joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140078e20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov esi, r14d
mov ebp, r14d
mov rdi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl esi, cl
add esi, esi
nop word [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140078ec4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140078e80
mov ecx, dword [r10]
jmp 0x140078fa7
cmp ecx, 0x4e0
jb 0x140078fa7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140078ee0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140078f30
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x12
xor ecx, edx
cmp ecx, dword [rdi + 0x10]
ja 0x140078e60
mov rax, qword [rdi + 8]
or esi, ecx
add rbp, rax
cmp rbp, 0x20
jb 0x140078e50
mov rbx, qword [rsp + 0x10]
mov eax, esi
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x140079020
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15d, edx
lea r14d, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov esi, r12d
mov ebp, r12d
test r14d, r14d
je 0x14007922a
mov r8, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0xff]
shl esi, cl
add esi, esi
nop dword [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x1400790e4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1400790a0
mov ecx, dword [r10]
jmp 0x1400791c7
cmp ecx, 0x4e0
jb 0x1400791c7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140079100
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140079150
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [rdi + 0x10]
cmp eax, edx
ja 0x140079080
mov r8, qword [rdi + 8]
or esi, eax
lea ecx, [r8 + 0xff]
shl ebp, cl
add ebp, ebp
or ebp, edx
cmp ebp, r14d
jb 0x140079070
xor edx, edx
mov eax, ebp
div r15d
mov ecx, eax
mov r8d, edx
xor edx, edx
mov eax, esi
div r15d
cmp eax, ecx
jb 0x14007924a
cmp r8d, r14d
jne 0x140079050
mov rbx, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15d
mov eax, edx
pop r15
pop r14
pop r12
ret
Function at 0x1400e70b0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x1400e70ed
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.1400e9b90
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1400e71ec
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.1400e9b90
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x1400e7160
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.1400150d0
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x1400e722b
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400e722b
call fcn.1400e9b08
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x1400e7212
mov rcx, r14
call fcn.1400e9b08
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
Function at 0x140002800
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call fcn.140002a50
test eax, eax
js 0x140002a3e
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x140002889
lea r8, [rbx + 8]
lea rax, [rbx + 8]
lea r8, [r8 + r9*4]
nop word [rax + rax]
mov ecx, dword [r8 - 8]
mov edx, dword [rax - 8]
add r10, 4
mov dword [rax - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 8], edx
mov edx, dword [rax - 4]
mov dword [rax - 4], ecx
mov ecx, dword [r8]
mov dword [r8 - 4], edx
mov edx, dword [rax]
mov dword [rax], ecx
mov ecx, dword [r8 + 4]
mov dword [r8], edx
mov edx, dword [rax + 4]
mov dword [rax + 4], ecx
sub r9, 4
mov dword [r8 + 4], edx
lea r8, [r8 - 0x10]
lea rax, [rax + 0x10]
cmp r10, r9
jl 0x140002840
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x140002a3c
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x140000000]
nop dword [rax]
mov r8d, dword [r10 + 0xe]
lea r10, [r10 + 0x10]
inc r11d
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x147a30]
movzx eax, byte [r10 - 1]
movzx ecx, byte [rdi + rax*4 + 0x147a30]
mov r9d, dword [rdi + rdx*4 + 0x147e30]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x148630]
movzx ecx, byte [rdi + rax*4 + 0x147a30]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x148a30]
movzx ecx, byte [rdi + rax*4 + 0x147a30]
movzx eax, byte [r10 + 3]
movzx edx, byte [rdi + rax*4 + 0x147a30]
xor r9d, dword [rdi + rcx*4 + 0x148230]
movzx eax, byte [r10 + 4]
movzx ecx, byte [rdi + rax*4 + 0x147a30]
mov r8d, dword [rdi + rdx*4 + 0x148630]
mov dword [r10 - 2], r9d
xor r8d, dword [rdi + rcx*4 + 0x148230]
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x147a30]
movzx eax, r9b
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x147e30]
movzx ecx, byte [rdi + rax*4 + 0x147a30]
movzx eax, byte [r10 + 7]
xor r8d, dword [rdi + rcx*4 + 0x148a30]
movzx edx, byte [rdi + rax*4 + 0x147a30]
movzx eax, byte [r10 + 8]
movzx ecx, byte [rdi + rax*4 + 0x147a30]
mov dword [r10 + 2], r8d
mov r8d, dword [rdi + rdx*4 + 0x148630]
xor r8d, dword [rdi + rcx*4 + 0x148230]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x147a30]
movzx eax, r9b
mov r9d, dword [r10 + 0xa]
xor r8d, dword [rdi + rcx*4 + 0x147e30]
movzx ecx, byte [rdi + rax*4 + 0x147a30]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x148a30]
movzx edx, byte [rdi + rax*4 + 0x147a30]
movzx eax, byte [r10 + 0xc]
movzx ecx, byte [rdi + rax*4 + 0x147a30]
mov dword [r10 + 6], r8d
mov r8d, dword [rdi + rdx*4 + 0x148630]
xor r8d, dword [rdi + rcx*4 + 0x148230]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x147a30]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x147e30]
movzx ecx, byte [rdi + rax*4 + 0x147a30]
xor r8d, dword [rdi + rcx*4 + 0x148a30]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1400028b0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140003de0
Capabilities:
Hash data with md5

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov rax, qword [0x14017b250]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor edx, edx
lea r8d, [rdx + 0x5c]
add rcx, 4
call fcn.14006eac0
mov dword [rdi + 4], 0x67452301
mov dword [rdi + 8], 0xefcdab89
mov dword [rdi + 0xc], 0x98badcfe
mov dword [rdi + 0x10], 0x10325476
mov qword [rdi + 0xb8], 0xf
xor ebx, ebx
mov qword [rdi + 0xb0], rbx
mov byte [rdi + 0xa0], bl
mov qword [rdi + 0xd8], 0xf
mov qword [rdi + 0xd0], rbx
mov byte [rdi + 0xc0], bl
mov word [rdi], 0x101
mov dword [rsp + 0x20], 0x333231
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], rbx
mov byte [rsp + 0x58], bl
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140003e96
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400086d0
nop
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x28], 0
xor r8d, r8d
lea rdx, [0x140149380]
lea rcx, [rsp + 0x28]
call fcn.1400086d0
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.140006fa0
nop
cmp qword [rsp + 0x70], 0x10
jb 0x140003efd
mov rcx, qword [rsp + 0x58]
call fcn.14006be70
nop
mov rax, rdi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14006c1f0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x140004eb0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov r14, rdx
xor edx, edx
mov rdi, r8
lea r8d, [rdx + 0x5c]
mov rbx, r9
mov rsi, rcx
mov dword [rsp + 0x20], 0
call fcn.14006eac0
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
mov dword [rsi], 0x67452301
mov dword [rsi + 4], 0xefcdab89
mov dword [rsi + 8], 0x98badcfe
mov dword [rsi + 0xc], 0x10325476
call fcn.140006e80
lea rbx, [rsi + 0x5c]
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
mov rdx, rsi
mov rcx, rbx
mov qword [rbx + 0x38], rax
call fcn.140006cd0
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], 0
mov byte [r14], 0
test rbx, rbx
je 0x140004fab
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x140004f65
mov rax, qword [r14]
jmp 0x140004f68
mov rax, r14
cmp rbx, rax
jb 0x140004fab
cmp rdx, 0x10
jb 0x140004f78
mov rcx, qword [r14]
jmp 0x140004f7b
mov rcx, r14
add rcx, qword [r14 + 0x10]
cmp rcx, rbx
jbe 0x140004fab
cmp rdx, 0x10
jb 0x140004f8f
mov rax, qword [r14]
jmp 0x140004f92
mov rax, r14
sub rbx, rax
mov r9d, 0x10
mov rdx, r14
mov r8, rbx
mov rcx, r14
call fcn.140008580
jmp 0x140004ff3
cmp qword [r14 + 0x18], 0x10
jae 0x140004fca
mov r8, qword [r14 + 0x10]
mov edx, 0x10
mov rcx, r14
call fcn.140007200
cmp qword [r14 + 0x18], 0x10
jb 0x140004fcf
mov rax, qword [r14]
jmp 0x140004fd2
mov rax, r14
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
cmp qword [r14 + 0x18], 0x10
mov qword [r14 + 0x10], 0x10
jb 0x140004fec
mov rax, qword [r14]
jmp 0x140004fef
mov rax, r14
mov byte [rax + 0x10], 0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rax, r14
add rsp, 0x30
pop r14
ret
Function at 0x140006ac0
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x14017b250]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r14, r9
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rsp + 0xe0]
mov qword [rsp + 0x30], rbx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea r8d, [r15 + 0x5c]
call fcn.14006eac0
mov dword [rdi], 0x67452301
mov dword [rdi + 4], 0xefcdab89
mov dword [rdi + 8], 0x98badcfe
mov dword [rdi + 0xc], 0x10325476
mov r8, r14
mov rdx, rbp
mov rcx, rdi
call fcn.140006e80
mov r8, qword [rbx + 0x10]
test r8, r8
je 0x140006b5d
cmp qword [rbx + 0x18], 0x10
jb 0x140006b52
mov rdx, qword [rbx]
jmp 0x140006b55
mov rdx, rbx
mov rcx, rdi
call fcn.140006e80
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140006990
nop
xor edx, edx
lea r8d, [rdx + 0x5c]
mov rcx, rdi
call fcn.14006eac0
mov dword [rdi], 0x67452301
mov dword [rdi + 4], 0xefcdab89
mov dword [rdi + 8], 0x98badcfe
mov dword [rdi + 0xc], 0x10325476
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
mov r8d, 0x10
mov rcx, rdi
call fcn.140006e80
mov r8, r14
mov rdx, rbp
mov rcx, rdi
call fcn.140006e80
mov r8, qword [rbx + 0x10]
test r8, r8
je 0x140006be1
cmp qword [rbx + 0x18], 0x10
jb 0x140006bd6
mov rdx, qword [rbx]
jmp 0x140006bd9
mov rdx, rbx
mov rcx, rdi
call fcn.140006e80
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.140006990
nop
mov r8, rax
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1400030c0
nop
cmp qword [rsp + 0x70], 0x10
jb 0x140006c12
mov rcx, qword [rsp + 0x58]
call fcn.14006be70
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], r15
mov byte [rsp + 0x58], 0
cmp qword [rsp + 0x50], 0x10
jb 0x140006c37
mov rcx, qword [rsp + 0x38]
call fcn.14006be70
mov qword [rsp + 0x50], 0xf
mov qword [rsp + 0x48], r15
mov byte [rsp + 0x38], 0
cmp qword [rbx + 0x18], 0x10
jb 0x140006c59
mov rcx, qword [rbx]
call fcn.14006be70
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], r15
mov byte [rbx], 0
mov rax, rsi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14006c1f0
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140011940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14017b250]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 3
mov rsi, rdx
xor bpl, bpl
call fcn.1400a4ce0
call fcn.1400a4b60
mov r8, qword [rsi]
mov edx, 0x2712
mov rcx, rax
mov rdi, rax
call fcn.1400a4de0
lea r8, [0x140025ca0]
mov edx, 0x4e2b
mov rcx, rdi
call fcn.1400a4de0
mov r8, rbx
mov edx, 0x2711
mov rcx, rdi
call fcn.1400a4de0
lea r8, [rsp + 0x20]
mov edx, 0x2722
mov rcx, rdi
mov dword [rsp + 0x2e], 0x302e31
mov dword [rsp + 0x24], 0x2d6c7275
mov dword [rsp + 0x20], 0x6362696c
mov dword [rsp + 0x28], 0x6e656761
mov word [rsp + 0x2c], 0x2f74
call fcn.1400a4de0
mov rcx, rdi
call fcn.1400a4890
mov ecx, 1
movzx ebx, bpl
test eax, eax
cmove ebx, ecx
mov rcx, rdi
call fcn.1400a4850
mov rdx, qword [rsi]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140011a19
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
movzx eax, bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14006c1f0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140011ac0
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14017b250]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0
call fcn.140034160
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 0x20
call fcn.140035120
test eax, eax
je 0x140011b5b
lea r8, [rsp + 0x38]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call fcn.140034c50
test eax, eax
je 0x140011b51
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], 0
call fcn.140032cb0
mov rcx, qword [rsp + 0x30]
call fcn.140032fb0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14006c1f0
add rsp, 0x68
ret
Function at 0x140012b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14017b250]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov rbx, rcx
mov dword [rbp - 0x30], 0
mov dword [rbp - 0x1b], 0x72656c6c
mov dword [rbp - 0x20], 0x74736e49
mov word [rbp - 0x26], 0x626f
mov word [rbp - 0x23], 0x5c6c
mov word [rbp - 0x13], 0x78
mov word [rbp - 0x16], 0x7475
mov byte [rbp - 0x21], 0x43
mov word [rbp - 0x28], 0x6c47
mov byte [rbp - 0x1c], 0x61
mov byte [rbp - 0x17], 0x4d
mov byte [rbp - 0x14], 0x65
mov byte [rbp - 0x24], 0x61
call fcn.14000d8e0
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006c1f0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140013250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
push rbp
push r12
push r13
push r15
lea rbp, [r11 - 0x1d8]
sub rsp, 0x2b8
mov rax, qword [0x14017b250]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor r13b, r13b
mov r15d, edx
mov r12, rcx
test edx, edx
je 0x1400134f1
test rcx, rcx
je 0x1400134f1
mov qword [r11 - 0x28], rsi
mov qword [r11 - 0x30], rdi
xor eax, eax
lea rcx, [rsp + 0x38]
or rdi, 0xffffffffffffffff
mov qword [r11 - 0x38], r14
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], edi
call fcn.140013110
lea ecx, [rdi + 3]
xor edx, edx
mov dword [rsp + 0x50], 0x130
mov r14d, eax
call fcn.140033c50
mov rsi, rax
cmp rax, rdi
je 0x1400134d3
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140035880
cmp eax, 1
jne 0x1400134cb
mov qword [rsp + 0x2f0], rbx
lea rdx, [rsp + 0x7c]
lea rcx, [rbp + 0x180]
mov dword [rbp + 0x187], 0x78652e72
mov dword [rbp + 0x180], 0x6c707865
mov word [rbp + 0x185], 0x6572
mov word [rbp + 0x18b], 0x65
mov byte [rbp + 0x184], 0x6f
call fcn.1400700a0
test eax, eax
jne 0x1400133ec
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call fcn.1400350a0
mov rbx, rax
test rax, rax
je 0x1400133ec
lea r8, [rsp + 0x30]
mov edx, 8
mov rcx, rax
call fcn.140035120
test eax, eax
je 0x1400133e4
mov r9d, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
lea r8, [rsp + 0x40]
mov edx, 0xc
mov qword [rsp + 0x20], rax
call fcn.1400347e0
test eax, eax
je 0x1400133aa
cmp r14d, dword [rsp + 0x40]
je 0x140013407
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400133c2
call fcn.140032fb0
mov qword [rsp + 0x30], 0
mov rcx, rbx
call fcn.140032fb0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400133ec
call fcn.140032fb0
mov qword [rsp + 0x30], 0
jmp 0x1400133ec
mov rcx, rbx
call fcn.140032fb0
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140035910
cmp eax, 1
je 0x140013303
jmp 0x1400134c3
xor r14d, r14d
lea rcx, [rbp + 0x84]
xor edx, edx
mov r8d, 0xfc
mov dword [rsp + 0x44], r14d
mov dword [rbp + 0x80], r14d
call fcn.14006eac0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x44]
lea r8, [rbp + 0x80]
lea edx, [r14 + 1]
mov r9d, 0x100
mov qword [rsp + 0x20], rax
call fcn.1400347e0
test eax, eax
je 0x1400134a7
mov rcx, qword [rbp + 0x80]
lea rdx, [rsp + 0x48]
call fcn.1400334d0
test eax, eax
je 0x1400134a7
mov rcx, qword [rsp + 0x48]
mov rdx, r15
inc rdi
cmp byte [rcx + rdi], r14b
jne 0x140013470
cmp rdi, rdx
jae 0x1400134a2
mov r9, rcx
lea r8, [rsp + 0x38]
mov rcx, r12
mov word [rsp + 0x38], 0x7325
mov byte [rsp + 0x3a], r14b
call fcn.14006d8dc
mov rcx, qword [rsp + 0x48]
mov r13b, 1
call fcn.140034ac0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400134bb
call fcn.140032fb0
mov qword [rsp + 0x30], r14
mov rcx, rbx
call fcn.140032fb0
mov rbx, qword [rsp + 0x2f0]
mov rcx, rsi
call fcn.140032fb0
mov r14, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2b0]
movzx eax, r13b
jmp 0x1400134f3
xor al, al
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14006c1f0
add rsp, 0x2b8
pop r15
pop r13
pop r12
pop rbp
ret
Function at 0x140013f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14017b250]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov rbx, rcx
mov dword [rbp - 0x30], 0
mov dword [rbp - 0x20], 0x736e4946
mov dword [rbp - 0x27], 0x61626f6c
mov word [rbp - 0x1c], 0x6174
mov word [rbp - 0x16], 0x754d
mov word [rbp - 0x19], 0x656c
mov dword [rbp - 0x14], 0x786574
mov word [rbp - 0x22], 0x465c
mov byte [rbp - 0x17], 0x72
mov byte [rbp - 0x23], 0x6c
mov byte [rbp - 0x28], 0x47
mov byte [rbp - 0x1a], 0x6c
call fcn.14000d8e0
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006c1f0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret