 0x58
mov byte [rsp + 0x40], 0x1b
mov byte [rsp + 0x41], 0x4e
mov byte [rsp + 0x42], 0x36
mov byte [rsp + 0x43], 0xbf
mov byte [rsp + 0x44], 0xab
mov byte [rsp + 0x45], 0x68
mov byte [rsp + 0x46], 0x4b
mov byte [rsp + 0x47], 0x4d
mov byte [rsp + 0x48], 0x7f
mov eax, 0x174
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x140015dce
mov eax, 0x174
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x14005e460]
mov rcx, qword gs:[0x58]
mov edx, 0x174
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x160
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.1400118b0
lea rcx, [0x140037010]
call fcn.140031990
nop
mov eax, 0x160
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400317d0
add rsp, 0x68
ret
Function at 0x140016200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14005c678]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0xf
mov byte [rsp + 0x38], 0xac
mov byte [rsp + 0x39], 0xd7
mov byte [rsp + 0x3a], 0x44
mov byte [rsp + 0x3b], 0x80
mov byte [rsp + 0x3c], 0x21
mov byte [rsp + 0x3d], 0x46
mov byte [rsp + 0x3e], 0x61
mov byte [rsp + 0x3f], 0x5d
mov byte [rsp + 0x40], 0x80
mov byte [rsp + 0x41], 0xc6
mov byte [rsp + 0x42], 0x44
mov byte [rsp + 0x43], 0x92
mov byte [rsp + 0x44], 0x26
mov byte [rsp + 0x45], 0x62
mov byte [rsp + 0x46], 0x31
mov eax, 0x1d8
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x140016314
mov eax, 0x1d8
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x14005e460]
mov rcx, qword gs:[0x58]
mov edx, 0x1d8
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x1c8
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.140012330
lea rcx, [0x1400370d0]
call fcn.140031990
nop
mov eax, 0x1c8
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400317d0
add rsp, 0x58
ret

Function at 0x140016750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14005c678]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0xd
mov byte [rsp + 0x38], 0xd
mov byte [rsp + 0x39], 0x3a
mov byte [rsp + 0x3a], 0x87
mov byte [rsp + 0x3b], 0x66
mov byte [rsp + 0x3c], 0xbe
mov byte [rsp + 0x3d], 0x77
mov byte [rsp + 0x3e], 0x50
mov byte [rsp + 0x3f], 0x67
mov byte [rsp + 0x40], 0x55
mov byte [rsp + 0x41], 0x32
mov byte [rsp + 0x42], 0x8b
mov byte [rsp + 0x43], 0x6c
mov byte [rsp + 0x44], 0xd1
mov eax, 0x508
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x14001685a
mov eax, 0x508
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x14005e460]
mov rcx, qword gs:[0x58]
mov edx, 0x508
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x4f8
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.140012250
lea rcx, [0x140037190]
call fcn.140031990
nop
mov eax, 0x4f8
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400317d0
add rsp, 0x58
ret
Function at 0x140017210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14005c678]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0x18
mov byte [rsp + 0x38], 0xa
mov byte [rsp + 0x39], 0x6e
mov byte [rsp + 0x3a], 0x4d
mov byte [rsp + 0x3b], 8
mov byte [rsp + 0x3c], 0xe6
mov byte [rsp + 0x3d], 0x2a
mov byte [rsp + 0x3e], 0x42
mov byte [rsp + 0x3f], 0x63
mov byte [rsp + 0x40], 0x22
mov byte [rsp + 0x41], 0x72
mov byte [rsp + 0x42], 0x4d
mov byte [rsp + 0x43], 4
mov byte [rsp + 0x44], 0xc1
