joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2319461f4
Capabilities:
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
lea rdx, [rbp - 8]
mov rax, qword [rbp + 0x10]
mov r8, rdx
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call rax
test eax, eax
sete al
test al, al
je 0x231946267
mov rax, qword [rbp - 8]
mov rcx, qword [rbp + 0x18]
mov dword [rsp + 0x28], 0x14
mov rdx, qword [rbp + 0x20]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8, rcx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
call rax
jmp 0x2319462f1
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x40], 0
lea rdx, [rbp - 8]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call rax
test eax, eax
sete al
test al, al
je 0x2319462f1
mov rax, qword [rbp - 8]
mov rcx, qword [rbp + 0x18]
mov dword [rsp + 0x28], 0x14
mov rdx, qword [rbp + 0x20]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8, rcx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
add rsp, 0x60
pop rbp
ret

Function at 0x231946310
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp - 0xc], 0
mov dword [rbp - 0x10], 4
lea rdx, [rbp - 8]
mov rax, qword [rbp + 0x10]
mov r8, rdx
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
call rax
test eax, eax
sete al
test al, al
je 0x231946394
mov rax, qword [rbp - 8]
mov rcx, qword [rbp + 0x18]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x30], rdx
lea rdx, [rbp - 0xc]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], 0
mov r9d, 0x10
mov r8, rcx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegGetValueA]
call rax
jmp 0x231946406
mov rax, qword [rbp + 0x10]
lea rdx, [rbp - 8]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
sete al
test al, al
je 0x231946406
mov rax, qword [rbp - 8]
mov rcx, qword [rbp + 0x18]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x30], rdx
lea rdx, [rbp - 0xc]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], 0
mov r9d, 0x10
mov r8, rcx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegGetValueA]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, dword [rbp - 0xc]
add rsp, 0x50
pop rbp
ret
Function at 0x23194647a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0x3a
mov byte [rbp - 0x50], 0x12
mov byte [rbp - 0x4f], 0x28
mov byte [rbp - 0x4e], 9
mov byte [rbp - 0x4d], 0xb
mov byte [rbp - 0x4c], 0x4a
mov byte [rbp - 0x4b], 0x84
mov byte [rbp - 0x4a], 0x8b
mov byte [rbp - 0x49], 0x1c
mov byte [rbp - 0x48], 0x1d
mov byte [rbp - 0x47], 0xa
mov byte [rbp - 0x46], 6
mov byte [rbp - 0x45], 0x1c
mov byte [rbp - 0x44], 0x4f
mov byte [rbp - 0x43], 0x8a
mov byte [rbp - 0x42], 0x8a
mov byte [rbp - 0x41], 0x16
mov byte [rbp - 0x40], 0x27
mov byte [rbp - 0x3f], 0x33
mov byte [rbp - 0x3e], 0x33
mov byte [rbp - 0x3d], 0x28
mov byte [rbp - 0x3c], 0x54
mov byte [rbp - 0x3b], 0x8b
mov byte [rbp - 0x3a], 0x9d
mov byte [rbp - 0x39], 0x16
mov byte [rbp - 0x38], 0x36
mov byte [rbp - 0x37], 0x34
mov byte [rbp - 0x36], 0x33
mov byte [rbp - 0x35], 0x3c
mov byte [rbp - 0x34], 0x48
