joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009c40
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x140009cb7
movsxd rdx, ecx
lea rcx, [0x140009b9c]
call qword [sym.imp.USER32.DLL_EnumWindows]
mov rbx, qword [0x14001cd48]
test rbx, rbx
je 0x140009d2a
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140009cad
cmp byte [rbx + 0x20], 0
je 0x140009cad
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.DLL_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x140009c73
jmp 0x140009d2a
mov rbx, qword [0x14001cd48]
test rbx, rbx
je 0x140009d2a
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140009d22
cmp byte [rbx + 0x21], 0
je 0x140009ce6
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x140009d12
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.DLL_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x14001cd48]
call fcn.140013fa4
mov rbx, rdi
test rdi, rdi
jne 0x140009cc3
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140009e04
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x14001d6e0]
call fcn.14001374c
xor ebx, ebx
or esi, 0xffffffff
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dl, byte [rax]
test dl, dl
je 0x140009eca
mov rcx, qword [rsp + 0x30]
mov r10b, 0x20
lea r9d, [rbx + 1]
cmp dl, r10b
jne 0x140009e58
add rax, r9
cmp byte [rax], r10b
je 0x140009e50
mov dl, byte [rax]
mov r8d, r9d
cmp dl, 0x22
jne 0x140009e8e
add rax, r9
mov rbx, rax
mov cl, byte [rax]
test cl, cl
je 0x140009e89
cmp cl, 0x22
je 0x140009e7c
add rax, r9
mov cl, byte [rax]
test cl, cl
jne 0x140009e6e
cmp byte [rax], 0
je 0x140009e89
mov rcx, rax
add rax, r9
jmp 0x140009eb0
mov rcx, rax
jmp 0x140009eb0
test dl, dl
je 0x140009ead
mov rbx, rax
cmp dl, r10b
je 0x140009ea3
add rax, r9
mov dl, byte [rax]
test dl, dl
jne 0x140009e95
cmp byte [rax], 0
mov rcx, rax
je 0x140009eb0
jmp 0x140009e84
xor r8d, r8d
cmp dword [rbp], esi
jne 0x140009eba
test rdi, rdi
jne 0x140009ed4
test r8d, r8d
je 0x140009ec2
add esi, r9d
mov dl, byte [rax]
xor ebx, ebx
test dl, dl
jne 0x140009e4b
test rdi, rdi
jne 0x140009ee6
movsxd rax, esi
jmp 0x140009ee9
test rbx, rbx
je 0x140009ee6
sub ecx, ebx
mov rax, rbx
mov dword [rdi], ecx
add dword [rbp], r9d
jmp 0x140009ee9
and dword [rdi], 0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140009fc4
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x14001d6e0]
call fcn.14001374c
xor ecx, ecx
add rsp, 0x28
jmp fcn.140009e04
Function at 0x14000a03c
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x28
mov rax, rdx
test rcx, rcx
je 0x14000a05c
test rax, rax
lea rdx, [0x1400196e6]
cmovne rdx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
add rsp, 0x28
ret
Function at 0x14000af24
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
mov rbp, rsp
sub rsp, 0x60
cmp qword [rcx + 8], 0
mov rbx, rcx
mov esi, 0x40
jne 0x14000b098
mov rcx, qword [0x14001caa0]
xor edx, edx
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
and dword [rbx + 0x14], 0
lea edi, [rsi - 0x3c]
mov qword [rbx + 8], rax
mov edx, edi
xor r9d, r9d
mov rcx, qword [rbx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
cmp dword [rbx + 0x1c], 0x706c7a31
mov rcx, qword [rbx]
lea r9, [rbp + 0x20]
jne 0x14000afc7
lea rdx, [rbp - 0x18]
mov r8d, 0x18
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp + 0x20], 0x18
jne 0x14000b098
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x28], rax
movzx eax, word [rbp - 8]
mov word [rbp - 0x20], ax
jmp 0x14000afe1
lea rdx, [rbp - 0x30]
mov r8d, 0x12
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp + 0x20], 0x12
jne 0x14000b098
cmp dword [rbx + 0x14], esi
jl 0x14000b00a
mov r8, qword [rbx + 8]
mov rcx, qword [0x14001caa0]
add esi, 0x40
movsxd r9, esi
mov edx, 8
shl r9, 3
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rbx + 8], rax
movsx r8, word [rbp - 0x20]
mov rcx, qword [0x14001caa0]
xor edx, edx
add r8, 0x19
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbp - 0x30]
and qword [rsp + 0x20], 0
mov qword [rax], rcx
mov rcx, qword [rbp - 0x28]
lea rdx, [rax + 0x14]
mov qword [rax + 8], rcx
movsx r8d, word [rbp - 0x20]
mov rcx, qword [rbx]
lea r9, [rbp + 0x20]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsx r11, word [rbp - 0x20]
mov byte [r11 + r12 + 0x14], 0
cmp dword [rbx + 0x1c], 0x706c7a31
movsx rax, word [rbp - 0x20]
jne 0x14000b06f
lea edi, [rdi + rax + 0x18]
jmp 0x14000b073
lea edi, [rdi + rax + 0x12]
mov dword [r12 + 0x10], edi
movsxd rcx, dword [rbx + 0x14]
add edi, dword [rbp - 0x28]
mov rax, qword [rbx + 8]
mov r9d, 1
mov qword [rax + rcx*8], r12
inc dword [rbx + 0x14]
mov edx, dword [rbp - 0x28]
jmp 0x14000af71
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret

Function at 0x14000d034
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x14001d8a0]
call fcn.140013664
mov rsi, rax
test rax, rax
je 0x14000d0ad
mov rcx, qword [rax + 8]
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x14000d072
mov edx, ebx
mov rcx, rsi
call rax
jmp 0x14000d0ad
mov rcx, qword [rsi]
call qword [sym.imp.USER32.DLL_GetWindowTextLengthA]
mov edx, ebx
mov ecx, eax
mov edi, eax
call fcn.140014840
lea r8d, [rdi + 1]
mov byte [rax], 0
mov rcx, qword [rsi]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.USER32.DLL_GetWindowTextA]
mov rcx, rbx
call sub.msvcrt.dll_strlen
sub edi, eax
mov ecx, edi
call fcn.1400149e0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000e9bc
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.USER32.DLL_GetFocus]
mov rdi, rax
test rax, rax
je 0x14000ea65
mov ecx, 9
call qword [sym.imp.USER32.DLL_GetKeyState]
test al, al
jns 0x14000ea65
mov ecx, 0x11
call qword [sym.imp.USER32.DLL_GetKeyState]
test al, al
js 0x14000ea65
mov ecx, 0x10
call qword [sym.imp.USER32.DLL_GetKeyState]
test al, al
js 0x14000ea65
mov ecx, 0x12
call qword [sym.imp.USER32.DLL_GetKeyState]
test al, al
js 0x14000ea65
lea rdx, [rsp + 0x40]
mov r8d, 5
mov rcx, rdi
call qword [sym.imp.USER32.DLL_GetClassNameA]
lea rdx, str.Rich
lea rcx, [rsp + 0x40]
mov r8d, 4
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x14000ea65
xor r9d, r9d
xor r8d, r8d
mov edx, 0x44e
mov rcx, rdi
call qword [sym.imp.USER32.DLL_SendMessageA]
bt rax, 0xb
jae 0x14000eb0f
test rbx, rbx
je 0x14000eaa4
mov ecx, 0x11
call qword [sym.imp.USER32.DLL_GetKeyState]
test al, al
js 0x14000ea97
mov ecx, 0x10
call qword [sym.imp.USER32.DLL_GetKeyState]
test al, al
js 0x14000ea97
mov ecx, 0x12
call qword [sym.imp.USER32.DLL_GetKeyState]
test al, al
jns 0x14000eaa4
mov edx, 1
mov rcx, rbx
call fcn.14000e968
test rdi, rdi
je 0x14000eabe
lea rdx, str.PB_Hotkey
mov rcx, rdi
call qword [sym.imp.USER32.DLL_GetPropA]
test rax, rax
jne 0x14000eb0f
lea rdx, str.PB_WindowID
mov rcx, rbx
call qword [sym.imp.USER32.DLL_GetPropA]
mov rdi, rax
test rax, rax
je 0x14000eb0f
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x14000eb0f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x38], eax
jne 0x14000eb0f
mov rcx, qword [0x14001d8c0]
lea rdx, [rdi - 1]
call fcn.140013664
test rax, rax
je 0x14000eb0f
mov rax, qword [rax + 0x10]
jmp 0x14000eb11
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400107ec
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14001da40], eax
add rsp, 0x28
ret