mov byte [rsp + 0x45], 0x12
mov byte [rsp + 0x46], 0x41
mov byte [rsp + 0x47], 0x7e
mov byte [rsp + 0x48], 0x11
mov byte [rsp + 0x49], 0x62
mov byte [rsp + 0x4a], 0x7c
mov byte [rsp + 0x4b], 3
mov byte [rsp + 0x4c], 0xd8
mov byte [rsp + 0x4d], 0x20
mov byte [rsp + 0x4e], 0x42
mov byte [rsp + 0x4f], 0x17
mov eax, 0x90c
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x140017351
mov eax, 0x90c
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x14005e460]
mov rcx, qword gs:[0x58]
mov edx, 0x90c
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x8f0
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.140011b50
lea rcx, [0x1400372b0]
call fcn.140031990
nop
mov eax, 0x8f0
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400317d0
add rsp, 0x68
ret
Function at 0x140017530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14005c678]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], 0x1e
mov byte [rsp + 0x38], 0x9a
mov byte [rsp + 0x39], 0xc7
mov byte [rsp + 0x3a], 0x54
mov byte [rsp + 0x3b], 0x12
mov byte [rsp + 0x3c], 0x2d
mov byte [rsp + 0x3d], 0xf8
mov byte [rsp + 0x3e], 0x5f
mov byte [rsp + 0x3f], 0x8e
mov byte [rsp + 0x40], 0x96
mov byte [rsp + 0x41], 0xdb
mov byte [rsp + 0x42], 0x57
mov byte [rsp + 0x43], 0x1a
mov byte [rsp + 0x44], 0x3e
mov byte [rsp + 0x45], 0x9d
mov byte [rsp + 0x46], 0x39
mov byte [rsp + 0x47], 0x98
mov byte [rsp + 0x48], 0x97
mov byte [rsp + 0x49], 0xd6
mov byte [rsp + 0x4a], 0x45
mov byte [rsp + 0x4b], 0x1a
mov byte [rsp + 0x4c], 0x36
mov byte [rsp + 0x4d], 0xf3
mov byte [rsp + 0x4e], 0x5f
mov byte [rsp + 0x4f], 0x8e
mov byte [rsp + 0x50], 0x98
mov byte [rsp + 0x51], 0xd9
mov byte [rsp + 0x52], 0x5d
mov byte [rsp + 0x53], 0x16
mov byte [rsp + 0x54], 0x3d
mov byte [rsp + 0x55], 0xbd
mov eax, 0x338
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x14001768f
mov eax, 0x338
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x14005e460]
mov rcx, qword gs:[0x58]
mov edx, 0x338
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x318
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.140011ca0
lea rcx, [0x140037310]
call fcn.140031990
nop
mov eax, 0x318
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400317d0
add rsp, 0x68
ret
Function at 0x140017830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14005c678]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], 0x29
mov byte [rsp + 0x38], 0x5f
mov byte [rsp + 0x39], 0xa6
mov byte [rsp + 0x3a], 0x93
mov byte [rsp + 0x3b], 0x4c
mov byte [rsp + 0x3c], 0x11
mov byte [rsp + 0x3d], 0x50
mov byte [rsp + 0x3e], 0xa4
mov byte [rsp + 0x3f], 0x52
mov byte [rsp + 0x40], 0x39
mov byte [rsp + 0x41], 0xb4
mov byte [rsp + 0x42], 0x98
mov byte [rsp + 0x43], 0x5b
mov byte [rsp + 0x44], 0x65
mov byte [rsp + 0x45], 0x4d
mov byte [rsp + 0x46], 0xae
mov byte [rsp + 0x47], 0x52
mov byte [rsp + 0x48], 0x49
mov byte [rsp + 0x49], 0xd3
mov byte [rsp + 0x4a], 0x9b
mov byte [rsp + 0x4b], 0x40
mov byte [rsp + 0x4c], 9
mov byte [rsp + 0x4d], 0x5d
mov byte [rsp + 0x4e], 0xae
mov byte [rsp + 0x4f], 0x4d
mov byte [rsp + 0x50], 0x39
mov byte [rsp + 0x51], 0xa3
mov byte [rsp + 0x52], 0x9c
mov byte [rsp + 0x53], 0x5b
mov byte [rsp + 0x54], 0xd
mov byte [rsp + 0x55], 0x39
mov byte [rsp + 0x56], 0xbc
mov byte [rsp + 0x57], 0x5e
mov byte [rsp + 0x58], 0x4a
mov byte [rsp + 0x59], 0xd3
mov byte [rsp + 0x5a], 0x9e
mov byte [rsp + 0x5b], 0x4e
mov byte [rsp + 0x5c], 9
mov byte [rsp + 0x5d], 0x55
mov byte [rsp + 0x5e], 0xae
mov byte [rsp + 0x5f], 0x5b
mov byte [rsp + 0x60], 0x19
mov eax, 0x284
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x1400179c6
mov eax, 0x284
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x14005e460]
mov rcx, qword gs:[0x58]
mov edx, 0x284
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x258
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.140011ed0
lea rcx, [0x140037370]
call fcn.140031990
nop
mov eax, 0x258
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400317d0
add rsp, 0x78
ret
Function at 0x140017a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14005c678]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0x11
mov byte [rsp + 0x38], 0x7e
mov byte [rsp + 0x39], 0x41
mov byte [rsp + 0x3a], 0x9e
mov byte [rsp + 0x3b], 0x73
mov byte [rsp + 0x3c], 0x3d
mov byte [rsp + 0x3d], 0xa
mov byte [rsp + 0x3e], 0xb1
mov byte [rsp + 0x3f], 0xbb
mov byte [rsp + 0x40], 0x7d
mov byte [rsp + 0x41], 0x47
mov byte [rsp + 0x42], 0x90
mov byte [rsp + 0x43], 0x66
mov byte [rsp + 0x44], 0x3b
mov byte [rsp + 0x45], 0xe
mov byte [rsp + 0x46], 0xb8
mov byte [rsp + 0x47], 0xd6
mov byte [rsp + 0x48], 0x2d
mov eax, 0xa7c
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x140017b1e
mov eax, 0xa7c
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x14005e460]
mov rcx, qword gs:[0x58]
mov edx, 0xa7c
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xa68
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.1400118b0
lea rcx, [0x1400373a0]
call fcn.140031990
nop
mov eax, 0xa68
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400317d0
add rsp, 0x68
ret
Function at 0x140017b50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14005c678]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], 0x1b
mov byte [rsp + 0x38], 0x67
mov byte [rsp + 0x39], 0x72
mov byte [rsp + 0x3a], 0x60
mov byte [rsp + 0x3b], 6
mov byte [rsp + 0x3c], 0x4d
mov byte [rsp + 0x3d], 1
mov byte [rsp + 0x3e], 0x5c
mov byte [rsp + 0x3f], 0x20
mov byte [rsp + 0x40], 9
mov byte [rsp + 0x41], 0x61
mov byte [rsp + 0x42], 1
mov byte [rsp + 0x43], 0x16
mov byte [rsp + 0x44], 0x2c
mov byte [rsp + 0x45], 0xb
mov byte [rsp + 0x46], 0x5f
mov byte [rsp + 0x47], 0x3c
mov byte [rsp + 0x48], 9
mov byte [rsp + 0x49], 0x62
mov byte [rsp + 0x4a], 1
mov byte [rsp + 0x4b], 0x10
mov byte [rsp + 0x4c], 0x35
mov byte [rsp + 0x4d], 0xe
mov byte [rsp + 0x4e], 0x47
mov byte [rsp + 0x4f], 0x5d
mov byte [rsp + 0x50], 0x77
mov byte [rsp + 0x51], 0xc
mov byte [rsp + 0x52], 0x21
mov eax, 0xa54
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x140017ca0
mov eax, 0xa54
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x14005e460]
mov rcx, qword gs:[0x58]
mov edx, 0xa54
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xa38
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.140011c30
lea rcx, [0x1400373d0]
call fcn.140031990
nop
mov eax, 0xa38
mov eax, eax
mov ecx, dword [0x14005e460]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400317d0
add rsp, 0x68
ret