joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, rdx
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075378]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140021efd
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x140021f51
mov dword [rsp + 0x30], 0x53746553
mov dword [rsp + 0x37], 0x53656369
mov word [rsp + 0x34], 0x7265
mov dword [rsp + 0x3b], 0x75746174
mov byte [rsp + 0x36], 0x76
mov word [rsp + 0x3f], 0x73
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x140021f49
mov rdx, rbp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140021f80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075378]
lea rcx, [rbp - 0x40]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140021fed
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x140022053
mov dword [rbp - 0x19], 0x41726568
mov dword [rbp - 0x2a], 0x69767265
mov dword [rbp - 0x1d], 0x63746170
mov dword [rbp - 0x22], 0x69446c72
mov word [rbp - 0x25], 0x4365
mov dword [rbp - 0x2f], 0x74726174
mov byte [rbp - 0x2b], 0x53
mov byte [rbp - 0x15], 0
mov byte [rbp - 0x26], 0x63
mov byte [rbp - 0x1e], 0x73
mov byte [rbp - 0x30], 0x53
mov byte [rbp - 0x23], 0x74
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x14002204b
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14003ff20
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140022080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, rdx
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075398]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400220ed
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x140022137
mov word [rsp + 0x30], 0x6150
mov dword [rsp + 0x33], 0x70704168
mov dword [rsp + 0x37], 0x41646e65
mov byte [rsp + 0x32], 0x74
mov byte [rsp + 0x3b], 0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x14002212f
mov rdx, rbp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140022160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edi, edx
mov rbx, rcx
mov dword [rsp + 0x37], 0x6f567473
mov dword [rsp + 0x3d], 0x57656d
mov dword [rsp + 0x30], 0x646e6946
mov word [rsp + 0x35], 0x7269
mov word [rsp + 0x3b], 0x756c
mov byte [rsp + 0x34], 0x46
lea rdx, [0x1400753f0]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025500
mov rsi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400221f5
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140025420
test rax, rax
je 0x140022210
mov edx, edi
mov rcx, rbx
call rax
jmp 0x140022214
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140022340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075378]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400223ab
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x1400223fe
mov dword [rsp + 0x38], 0x41656369
mov dword [rsp + 0x33], 0x7265536e
mov word [rsp + 0x30], 0x704f
mov byte [rsp + 0x32], 0x65
mov byte [rsp + 0x37], 0x76
mov byte [rsp + 0x3c], 0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x1400223f6
mov r8d, r14d
mov rdx, rbp
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400255d0
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140022420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r15d, r9d
mov r14d, r8d
mov rsi, rdx
mov rdi, rcx
lea rdx, [0x140075378]
lea rcx, [rbp - 0x48]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rbx, rax
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14002248d
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rbx, rbx
je 0x140022508
mov word [rbp - 0x20], 0x6d61
mov dword [rbp - 0x31], 0x63696c70
mov dword [rbp - 0x37], 0x646c6975
mov word [rbp - 0x1d], 0x41
mov dword [rbp - 0x24], 0x4e687469
mov byte [rbp - 0x38], 0x42
mov dword [rbp - 0x2b], 0x65636341
mov word [rbp - 0x33], 0x7845
mov word [rbp - 0x26], 0x5773
mov byte [rbp - 0x1e], 0x65
mov byte [rbp - 0x27], 0x73
mov word [rbp - 0x2d], 0x7469
lea rdx, [rbp - 0x38]