Function at 0x140010804
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edx, ecx
mov ebx, 0x104
mov ecx, ebx
call fcn.140014840
mov ecx, ebx
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, str.Kernel32.DLL
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
test rax, rax
je 0x140010876
lea rdx, [0x140019cc8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001086d
mov r8d, ebx
mov rdx, rsi
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
sub ebx, edi
mov ecx, ebx
call fcn.1400149e0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
movsxd r11, edi
mov byte [r11 + rsi], 0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001089c
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400108c7
test dl, 2
je 0x1400108ba
mov edx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cdqe
jmp 0x1400108c9
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor edx, edx
jmp 0x14001089c

Function at 0x1400108d0
Capabilities:
Delete file
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400108c7
test dl, 2
je 0x1400108ba
mov edx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cdqe
jmp 0x1400108c9
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor edx, edx
jmp 0x14001089c

Function at 0x1400108d8
Capabilities:
Create directory

Disassembly:
sub rsp, 0x138
test rcx, rcx
je 0x14001094b
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call sub.msvcrt.dll_strncpy
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x124], 0
call sub.msvcrt.dll_strlen
lea rcx, [rsp + rax + 0x20]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x140010937
lea rdx, [rcx - 1]
mov al, byte [rdx]
cmp al, 0x20
je 0x14001092a
cmp al, 0x5c
je 0x14001092a
cmp al, 0x2f
jne 0x140010937
lea rax, [rsp + 0x20]
mov rcx, rdx
cmp rdx, rax
ja 0x140010918
mov byte [rcx], 0
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cdqe
jmp 0x14001094d
xor eax, eax
add rsp, 0x138
ret

Function at 0x1400109f4
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140010a07
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cdqe
jmp 0x140010a09
xor eax, eax
add rsp, 0x28
ret