mov byte [rbp - 0x33], 0x97
mov byte [rbp - 0x32], 0x8b
mov byte [rbp - 0x31], 0x1c
mov byte [rbp - 0x30], 0x2f
mov byte [rbp - 0x2f], 0x33
mov byte [rbp - 0x2e], 0x39
mov byte [rbp - 0x2d], 0x1a
mov byte [rbp - 0x2c], 0x4f
mov byte [rbp - 0x2b], 0x96
mov byte [rbp - 0x2a], 0x90
mov byte [rbp - 0x29], 0x16
mov byte [rbp - 0x28], 0x2f
mov byte [rbp - 0x27], 0x1b
mov byte [rbp - 0x26], 0x3f
mov byte [rbp - 0x25], 0x10
mov byte [rbp - 0x24], 0x51
mov byte [rbp - 0x23], 0x8c
mov byte [rbp - 0x22], 0x9a
mov byte [rbp - 0x21], 0x10
mov byte [rbp - 0x20], 0x24
mov byte [rbp - 0x1f], 0x34
mov byte [rbp - 0x1e], 0x33
mov byte [rbp - 0x1d], 0x2c
mov byte [rbp - 0x1c], 0x44
mov byte [rbp - 0x1b], 0x96
mov byte [rbp - 0x1a], 0x8d
mov byte [rbp - 0x19], 0x1c
mov byte [rbp - 0x18], 0x2c
mov byte [rbp - 0x17], 0x47
lea rax, [0x231ec7b80]
mov rcx, rax
call fcn.23196a600
movzx eax, byte [rax]
test al, al
jne 0x2319465e3
lea rax, [0x231ec7ba0]
mov rcx, rax
call fcn.23196a600
mov rcx, rax
lea rax, [rbp - 0x50]
mov rdx, rax
call fcn.231985420
lea rax, [0x231ec7b80]
mov rcx, rax
call fcn.23196a600
mov byte [rax], 1
lea rax, [0x231ec7ba0]
mov rcx, rax
call fcn.23196a600
mov r8d, 0
mov rdx, rax
lea rax, [0x231985480]
mov rcx, rax
call fcn.231969750
lea rax, [0x231ec7ba0]
mov rcx, rax
call fcn.23196a600
add rsp, 0x70
pop rbp
ret
Function at 0x2319465f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0x17
mov byte [rbp - 0x20], 5
mov byte [rbp - 0x1f], 0x2e
mov byte [rbp - 0x1e], 0x1c
mov byte [rbp - 0x1d], 0x1e
mov byte [rbp - 0x1c], 0x5f
mov byte [rbp - 0x1b], 0x89
mov byte [rbp - 0x1a], 0x9c
mov byte [rbp - 0x19], 0x35
mov byte [rbp - 0x18], 0x2e
mov byte [rbp - 0x17], 0x24
mov byte [rbp - 0x16], 4
mov byte [rbp - 0x15], 0x28
mov byte [rbp - 0x14], 0x52
mov byte [rbp - 0x13], 0x97
mov byte [rbp - 0x12], 0x92
mov byte [rbp - 0x11], 0xa
mov byte [rbp - 0x10], 0x35
mov byte [rbp - 0xf], 0x26
mov byte [rbp - 0xe], 0x1b
mov byte [rbp - 0xd], 0x16
mov byte [rbp - 0xc], 0x52
mov byte [rbp - 0xb], 0x8b
mov byte [rbp - 0xa], 0xf9
lea rax, [0x231ec7b40]
mov rcx, rax
call fcn.23196a600
movzx eax, byte [rax]
test al, al
jne 0x2319466d5
lea rax, [0x231ec7b60]
mov rcx, rax
call fcn.23196a600
mov rcx, rax
lea rax, [rbp - 0x20]
mov rdx, rax
call fcn.2319800e0
lea rax, [0x231ec7b40]
mov rcx, rax
call fcn.23196a600
mov byte [rax], 1
lea rax, [0x231ec7b60]
mov rcx, rax
call fcn.23196a600
mov r8d, 0
mov rdx, rax
lea rax, [0x231980140]
mov rcx, rax
call fcn.231969750
lea rax, [0x231ec7b60]
mov rcx, rax
call fcn.23196a600
add rsp, 0x40
pop rbp
ret

Function at 0x2319467a4
Capabilities:
Lock the desktop

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov dword [rbp + 0x20], ecx
lea rax, [rbp - 7]
mov rcx, rax
call fcn.2319465f8
mov rcx, rax
call fcn.231980180
mov rbx, rax
lea rax, [rbp - 6]
mov rcx, rax
call fcn.23194647a
mov rcx, rax
call fcn.2319854c0
mov r9d, 0
mov r8, rbx
mov rdx, rax
mov ecx, 0
call fcn.23194641f
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x231946815
mov rax, qword [sym.imp.USER32.dll_LockWorkStation]
call rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
call rax
jmp 0x231946861
cmp dword [rbp + 0x20], 0
je 0x231946853
lea rax, [rbp - 5]
mov rcx, rax
call fcn.2319466ea
mov rcx, rax
call fcn.23198c300
mov rdx, rax
mov rax, qword [0x231ed1e50]
mov rcx, rax
call fcn.231a31eb0
mov rcx, rax
mov rax, qword [0x231ed1e60]
mov rdx, rax
call fcn.2319e90b0
mov ecx, 0x3f0
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
add rsp, 0x38
pop rbx
pop rbp
ret
Function at 0x231946aa8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0x17
mov byte [rbp - 0x20], 0x1a
mov byte [rbp - 0x1f], 0x52
mov byte [rbp - 0x1e], 0x93
mov byte [rbp - 0x1d], 0xba
mov byte [rbp - 0x1c], 0x25
mov byte [rbp - 0x1b], 0xea
mov byte [rbp - 0x1a], 0x39
mov byte [rbp - 0x19], 0xf8
mov byte [rbp - 0x18], 0x22
mov byte [rbp - 0x17], 0x55
mov byte [rbp - 0x16], 0xae
mov byte [rbp - 0x15], 0x8c
mov byte [rbp - 0x14], 0x3f
mov byte [rbp - 0x13], 0xef
mov byte [rbp - 0x12], 0
mov byte [rbp - 0x11], 0xf4
mov byte [rbp - 0x10], 0x3e
mov byte [rbp - 0xf], 0x48
mov byte [rbp - 0xe], 0x9c
mov byte [rbp - 0xd], 0x8e
mov byte [rbp - 0xc], 0x34
mov byte [rbp - 0xb], 0xca
mov byte [rbp - 0xa], 0x4d
lea rax, [0x231ec7a00]
mov rcx, rax
call fcn.23196a600
movzx eax, byte [rax]
test al, al
jne 0x231946b85
lea rax, [0x231ec7a20]
mov rcx, rax
call fcn.23196a600
mov rcx, rax
lea rax, [rbp - 0x20]
mov rdx, rax
call fcn.23197fb40
lea rax, [0x231ec7a00]
mov rcx, rax
call fcn.23196a600
mov byte [rax], 1
lea rax, [0x231ec7a20]
mov rcx, rax
call fcn.23196a600
mov r8d, 0
mov rdx, rax
lea rax, [0x23197fba0]
mov rcx, rax
call fcn.231969750
lea rax, [0x231ec7a20]
mov rcx, rax
call fcn.23196a600
add rsp, 0x40
pop rbp
ret
Function at 0x231946cf2
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x278
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x210], rcx
mov qword [rbp + 0x218], rdx
mov rax, qword [rbp + 0x210]
mov rcx, rax
call fcn.23199da60
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x218]
mov rcx, rax
call fcn.23199da60
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp + 0x1e8]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
call rax
mov rax, qword [rbp + 0x1e8]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
call rax
test eax, eax
sete al
test al, al
je 0x231946d76
mov eax, 3
jmp 0x231947096
mov rax, qword [rbp + 0x1e8]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyA]
call rax
test eax, eax
setne al
test al, al
je 0x231946d9c
mov eax, 0x10b
jmp 0x231947096
lea rax, [rbp + 0x12f]
mov rcx, rax
call fcn.2319e0310
lea rcx, [rbp + 0x12f]
mov rdx, qword [rbp + 0x1e0]
lea rax, [rbp + 0x100]
mov r8, rcx
mov rcx, rax
call fcn.231a15ea0
lea rax, [rbp + 0x15f]
mov rcx, rax
call fcn.2319e0310
lea rcx, [rbp + 0x15f]
mov rdx, qword [rbp + 0x1e8]
lea rax, [rbp + 0x130]
mov r8, rcx
mov rcx, rax
call fcn.231a15ea0
lea rax, [rbp + 0xe0]
lea rcx, [rbp + 0x100]
lea rdx, [rbp + 0x130]
mov r8, rcx
mov rcx, rax
call fcn.231a32570
lea rax, [rbp + 0xe0]
mov rcx, rax
call fcn.23199da60
mov rcx, rax
lea rax, [rbp - 0x60]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x1d8], rax
lea rax, [rbp + 0xe0]
mov rcx, rax
call fcn.231a16660
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.231a16660
lea rax, [rbp + 0x15f]
mov rcx, rax
call fcn.2319e0340
lea rax, [rbp + 0x100]
mov rcx, rax
call fcn.231a16660
lea rax, [rbp + 0x12f]
mov rcx, rax
call fcn.2319e0340
cmp qword [rbp + 0x1d8], 0xffffffffffffffff
je 0x231946fb8
lea rax, [rbp + 0x1af]
mov rcx, rax
call fcn.2319e0310
lea rcx, [rbp + 0x1af]
lea rax, [rbp - 0x60]
lea rdx, [rax + 0x2c]
lea rax, [rbp + 0x180]
mov r8, rcx
mov rcx, rax
call fcn.231a15ea0
lea rax, [rbp + 0x1d7]
mov rcx, rax
call fcn.2319e0310
lea rcx, [rbp + 0x1d7]
mov rdx, qword [rbp + 0x1e8]
lea rax, [rbp + 0x1b0]
mov r8, rcx
mov rcx, rax
call fcn.231a15ea0
lea rax, [rbp + 0x160]
lea rcx, [rbp + 0x180]
lea rdx, [rbp + 0x1b0]
mov r8, rcx
mov rcx, rax
call fcn.231a32570
lea rax, [rbp + 0x160]
mov rcx, rax
call fcn.23199da60
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
lea rax, [rbp + 0x160]
mov rcx, rax
call fcn.231a16660
lea rax, [rbp + 0x1b0]
mov rcx, rax
call fcn.231a16660
lea rax, [rbp + 0x1d7]
mov rcx, rax
call fcn.2319e0340
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.231a16660
lea rax, [rbp + 0x1af]
mov rcx, rax
call fcn.2319e0340
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0x1d8]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileA]
call rax
test eax, eax
setne al
test al, al
jne 0x231946e9c
mov rax, qword [rbp + 0x1d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
jmp 0x231947096
add rsp, 0x278
pop rbx
pop rbp
ret
Function at 0x23194713e
Capabilities:
Encode data using base64 via winapi

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov dword [rbp - 8], 0
mov rax, qword [rbp + 0x28]
mov rcx, rax
call fcn.23199da40
mov ebx, eax
mov rax, qword [rbp + 0x28]
mov rcx, rax
call fcn.23199d8c0
mov rcx, rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0x40000001
mov edx, ebx
mov rax, qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call rax
test eax, eax
setne al
test al, al
je 0x231947264
lea rax, [rbp - 3]
mov rcx, rax
call fcn.2319e0310
mov eax, dword [rbp - 8]
mov ecx, eax
lea rdx, [rbp - 3]
lea rax, [rbp - 0x30]
mov r9, rdx
mov r8d, 0
mov rdx, rcx
mov rcx, rax
call fcn.231a15f50
lea rax, [rbp - 3]
mov rcx, rax
call fcn.2319e0340
lea rax, [rbp - 0x30]
mov edx, 0
mov rcx, rax
call fcn.231a16830
mov rbx, rax
mov rax, qword [rbp + 0x28]
mov rcx, rax
call fcn.23199da40
mov esi, eax
mov rax, qword [rbp + 0x28]
mov rcx, rax
call fcn.23199d8c0
mov rcx, rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8d, 0x40000001
mov edx, esi
mov rax, qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call rax
test eax, eax
setne al
test al, al
je 0x23194724a
lea rax, [rbp - 0x30]
mov rcx, qword [rbp + 0x20]
mov rdx, rax
call fcn.231a15850
mov ebx, 0
jmp 0x23194724f
mov ebx, 1
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.231a16660
cmp ebx, 1
jne 0x2319472f6
lea rax, [rbp - 2]
mov rcx, rax
call fcn.2319e0310
lea rax, [rbp - 1]
mov rcx, rax
call fcn.2319470a0
mov rcx, rax
call fcn.231980cc0
mov rdx, rax
lea rcx, [rbp - 2]
mov rax, qword [rbp + 0x20]
mov r8, rcx
mov rcx, rax
call fcn.231a15ea0
lea rax, [rbp - 2]
mov rcx, rax
call fcn.2319e0340
jmp 0x2319472f6
mov rax, qword [rbp + 0x20]
add rsp, 0x60
pop rbx
pop rsi
pop rbp
ret
Function at 0x2319473a0
Capabilities:
Decode data using base64 via winapi

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov dword [rbp - 8], 0
mov rax, qword [rbp + 0x28]
mov rcx, rax
call fcn.23199dc40
mov ebx, eax
mov rax, qword [rbp + 0x28]
mov rcx, rax
call fcn.23199da60
mov rcx, rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 1
mov edx, ebx
mov rax, qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call rax
test eax, eax
setne al
test al, al
je 0x2319474ea
lea rax, [rbp - 3]
mov rcx, rax
call fcn.2319e0310
mov eax, dword [rbp - 8]
mov ecx, eax
lea rdx, [rbp - 3]
lea rax, [rbp - 0x30]
mov r9, rdx
mov r8d, 0
mov rdx, rcx
mov rcx, rax
call fcn.231a15f50
lea rax, [rbp - 3]
mov rcx, rax
call fcn.2319e0340
lea rax, [rbp - 0x30]
mov edx, 0
mov rcx, rax
call fcn.231a16830
mov rbx, rax
mov rax, qword [rbp + 0x28]
mov rcx, rax
call fcn.23199dc40
mov esi, eax
mov rax, qword [rbp + 0x28]
mov rcx, rax
call fcn.23199da60
mov rcx, rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8d, 1
mov edx, esi
mov rax, qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call rax
test eax, eax
setne al
test al, al
je 0x2319474d0
lea rax, [rbp - 0x30]
mov rcx, qword [rbp + 0x20]
mov rdx, rax
call fcn.231a15850
mov ebx, 0
jmp 0x2319474d5
mov ebx, 1
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.231a16660
cmp ebx, 1
jne 0x23194757c
lea rax, [rbp - 2]
mov rcx, rax
call fcn.2319e0310
lea rax, [rbp - 1]
mov rcx, rax
call fcn.231947302
mov rcx, rax
call fcn.231981140
mov rdx, rax
lea rcx, [rbp - 2]
mov rax, qword [rbp + 0x20]
mov r8, rcx
mov rcx, rax
call fcn.231a15ea0
lea rax, [rbp - 2]
mov rcx, rax
call fcn.2319e0340
jmp 0x23194757c
mov rax, qword [rbp + 0x20]
add rsp, 0x70
pop rbx
pop rsi
pop rbp
ret
Function at 0x231947639
Capabilities:
Manipulate console buffer

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov ecx, 0xfffffff5
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
call rax
mov qword [rbp - 8], rax
lea rax, [rbp - 0x30]
mov rcx, qword [rbp - 8]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
call rax
movzx eax, word [rbp - 0x30]
movsx edx, ax
movzx eax, word [rbp - 0x2e]
cwde
imul eax, edx
mov dword [rbp - 0xc], eax
mov di, 0
movzx eax, di
mov edi, eax
mov ecx, dword [rbp - 0xc]
mov rax, qword [rbp - 8]
lea rdx, [rbp - 0x34]
mov qword [rsp + 0x20], rdx
mov r9d, edi
mov r8d, ecx
mov edx, 0x20
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
call rax
mov si, 0
movzx eax, si
mov esi, eax
movzx eax, word [rbp - 0x28]
movzx eax, ax
mov r8d, dword [rbp - 0xc]
mov rcx, qword [rbp - 8]
lea rdx, [rbp - 0x34]
mov qword [rsp + 0x20], rdx
mov r9d, esi
mov edx, eax
mov rax, qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
call rax
mov bx, 0
movzx eax, bx
mov ebx, eax
mov rax, qword [rbp - 8]
mov edx, ebx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x23194839e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0x17
mov byte [rbp - 0x20], 0x48
mov byte [rbp - 0x1f], 0x3e
mov byte [rbp - 0x1e], 0xa6
mov byte [rbp - 0x1d], 0x70
mov byte [rbp - 0x1c], 8
mov byte [rbp - 0x1b], 0x6f
mov byte [rbp - 0x1a], 0x8a
mov byte [rbp - 0x19], 0x4f
mov byte [rbp - 0x18], 0x64
mov byte [rbp - 0x17], 0x27
mov byte [rbp - 0x16], 0xa5
mov byte [rbp - 0x15], 0x23
mov byte [rbp - 0x14], 2
mov byte [rbp - 0x13], 0x6e
mov byte [rbp - 0x12], pe_nt_image_headers64
mov byte [rbp - 0x11], 0x1f
mov byte [rbp - 0x10], 0x6a
mov byte [rbp - 0xf], 0x39
mov byte [rbp - 0xe], 0xb0
mov byte [rbp - 0xd], 0x6d
mov byte [rbp - 0xc], 0x15
mov byte [rbp - 0xb], 6
mov byte [rbp - 0xa], 0xed
lea rax, [0x231ec7540]
mov rcx, rax
call fcn.23196a600
movzx eax, byte [rax]
test al, al
jne 0x23194847b
lea rax, [0x231ec7560]
mov rcx, rax
call fcn.23196a600
mov rcx, rax
lea rax, [rbp - 0x20]
mov rdx, rax
call fcn.23197ffc0
lea rax, [0x231ec7540]
mov rcx, rax
call fcn.23196a600
mov byte [rax], 1
lea rax, [0x231ec7560]
mov rcx, rax
call fcn.23196a600
mov r8d, 0
mov rdx, rax
lea rax, [0x231980020]
mov rcx, rax
call fcn.231969750
lea rax, [0x231ec7560]
mov rcx, rax
call fcn.23196a600
add rsp, 0x40
pop rbp
ret
Function at 0x23194874c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0x15
mov byte [rbp - 0x20], 0x58
mov byte [rbp - 0x1f], 0x71
mov byte [rbp - 0x1e], 0xed
mov byte [rbp - 0x1d], 0x2c
mov byte [rbp - 0x1c], 0x1f
mov byte [rbp - 0x1b], 0xd6
mov byte [rbp - 0x1a], 0
mov byte [rbp - 0x19], 0xf1
mov byte [rbp - 0x18], 0x4f
mov byte [rbp - 0x17], 0x66
mov byte [rbp - 0x16], 0xfe
mov byte [rbp - 0x15], 0x27
mov byte [rbp - 0x14], 0x14
mov byte [rbp - 0x13], 0xd6
mov byte [rbp - 0x12], 4
mov byte [rbp - 0x11], 0xe5
mov byte [rbp - 0x10], 0x54
mov byte [rbp - 0xf], 0x70
mov byte [rbp - 0xe], 0xeb
mov byte [rbp - 0xd], 0x30
mov byte [rbp - 0xc], 0x4d
lea rax, [0x231ec7400]
mov rcx, rax
call fcn.23196a600
movzx eax, byte [rax]
test al, al
jne 0x231948821
lea rax, [0x231ec7420]
mov rcx, rax
call fcn.23196a600
mov rcx, rax
lea rax, [rbp - 0x20]
mov rdx, rax
call fcn.23197f6c0
lea rax, [0x231ec7400]
mov rcx, rax
call fcn.23196a600
mov byte [rax], 1
lea rax, [0x231ec7420]
mov rcx, rax
call fcn.23196a600
mov r8d, 0
mov rdx, rax
lea rax, [0x23197f720]
mov rcx, rax
call fcn.231969750
lea rax, [0x231ec7420]
mov rcx, rax
call fcn.23196a600
add rsp, 0x40
pop rbp
ret

Function at 0x2319488fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0xc
mov byte [rbp - 0x14], 0x54
mov byte [rbp - 0x13], 0x55
mov byte [rbp - 0x12], 0x5c
mov byte [rbp - 0x11], 0x14
mov byte [rbp - 0x10], 0x16
mov byte [rbp - 0xf], 0x31
mov byte [rbp - 0xe], 0x19
mov byte [rbp - 0xd], 0x46
mov byte [rbp - 0xc], 0x27
mov byte [rbp - 0xb], 0x58
mov byte [rbp - 0xa], 0x36
mov byte [rbp - 9], 0x59
lea rax, [0x231ec7380]
mov rcx, rax
call fcn.23196a600
movzx eax, byte [rax]
test al, al
jne 0x2319489ad
lea rax, [0x231ec73a0]
mov rcx, rax
call fcn.23196a600
mov rcx, rax
lea rax, [rbp - 0x14]
mov rdx, rax
call fcn.23197d080
lea rax, [0x231ec7380]
mov rcx, rax
call fcn.23196a600
mov byte [rax], 1
lea rax, [0x231ec73a0]
mov rcx, rax
call fcn.23196a600
mov r8d, 0
mov rdx, rax
lea rax, [0x23197d0e0]
mov rcx, rax
call fcn.231969750
lea rax, [0x231ec73a0]
mov rcx, rax
call fcn.23196a600
add rsp, 0x40
pop rbp
ret
Function at 0x23194988a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0x42
mov byte [rbp - 0x50], 0xdc
mov byte [rbp - 0x4f], 0x10
mov byte [rbp - 0x4e], 0x9f
mov byte [rbp - 0x4d], 0x23
mov byte [rbp - 0x4c], 0xe0
mov byte [rbp - 0x4b], 8
mov byte [rbp - 0x4a], 0x8d
mov byte [rbp - 0x49], 0x5c
mov byte [rbp - 0x48], 0xd3
mov byte [rbp - 0x47], 0x32
mov byte [rbp - 0x46], 0x90
mov byte [rbp - 0x45], 0x34
mov byte [rbp - 0x44], 0xe5
mov byte [rbp - 0x43], 6
mov byte [rbp - 0x42], 0x8c
mov byte [rbp - 0x41], 0x56
mov byte [rbp - 0x40], 0xe9
mov byte [rbp - 0x3f], 0xb
mov byte [rbp - 0x3e], 0xa5
mov byte [rbp - 0x3d], 0
mov byte [rbp - 0x3c], 0xfe
mov byte [rbp - 0x3b], 7
mov byte [rbp - 0x3a], 0x9b
mov byte [rbp - 0x39], 0x56
mov byte [rbp - 0x38], 0xf8
mov byte [rbp - 0x37], 0xc
mov byte [rbp - 0x36], 0xa5
mov byte [rbp - 0x35], 0x14
mov byte [rbp - 0x34], 0xe2
mov byte [rbp - 0x33], 0x1b
mov byte [rbp - 0x32], 0x8d
mov byte [rbp - 0x31], 0x5c
mov byte [rbp - 0x30], 0xe1
mov byte [rbp - 0x2f], 0xb
mov byte [rbp - 0x2e], 0xaf
mov byte [rbp - 0x2d], 0x32
mov byte [rbp - 0x2c], 0xe5
mov byte [rbp - 0x2b], 0x1a
mov byte [rbp - 0x2a], 0x96
mov byte [rbp - 0x29], 0x56
mov byte [rbp - 0x28], 0xe1
mov byte [rbp - 0x27], 0x23
mov byte [rbp - 0x26], 0xba
mov byte [rbp - 0x25], 0x38
mov byte [rbp - 0x24], 0xfa
mov byte [rbp - 0x23], 0x19
mov byte [rbp - 0x22], 0x90
mov byte [rbp - 0x21], 0x57
mov byte [rbp - 0x20], 0xea
mov byte [rbp - 0x1f], 0x11
mov byte [rbp - 0x1e], 0x8d
mov byte [rbp - 0x1d], 0x24
mov byte [rbp - 0x1c], 0xcb
mov byte [rbp - 0x1b], 0x21
mov byte [rbp - 0x1a], 0x9a
mov byte [rbp - 0x19], 0x55
mov byte [rbp - 0x18], 0xff
mov byte [rbp - 0x17], 0x1a
mov byte [rbp - 0x16], 0x8b
mov byte [rbp - 0x15], 0x1a
mov byte [rbp - 0x14], 0xf8
mov byte [rbp - 0x13], 0xd
mov byte [rbp - 0x12], 0x8a
mov byte [rbp - 0x11], 0x55
mov byte [rbp - 0x10], 0xea
mov byte [rbp - 0xf], 0x7f
lea rax, [0x231ec6dc0]
mov rcx, rax
call fcn.23196a600
movzx eax, byte [rax]
test al, al
jne 0x231949a13
lea rax, [0x231ec6de0]
mov rcx, rax
call fcn.23196a600
mov rcx, rax
lea rax, [rbp - 0x50]
mov rdx, rax
call fcn.2319890e0
lea rax, [0x231ec6dc0]
mov rcx, rax
call fcn.23196a600
mov byte [rax], 1
lea rax, [0x231ec6de0]
mov rcx, rax
call fcn.23196a600
mov r8d, 0
mov rdx, rax
lea rax, [0x231989140]
mov rcx, rax
call fcn.231969750
lea rax, [0x231ec6de0]
mov rcx, rax
call fcn.23196a600
add rsp, 0x70
pop rbp
ret