mov rcx, rbx
call fcn.140025420
test rax, rax
je 0x140022500
mov r10d, dword [rbp + 0x58]
mov dword [rsp + 0x20], r10d
mov r9d, r15d
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400255d0
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140022530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
lea rdx, [0x140075398]
lea rcx, [rbp - 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rbx, rax
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140022597
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rbx, rbx
je 0x1400225ed
mov dword [rbp - 0x1d], 0x6d655268
mov dword [rbp - 0xf], 0x416e6f
mov word [rbp - 0x15], 0x7478
mov word [rbp - 0x12], 0x736e
mov dword [rbp - 0x19], 0x4565766f
mov word [rbp - 0x20], 0x6150
mov byte [rbp - 0x10], 0x69
mov byte [rbp - 0x1e], 0x74
mov byte [rbp - 0x13], 0x65
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.140025420
test rax, rax
je 0x1400225e5
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400255d0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret

Function at 0x140022610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rsi, rcx
mov r13, qword [rbp + 0x68]
mov rax, qword [rbp + 0x70]
mov qword [rbp - 0x40], rax
xor ebx, ebx
lea rdx, [0x140075378]
lea rcx, [rbp - 0x48]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14002268f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x1400226fb
mov word [rbp - 0x21], 0x6c69
mov dword [rbp - 0x2c], 0x6f547473
mov dword [rbp - 0x28], 0x506e656b
mov dword [rbp - 0x30], 0x756a6441
mov word [rbp - 0x24], 0x6972
mov dword [rbp - 0x1e], 0x736567
mov byte [rbp - 0x22], 0x76
mov byte [rbp - 0x1f], 0x65
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x1400226f3
mov rcx, qword [rbp - 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r13
mov r9d, r12d
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140022720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075378]
lea rcx, [rbp - 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140022793
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x1400227f3
mov dword [rbp - 0x1a], 0x76697250
mov dword [rbp - 0x20], 0x6b6f6f4c
mov word [rbp - 0x10], 0x6c61
mov word [rbp - 0xd], 0x4165
mov dword [rbp - 0x14], 0x56656765
mov word [rbp - 0x1c], 0x7075
mov byte [rbp - 0xb], 0
mov byte [rbp - 0xe], 0x75
mov word [rbp - 0x16], 0x6c69
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x1400227eb
mov r8, r15
mov rdx, r14
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140022820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, r8
mov ebp, edx
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x140075378]
lea rcx, [rsp + 0x20]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14002288a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x1400228e0
mov dword [rsp + 0x35], 0x65636f72
mov dword [rsp + 0x3b], 0x656b6f54
mov dword [rsp + 0x31], 0x506e6570
mov word [rsp + 0x39], 0x7373
mov word [rsp + 0x3f], 0x6e
mov byte [rsp + 0x30], 0x4f
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x1400228d8
mov r8, r14
mov edx, ebp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140022900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15, r9
mov r14, r8
mov ebp, edx
mov esi, ecx
mov r12, qword [rsp + 0xd0]
mov r13, qword [rsp + 0xd8]
mov ebx, 1
lea rdx, [0x140075398]
lea rcx, [rsp + 0x30]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, ebx
jg 0x140022984
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x1400229f4
mov word [rsp + 0x41], 0x7373
mov dword [rsp + 0x44], 0x65755163
mov word [rsp + 0x4d], 0x6e69
mov byte [rsp + 0x40], 0x41
mov word [rsp + 0x50], 0x41
mov byte [rsp + 0x4f], 0x67
mov dword [rsp + 0x48], 0x74537972
mov byte [rsp + 0x4c], 0x72
mov byte [rsp + 0x43], 0x6f
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x1400229ec