Function at 0x140010a2c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edx, ecx
mov esi, 0x104
mov ecx, esi
call fcn.140014840
mov ecx, esi
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
movsxd rbx, eax
test eax, eax
je 0x140010a6b
cmp byte [rbx + rdi - 1], 0x5c
je 0x140010a6b
mov byte [rbx + rdi], 0x5c
inc ebx
sub esi, ebx
mov ecx, esi
call fcn.1400149e0
mov rsi, qword [rsp + 0x38]
movsxd r11, ebx
mov rbx, qword [rsp + 0x30]
mov byte [r11 + rdi], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140010b70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov dword [rsp + 0x40], eax
cmp dword [rcx + 0x1c], eax
jne 0x140010bb6
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx + 8]
lea r9, [rsp + 0x40]
sub r8d, dword [rcx + 0x14]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r11d, dword [rbx + 0x10]
movsxd rax, dword [rsp + 0x40]
mov dword [rbx + 0x14], r11d
add rsp, 0x30
pop rbx
ret
cdqe
add rsp, 0x30
pop rbx
ret
Function at 0x1400112c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov edi, r8d
mov rsi, rdx
mov dword [rsp + 0x48], ebx
test rdx, rdx
je 0x140011338
test r8d, r8d
je 0x140011338
mov rdx, rcx
mov rcx, qword [0x14001da50]
call fcn.140013664
test rax, rax
je 0x140011334
mov r8d, edi
mov rdx, rsi
cmp qword [rax + 8], rbx
je 0x140011321
mov rcx, rax
call fcn.1400114f0
mov ebx, eax
cdqe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140011350
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, rdx
mov dword [rsp + 0x48], ebx
test rdx, rdx
je 0x1400113e1
cmp byte [rdx], bl
je 0x1400113e1
mov rdx, rcx
mov rcx, qword [0x14001da50]
call fcn.140013664
mov r11, rax
test rax, rax
je 0x1400113dd
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov rdx, rsi
cmp qword [rax + 8], rbx
je 0x1400113bf
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call fcn.1400114f0
mov ebx, eax
cdqe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor eax, eax
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, qword [r11]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140011400
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x30
mov rsi, rdx
mov rdx, rcx
mov rcx, qword [0x14001da50]
xor ebp, ebp
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x68], ebp
call fcn.140013664
mov rbx, rax
test rax, rax
je 0x1400114e0
test rsi, rsi
je 0x14001148b
cmp byte [rsi], bpl
je 0x14001148b
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x50], rdi
mov rdx, rsi
mov rdi, rsi
cmp qword [rax + 8], rbp
je 0x140011468
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.1400114f0
mov dword [rsp + 0x60], eax
jmp 0x140011486
xor eax, eax
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbp
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, qword [rsp + 0x50]
mov r8d, 2
lea rdx, [0x140019cf0]
cmp qword [rbx + 8], rbp
je 0x1400114b9
mov rcx, rbx
call fcn.1400114f0
mov rdx, rax
mov eax, dword [rsp + 0x60]
add eax, edx
cdqe
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rbx]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x60]
mov edx, dword [rsp + 0x68]
add eax, edx
cdqe
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
movsxd rax, dword [rsp + 0x60]
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
Function at 0x140017308
Capabilities:
Execute syscall

Disassembly:
leave
in al, dx
sbb bh, al
and al, 0xd0
leave
jmp 0x140016495
nop
cmp ebx, ecx
cmp al, 0xf3
nop
call 0x140017853
xor byte [rsi], bl
cli
lea ebp, [rdi - 0x2c60]
pushfq
jg 0x140018242
push rbx
lea ebp, [rbp + 0x6e35]
jp 0x140017c78
ja 0x1400164d2
jne 0x140016979
je 0x140018154
test ebp, 0x92f40ab3
cmp r10, rbx
movabs rcx, 0x57ea01fffffe0ee9
cpuid
syscall
jmp 0x140017e2a
add byte [rax - 0x75], cl
clc
dec dword [rax - 0x75]
mov dword [rsp - 0x30], 0x58571e3f
add byte [rax - 0x75], cl
Function at 0x140027319
Capabilities:
Execute syscall

Disassembly:
popfq
cmp r10d, 0x14aeb7e
xor edi, 0x7bffcb2
and r9d, 0x2c7fe2df
call rcx
neg r13
syscall
bswap rdx
ror ecx, 0x3f
pop r10
movabs r8, 0x511ab4ffffe7b3e9
test edi, 0xf955cc53
push rbp
stc
dec rsi
ret 0x38
jne 0x140027320
bswap r10
movabs rcx, 0x7a4d9e00000242e9
jmp 0x140027567
syscall
cmp r10d, 0x7c146641
or edx, 0x7a84e6d3
add ebp, 0xbd221a00
ret
xchg rcx, rcx
cmp eax, ecx
mov rcx, rbx
mov r14d, r12d
mov dword [rsp - 0x1c], 0x24923827
mov dword [rsp - 0x1c], 0x57d7a4a1
mov dword [rsp - 0x14], 0x652ec901
mov dword [rsp - 0x30], 0x49d4a31d
jmp 0x14002735a
mov rdx, rax
mov rcx, r15
call fcn.1400f2b98
mov ecx, dword [rdi]
xchg rdx, rdx
lea rdx, [rsp + 0x38]
sub ecx, 0xe
jne 0x1400275b7
je 0x1400275b7
jg 0x1400284e3
syscall
jmp rcx
jmp 0x140027377
call fcn.1400277d0
add rsp, 0x73
pop rdi
ret
pop rdi
lea r9d, [r14 + 1]
jmp 0x1400279d3

Function at 0x14002d0d0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x3c], 0x7a8ea4a2
mov dword [rsp - 0x38], 0x13e829aa
mov dword [rsp - 0x30], 0x27e14791
mov dword [rsp - 0x40], ebx
jmp 0x14002d145
invalid
mov dword [rsp - 0x1c], 0x20558bdb
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi

Function at 0x14002ed5f
Capabilities:
Execute syscall

Disassembly:
fmul qword [rdi]
mov bh, byte [rdx - 7]
invalid
rol byte [rcx + 0x57], 1
mov rsp, rsp
mov rcx, rcx
mov dword [rsp - 0x18], 0x4346beae
mov rbp, rbp
jne 0x14002ed88
je 0x14002ed88
jl 0x14002e64b
call rcx
pushfq
neg r12
inc rsi
movabs r8, 0x47c4c600000764e9
rcl r11d, 0xdd
syscall
pushf
lea r10d, [rbp + 0x35f]
cmp r12, rcx
or r12d, 0xe801378e
ret
jmp 0x14002f4f1
ret
pop rbx
mov r15, rcx
call fcn.1400eecc0
mov rsi, rsi
mov dword [rsp - 0x30], 0x6be67dc2
jmp 0x14002f743
movabs rbx, 0x5b0041bb7f87b0eb
jne 0x14002f49c
jmp 0x14002f44e
je 0x14002f49c
call fcn.14002f440
add rsp, 0x60
pop rbx
jmp 0x14002f44d
mov dword [rsp - 0x40], 0x2acee39a
sub rsp, 0x60
push rbx
jmp 0x14002f49a
mov qword [rsp + 0x50], rsi
mov dword [rsp - 0x44], 0x1d301ed3
mov dword [rsp - 0x14], 0x3fb97bac
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r14
push r8
mov rsp, rsp
mov r8, r8
mov r11, r11
mov rcx, r15
mov qword [rsp + 0x58], rbp
jmp 0x14002f5f6
test al, al
je 0x14002ef95
mov qword [rsp + 0x70], rbx
xchg rsp, rsp
jmp 0x14002f68b
Function at 0x14002ed60
Capabilities:
Execute syscall

Disassembly:
fmul qword [rdi]
mov bh, byte [rdx - 7]
invalid
rol byte [rcx + 0x57], 1
mov rsp, rsp
mov rcx, rcx
mov dword [rsp - 0x18], 0x4346beae
mov rbp, rbp
jne 0x14002ed88
je 0x14002ed88
jl 0x14002e64b
call rcx
pushfq
neg r12
inc rsi
movabs r8, 0x47c4c600000764e9
rcl r11d, 0xdd
syscall
pushf
lea r10d, [rbp + 0x35f]
cmp r12, rcx
or r12d, 0xe801378e
ret
jmp 0x14002f4f1
ret
pop rbx
mov r15, rcx
call fcn.1400eecc0
mov rsi, rsi
mov dword [rsp - 0x30], 0x6be67dc2
jmp 0x14002f743
movabs rbx, 0x5b0041bb7f87b0eb
jne 0x14002f49c
jmp 0x14002f44e
je 0x14002f49c
call fcn.14002f440
add rsp, 0x60
pop rbx
jmp 0x14002f44d
mov dword [rsp - 0x40], 0x2acee39a
sub rsp, 0x60
push rbx
jmp 0x14002f49a
mov qword [rsp + 0x50], rsi
mov dword [rsp - 0x44], 0x1d301ed3
mov dword [rsp - 0x14], 0x3fb97bac
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r14
push r8
mov rsp, rsp
mov r8, r8
mov r11, r11
mov rcx, r15
mov qword [rsp + 0x58], rbp
jmp 0x14002f5f6
test al, al
je 0x14002ef95
mov qword [rsp + 0x70], rbx
xchg rsp, rsp
jmp 0x14002f68b

Function at 0x14002ed83
Capabilities:
Execute syscall

Disassembly:
fmul qword [rdi]
mov bh, byte [rdx - 7]
invalid
rol byte [rcx + 0x57], 1
mov rsp, rsp
mov rcx, rcx
mov dword [rsp - 0x18], 0x4346beae
mov rbp, rbp
jne 0x14002ed88
je 0x14002ed88
jl 0x14002e64b
call rcx
pushfq
neg r12
inc rsi
movabs r8, 0x47c4c600000764e9
rcl r11d, 0xdd
syscall
pushf
lea r10d, [rbp + 0x35f]
cmp r12, rcx
or r12d, 0xe801378e
ret
jmp 0x14002f4f1
ret
pop rbx
mov r15, rcx
call fcn.1400eecc0
mov rsi, rsi
mov dword [rsp - 0x30], 0x6be67dc2
jmp 0x14002f743
movabs rbx, 0x5b0041bb7f87b0eb
jne 0x14002f49c
jmp 0x14002f44e
je 0x14002f49c
call fcn.14002f440
add rsp, 0x60
pop rbx
jmp 0x14002f44d
mov dword [rsp - 0x40], 0x2acee39a
sub rsp, 0x60
push rbx
jmp 0x14002f49a
mov qword [rsp + 0x50], rsi
mov dword [rsp - 0x44], 0x1d301ed3
mov dword [rsp - 0x14], 0x3fb97bac
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r14
push r8
mov rsp, rsp
mov r8, r8
mov r11, r11
mov rcx, r15
mov qword [rsp + 0x58], rbp
jmp 0x14002f5f6
test al, al
je 0x14002ef95
mov qword [rsp + 0x70], rbx
xchg rsp, rsp
jmp 0x14002f68b
Function at 0x14002ef27
Capabilities:
Execute syscall

Disassembly:
xchg rdi, rdi
xchg r15, r15
mov dword [rsp + 0x84], ecx
mov rcx, rdi
call rbx
mov rcx, r15
jmp 0x14002f18f
call qword [rdx + 0x98]
mov rcx, r15
call fcn.1400ef180
mul esi
or r10d, 0xf87508f1
or r11d, 0x6583b583
rcl r10d, 0xd
rcr esi, 0xda
syscall
ret
mov rcx, rax
xchg rsi, rsi
mov r12, r12
mov dword [rsp - 0x1c], 0x24a3666
mov rdx, qword [rax]
jne 0x14002ef3b
je 0x14002ef3b
and r14d, 0xdea01cd9
syscall
jmp 0x14002ee40
jmp 0x14002edfc
add byte [rax], al
mov dword [rsp - 0x2c], 0x2140278a
mov dword [rsp - 0x28], edx
and al, 0xd8
push r9
movabs r9, 0x7cad73000005cfe9
jmp 0x14002f4b7
jmp 0x14002f5dc
mov dword [rsp - 0x20], edx
xchg r12, r12
mov dword [rsp - 0x2c], ebp
call qword [rdx + 0x90]
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov dword [rsp - 0x3c], 0x19bfec0e
jmp 0x14002f2f1
pop rbx
xchg rdi, rdi
call fcn.1400ef2b0
mov rcx, rax
mov rdx, qword [rax]
jmp 0x14002f0f9
mov dword [rsp - 0x44], ecx
mov dword [rsp - 0x28], 0x1905b501
mov dword [rsp - 0x1c], 0x3cf82835
push rbx
movabs rbx, 0x5add35f26590c3eb
jne 0x14002f1a6
jmp 0x14002f16b
jne 0x14002f1d8
je 0x14002f1d8
jmp rax
jmp 0x14002f240
je 0x14002f1a6
call fcn.14002f391
add rsp, 0x60
pop rbx
je 0x14002f28e
jne 0x14002f28e
pause
test r12, rdi
jb 0x14002eff6
lea edi, [rcx + 0x4685]
ja 0x14002f576
rcr r10d, 0xaf
mov edx, 0x32205155
call rax
call fcn.14002fd31
rol ecx, 0x8b
cmp r8d, 0xf4346e7e
lea r11d, [rdi + 0xa302]
movabs rsi, 0x383986fffffed7e9
popf
jmp rax
jmp loc.14002f16a
mov rcx, r15
call fcn.1400ef2b0
jmp 0x14002ef12
xchg rdx, rdx
xchg rdi, rdi
mov rsi, qword [rsp + 0x50]
cmp qword [r15 + 0x10e8], rbp
jbe 0x14002f2a7
jne 0x14002f327
je 0x14002f327
inc r8
add r9d, 0xa18d45e9
inc r8
div rdi
lea edx, [rdx + 0xbb7]
jmp rax
jmp 0x14002f6a1
jne 0x14002f008
je 0x14002f008
call fcn.14002f505
add rsp, 0x60
pop r9
jmp 0x14002f5db
sub byte [rdx - 5], 0xff
dec dword [rdi]
xor byte [rax + 0x41fffff2], 0x81
invalid
ret
pop r9
Function at 0x140035e3a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
invalid
mov dword [rsp - 0x40], 0x31402caa
push r9
movabs r9, 0xab1f90000027ce9
jne 0x140035cde
jmp fcn.140035f5f
je 0x140035cde
je 0x140035d16
jne 0x140035d16
cmp ebx, 0x895b78eb
pause
rol edi, 0x1e
call rcx
inc r13
lea r11d, [rdi + 0x45d8]
cmp edi, 0x245d356d
jmp [rbp + 0x35]
pop rbp
and al, 0x44
lea edx, [rdi + 0x4ebd]
popf
movabs r11, 0x628969fffffaace9
bswap rdx
call fcn.140035a3b
push rsi
movabs rsi, 0x73d912fffff911e9
jne 0x140035d29
jmp fcn.1400357c7
jmp fcn.14003563f
je 0x140035d29
call fcn.140035e3a
add rsp, 0x75
pop rsi
jmp fcn.14003563e
mov dword [rsp - 0x44], 0x31be5d08
mov dword [rsp - 0x1c], 0x39aa64a4
xchg r11, r11
je 0x140035d94
jne 0x140035d94
lea r14d, [rdx + 0xd2d4]
div r8
test esi, 0x114a748c
movabs rbp, 0x658e1affffff39e9
jbe 0x140036158
jmp 0x140035cd2
add r10d, 0x8a6b61a2
lea ecx, [rdi + 0x876d]
call fcn.1400359db
shl cl, 3
movzx edx, word [rsp + rax*2 + 0x5e]
xchg r12, r12
mov eax, r13d
shr eax, cl
movzx ecx, al
je 0x140035dfd
jne 0x140035dfd
or ebp, 0x9925853
pushfq
cmp rdi, rbx
rcl r8d, 0x4b
jmp rax
jmp 0x140035d6b
int 0x44
lea ecx, [rbx - 0xe5a8]
jns 0x14003598c
ja 0x140034f07
mov r9d, 0xfa491fe0
jmp 0x140035e58
and al, 0xe8
sub bh, byte [rax + 0x41]
push rcx
mov rax, qword [rbp + 0x10a8]
and cl, 3
jmp 0x140035dcb
call 0x129cc176c
pop rbx
add byte [rax], al
add bl, al
ret
Function at 0x140043be4
Capabilities:
Execute syscall

Disassembly:
popfq
dec r8
syscall
test r13d, 0xe4fff704
pause
ror r10d, 0x4c
ret 0x10