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r9, r15
mov r8, r14
mov edx, ebp
mov ecx, esi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140022a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov word [rbp - 0x2f], 0x5354
mov dword [rbp - 0x23], 0x6f736e6f
mov dword [rbp - 0x28], 0x65766974
mov dword [rbp - 0x2c], 0x63417465
mov dword [rbp - 0x1e], 0x73655365
mov dword [rbp - 0x19], 0x496e6f69
mov byte [rbp - 0x24], 0x43
mov byte [rbp - 0x1f], 0x6c
mov byte [rbp - 0x2d], 0x47
mov word [rbp - 0x15], 0x64
mov byte [rbp - 0x30], 0x57
mov byte [rbp - 0x1a], 0x73
lea rdx, [0x1400753f0]
lea rcx, [rbp - 0x40]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025500
mov rbx, rax
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140022ac2
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.140025420
test rax, rax
je 0x140022ad7
call rax
jmp 0x140022ada
or eax, 0xffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140022b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r15, r9
mov r14, r8
mov ebp, edx
mov rsi, rcx
mov r12, qword [rsp + 0xf0]
mov r13, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x48], rax
mov ebx, 1
lea rdx, [0x140075378]
lea rcx, [rsp + 0x40]
call fcn.140017910
nop
mov rcx, qword [rax]
call fcn.140025360
mov rdi, rax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, ebx
jg 0x140022ba2
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x140022c16
mov dword [rsp + 0x67], 0x4579654b
mov word [rsp + 0x6c], 0x41
mov byte [rsp + 0x6b], 0x78
mov dword [rsp + 0x62], 0x756e4567
mov word [rsp + 0x60], 0x6552
mov byte [rsp + 0x66], 0x6d
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140025420
test rax, rax
je 0x140022c0e
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r9, r15
mov r8, r14
mov edx, ebp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400255d0
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140025970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push r14
push r15
sub rsp, 0xca0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov qword [rbp + 0xc98], rbx
mov qword [rbp + 0xca0], rsi
mov qword [rbp + 0xca8], rdi
mov rax, qword [0x1400970b0]
xor rax, rbp
mov qword [rbp + 0xc60], rax
mov r15, rcx
mov qword [rbp + 0x28], rcx
xor esi, esi
mov dword [rbp + 0xc], esi
lea rdx, [0x140075e88]
call fcn.14003e5c0
mov dword [rbp + 0xc], 1
mov dword [rbp + 0x84a], 0x64006f
mov dword [rbp + 0x84e], 0x630075
mov dword [rbp + 0x844], 0x50006c
mov dword [rbp + 0x840], 0x610074
mov dword [rbp + 0x852], 0x490074
mov dword [rbp + 0x83c], 0x690067
mov dword [rbp + 0x856], 0x64
mov dword [rbp + 0x838], 0x690044
mov eax, 0x72
mov word [rbp + 0x848], ax
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x30]
call fcn.140045030
mov dword [rbp + 8], 0x800
lea rdx, [0x14006fb50]
lea rcx, [rbp + 0x18]
call fcn.140017b10
nop
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
mov r9d, 0x101
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000002
call fcn.14001f4e0
test eax, eax
sete dil
mov rdx, qword [rbp + 0x18]
add rdx, 0xffffffffffffffe8
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140025a9c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test dil, dil
je 0x140025be4
lea rax, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x838]
mov rcx, qword [rbp + 0x10]
call fcn.14001f5f0
test eax, eax
jne 0x140025bdb
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rbp + 0x861]
call fcn.140045030
mov byte [rbp + 0x860], 0
movsxd r14, dword [rbp + 8]
mov rdi, rsi
test r14, r14
jle 0x140025b54
nop dword [rax]
movzx ecx, byte [rbp + rdi + 0x30]
movzx eax, cl
shr al, 4
mov byte [rbp], al
and cl, 0xf
mov byte [rbp + 1], cl
mov rcx, rsi
movzx eax, byte [rbp + rcx]
cmp al, 9
ja 0x140025b24
add al, 0x30
jmp 0x140025b26
add al, 0x37
mov byte [rbp + rcx + 4], al
inc rcx
cmp rcx, 2
jl 0x140025b17
mov byte [rbp + 6], 0
lea r8, [rbp + 4]
mov edx, 0x400
lea rcx, [rbp + 0x860]
call fcn.14005161c
inc rdi
cmp rdi, r14
jl 0x140025b00
mov dword [rbp + 0x832], 0x73
mov eax, 0x25
mov word [rbp + 0x830], ax
lea rax, [rbp + 0x860]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140025b71
inc ebx
cmp ebx, 0x3fffffff
jg 0x140025bc9
movsxd rax, ebx
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140025b9d
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140040600
sub rsp, rcx
lea rcx, [rsp + 0x30]
mov r9d, 3
mov r8d, ebx
lea rdx, [rbp + 0x860]
call fcn.14003f270
mov rsi, rax
mov r8, rsi
lea rdx, [rbp + 0x830]
mov rcx, r15
call fcn.14003f360
mov rcx, qword [rbp + 0x10]
call fcn.140023bc0
mov rax, r15
mov rcx, qword [rbp + 0xc60]
xor rcx, rbp
call fcn.14003ff20
mov rbx, qword [rbp + 0xc98]
mov rsi, qword [rbp + 0xca0]
mov rdi, qword [rbp + 0xca8]
lea rsp, [rbp + 0xc70]
pop r15
pop r14
pop rbp
ret
Function at 0x140025d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1c8]
sub rsp, 0x2c0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor edi, edi
mov dword [rsp + 0x40], edi
call fcn.140034030
mov rcx, rax
test rax, rax
jne 0x140025d5a
mov ecx, 0x80004005
call fcn.140033340
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x40], 1
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x50]
call fcn.140045030
mov dword [rsp + 0x30], 0x200
mov dword [rsp + 0x7c], 0x450052
mov dword [rbp - 0x66], 0x700079
mov dword [rbp - 0x6a], 0x720043
mov dword [rbp - 0x74], 0x6f0073
mov dword [rsp + 0x76], 0x570054
mov dword [rbp - 0x62], 0x6f0074
mov dword [rbp - 0x56], 0x790068
mov dword [rbp - 0x78], 0x6f0072
mov dword [rbp - 0x70], 0x740066
mov word [rbp - 0x52], di
mov eax, 0x41
mov word [rsp + 0x7a], ax
mov ecx, 0x5c
mov word [rbp - 0x6c], cx
mov dword [rbp - 0x5a], 0x700061
mov dword [rsp + 0x72], 0x46004f
mov dword [rbp - 0x7e], 0x69004d
mov dword [rbp - 0x5e], 0x720067
mov word [rbp - 0x80], cx
mov eax, 0x53
mov word [rsp + 0x70], ax
mov edx, 0x63
mov word [rbp - 0x7a], dx
mov dword [rsp + 0x64], 0x470065
mov dword [rsp + 0x68], 0x690075
mov dword [rsp + 0x60], 0x6e0069
mov dword [rsp + 0x5c], 0x680063
mov dword [rsp + 0x58], 0x61004d
mov dword [rsp + 0x6c], 0x64
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffff80000002
call fcn.14001f4e0
test eax, eax
jne 0x140025f23
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
call fcn.14001f5f0
test eax, eax
je 0x140025ef4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffff80000002
call fcn.14001f4e0
test eax, eax
jne 0x140025f23
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
call fcn.14001f5f0
test eax, eax
jne 0x140025f23
lea rax, [rbp - 0x50]
or rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140025f00
mov r8d, ecx
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.14003eb70
mov rcx, qword [rsp + 0x38]
call fcn.140023bc0
mov rax, rbx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14003ff20
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140026bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov qword [rbp - 0x28], rcx
xor ecx, ecx
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rcx
cmp qword [rbx + 0x18], 0x10
jb 0x140026c05
mov rax, qword [rbx]
jmp 0x140026c08
mov rax, rbx
mov byte [rax], cl
mov byte [rbx + 0x20], 0
mov qword [rbx + 0x28], rcx
mov qword [rbx + 0x30], rcx
mov word [rbp - 0x10], 0x6c6c
mov word [rbp - 0x20], 0x534e
mov dword [rbp - 0x1d], 0x6e495f53
mov dword [rbp - 0x17], 0x4d282063
mov word [rbp - 0xd], 0x29
mov word [rbp - 0x19], 0x7465
mov word [rbp - 0x13], 0x7a6f
mov byte [rbp - 0x1e], 0x49
mov byte [rbp - 0x11], 0x69
mov byte [rbp - 0xe], 0x61
lea rax, [rbp - 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140026c56
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.14002c510
nop
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret