joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003d060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x78
mov byte [rsp + 0x22], 0x64
mov byte [rsp + 0x23], 0x64
mov byte [rsp + 0x24], 0x60
mov byte [rsp + 0x25], 0x63
mov byte [rsp + 0x26], 0x2a
mov byte [rsp + 0x27], 0x3f
mov byte [rsp + 0x28], 0x3f
mov byte [rsp + 0x29], 0x76
mov byte [rsp + 0x2a], 0x79
mov byte [rsp + 0x2b], 0x7c
mov byte [rsp + 0x2c], 0x75
mov byte [rsp + 0x2d], 0x63
mov byte [rsp + 0x2e], 0x3e
mov byte [rsp + 0x2f], 0x73
mov byte [rsp + 0x30], 0x71
mov byte [rsp + 0x31], 0x64
mov byte [rsp + 0x32], 0x72
mov byte [rsp + 0x33], 0x7f
mov byte [rsp + 0x34], 0x68
mov byte [rsp + 0x35], 0x3e
mov byte [rsp + 0x36], 0x7d
mov byte [rsp + 0x37], 0x7f
mov byte [rsp + 0x38], 0x75
mov byte [rsp + 0x39], 0x3f
mov byte [rsp + 0x3a], 0x23
mov byte [rsp + 0x3b], 0x7b
mov byte [rsp + 0x3c], 0x63
mov byte [rsp + 0x3d], 0x69
mov byte [rsp + 0x3e], 0x60
mov byte [rsp + 0x3f], 0x27
mov byte [rsp + 0x40], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d8a8], eax
jle 0x14003d18c
lea rcx, [0x14023d8a8]
call fcn.140124ec8
cmp dword [0x14023d8a8], 0xffffffff
jne 0x14003d18c
mov edx, 8
lea rcx, [0x14023d738]
call fcn.140009120
lea rdx, [0x14023d738]
lea rcx, [rsp + 0x20]
call fcn.140042990
lea rcx, [0x140130f20]
call fcn.140125274
nop
lea rcx, [0x14023d8a8]
call fcn.140124e5c
nop
lea rcx, [0x14023d738]
call fcn.14000a080
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x58
ret
Function at 0x14003d1b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x78
mov byte [rsp + 0x22], 0x64
mov byte [rsp + 0x23], 0x64
mov byte [rsp + 0x24], 0x60
mov byte [rsp + 0x25], 0x63
mov byte [rsp + 0x26], 0x2a
mov byte [rsp + 0x27], 0x3f
mov byte [rsp + 0x28], 0x3f
mov byte [rsp + 0x29], 0x76
mov byte [rsp + 0x2a], 0x79
mov byte [rsp + 0x2b], 0x7c
mov byte [rsp + 0x2c], 0x75
mov byte [rsp + 0x2d], 0x63
mov byte [rsp + 0x2e], 0x3e
mov byte [rsp + 0x2f], 0x73
mov byte [rsp + 0x30], 0x71
mov byte [rsp + 0x31], 0x64
mov byte [rsp + 0x32], 0x72
mov byte [rsp + 0x33], 0x7f
mov byte [rsp + 0x34], 0x68
mov byte [rsp + 0x35], 0x3e
mov byte [rsp + 0x36], 0x7d
mov byte [rsp + 0x37], 0x7f
mov byte [rsp + 0x38], 0x75
mov byte [rsp + 0x39], 0x3f
mov byte [rsp + 0x3a], 0x23
mov byte [rsp + 0x3b], 0x7b
mov byte [rsp + 0x3c], 0x63
mov byte [rsp + 0x3d], 0x69
mov byte [rsp + 0x3e], 0x60
mov byte [rsp + 0x3f], 0x27
mov byte [rsp + 0x40], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d730], eax
jle 0x14003d2dc
lea rcx, [0x14023d730]
call fcn.140124ec8
cmp dword [0x14023d730], 0xffffffff
jne 0x14003d2dc
mov edx, 8
lea rcx, [0x14023d990]
call fcn.140009120
lea rdx, [0x14023d990]
lea rcx, [rsp + 0x20]
call fcn.140042990
lea rcx, [0x140130f00]
call fcn.140125274
nop
lea rcx, [0x14023d730]
call fcn.140124e5c
nop
lea rcx, [0x14023d990]
call fcn.14000a080
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x58
ret
Function at 0x14003d300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x53
mov byte [rsp + 0x22], 0x2a
mov byte [rsp + 0x23], 0x4c
mov byte [rsp + 0x24], 0x47
mov byte [rsp + 0x25], 0x79
mov byte [rsp + 0x26], 0x7e
mov byte [rsp + 0x27], 0x74
mov byte [rsp + 0x28], 0x7f
mov byte [rsp + 0x29], 0x67
mov byte [rsp + 0x2a], 0x63
mov byte [rsp + 0x2b], 0x4c
mov byte [rsp + 0x2c], 0x44
mov byte [rsp + 0x2d], 0x75
mov byte [rsp + 0x2e], 0x7d
mov byte [rsp + 0x2f], 0x60
mov byte [rsp + 0x30], 0x4c
mov byte [rsp + 0x31], 0x51
mov byte [rsp + 0x32], 0x79
mov byte [rsp + 0x33], 0x7d
mov byte [rsp + 0x34], 0x43
mov byte [rsp + 0x35], 0x64
mov byte [rsp + 0x36], 0x71
mov byte [rsp + 0x37], 0x62
mov byte [rsp + 0x38], 0x3e
mov byte [rsp + 0x39], 0x75
mov byte [rsp + 0x3a], 0x68
mov byte [rsp + 0x3b], 0x75
mov byte [rsp + 0x3c], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d9b0], eax
jle 0x14003d418
lea rcx, [0x14023d9b0]
call fcn.140124ec8
cmp dword [0x14023d9b0], 0xffffffff
jne 0x14003d418
mov edx, 8
lea rcx, [0x14023d880]
call fcn.140009120
lea rdx, [0x14023d880]
lea rcx, [rsp + 0x20]
call fcn.1400428d0
lea rcx, [0x140130ee0]
call fcn.140125274
nop
lea rcx, [0x14023d9b0]
call fcn.140124e5c
nop
lea rcx, [0x14023d880]
call fcn.14000a080
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x58
ret
Function at 0x14003d440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x41
mov byte [rsp + 0x22], 0x40
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x42
mov byte [rsp + 0x25], 0x47
mov byte [rsp + 0x26], 0x48
mov byte [rsp + 0x27], 0x28
mov byte [rsp + 0x28], 0x64
mov byte [rsp + 0x29], 0x72
mov byte [rsp + 0x2a], 0x7a
mov byte [rsp + 0x2b], 0x75
mov byte [rsp + 0x2c], 0x44
mov byte [rsp + 0x2d], 0x52
mov byte [rsp + 0x2e], 0x48
mov byte [rsp + 0x2f], 0x53
mov byte [rsp + 0x30], 0x75
mov byte [rsp + 0x31], 0x42
mov byte [rsp + 0x32], 0x64
mov byte [rsp + 0x33], 0x59
mov byte [rsp + 0x34], 0x5d
mov byte [rsp + 0x35], 0x61
mov byte [rsp + 0x36], 0x64
mov byte [rsp + 0x37], 0x51
mov byte [rsp + 0x38], 0x43
mov byte [rsp + 0x39], 0x28
mov byte [rsp + 0x3a], 0x64
mov byte [rsp + 0x3b], 0x5f
mov byte [rsp + 0x3c], 0x7e
mov byte [rsp + 0x3d], 0x73
mov byte [rsp + 0x3e], 0x7c
mov byte [rsp + 0x3f], 0x75
mov byte [rsp + 0x40], 0x28
mov byte [rsp + 0x41], 0x75
mov byte [rsp + 0x42], 0x46
mov byte [rsp + 0x43], 0x7e
mov byte [rsp + 0x44], 0x61
mov byte [rsp + 0x45], 0x7c
mov byte [rsp + 0x46], 0x78
mov byte [rsp + 0x47], 0x55
mov byte [rsp + 0x48], 0x65
mov byte [rsp + 0x49], 0x46
mov byte [rsp + 0x4a], 0x47
mov byte [rsp + 0x4b], 0x4a
mov byte [rsp + 0x4c], 0x7d
mov byte [rsp + 0x4d], 0x21
mov byte [rsp + 0x4e], 0x49
mov byte [rsp + 0x4f], 0x7b
mov byte [rsp + 0x50], 0x60
mov byte [rsp + 0x51], 0x54
mov byte [rsp + 0x52], 0x64
mov byte [rsp + 0x53], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d948], eax
jle 0x14003d5cb
lea rcx, [0x14023d948]
call fcn.140124ec8
cmp dword [0x14023d948], 0xffffffff
jne 0x14003d5cb
mov edx, 8
lea rcx, [0x14023d798]
call fcn.140009120
lea rdx, [0x14023d798]
lea rcx, [rsp + 0x20]
call fcn.140042810
lea rcx, [0x140130ec0]
call fcn.140125274
nop
lea rcx, [0x14023d948]
call fcn.140124e5c
nop
lea rcx, [0x14023d798]
call fcn.14000a080
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x68
ret
Function at 0x14003d5f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x41
mov byte [rsp + 0x22], 0x40
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x42
mov byte [rsp + 0x25], 0x47
mov byte [rsp + 0x26], 0x48
mov byte [rsp + 0x27], 0x28
mov byte [rsp + 0x28], 0x64
mov byte [rsp + 0x29], 0x72
mov byte [rsp + 0x2a], 0x7a
mov byte [rsp + 0x2b], 0x75
mov byte [rsp + 0x2c], 0x44
mov byte [rsp + 0x2d], 0x52
mov byte [rsp + 0x2e], 0x48
mov byte [rsp + 0x2f], 0x53
mov byte [rsp + 0x30], 0x75
mov byte [rsp + 0x31], 0x42
mov byte [rsp + 0x32], 0x64
mov byte [rsp + 0x33], 0x59
mov byte [rsp + 0x34], 0x5d
mov byte [rsp + 0x35], 0x61
mov byte [rsp + 0x36], 0x64
mov byte [rsp + 0x37], 0x51
mov byte [rsp + 0x38], 0x43
mov byte [rsp + 0x39], 0x28
mov byte [rsp + 0x3a], 0x64
mov byte [rsp + 0x3b], 0x5f
mov byte [rsp + 0x3c], 0x7e
mov byte [rsp + 0x3d], 0x73
mov byte [rsp + 0x3e], 0x7c
mov byte [rsp + 0x3f], 0x75
mov byte [rsp + 0x40], 0x28
mov byte [rsp + 0x41], 0x75
mov byte [rsp + 0x42], 0x46
mov byte [rsp + 0x43], 0x7e
mov byte [rsp + 0x44], 0x61
mov byte [rsp + 0x45], 0x7c
mov byte [rsp + 0x46], 0x78
mov byte [rsp + 0x47], 0x55
mov byte [rsp + 0x48], 0x65
mov byte [rsp + 0x49], 0x46
mov byte [rsp + 0x4a], 0x47
mov byte [rsp + 0x4b], 0x4a
mov byte [rsp + 0x4c], 0x7d
mov byte [rsp + 0x4d], 0x21
mov byte [rsp + 0x4e], 0x49
mov byte [rsp + 0x4f], 0x7b
mov byte [rsp + 0x50], 0x60
mov byte [rsp + 0x51], 0x54
mov byte [rsp + 0x52], 0x64
mov byte [rsp + 0x53], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d998], eax
jle 0x14003d77b
lea rcx, [0x14023d998]
call fcn.140124ec8
cmp dword [0x14023d998], 0xffffffff
jne 0x14003d77b
mov edx, 8
lea rcx, [0x14023d6f8]
call fcn.140009120
lea rdx, [0x14023d6f8]
lea rcx, [rsp + 0x20]
call fcn.140042810
lea rcx, [0x140130ea0]
call fcn.140125274
nop
lea rcx, [0x14023d998]
call fcn.140124e5c
nop
lea rcx, [0x14023d6f8]
call fcn.14000a080
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x68
ret
Function at 0x14003dbd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x7b
mov byte [rsp + 0x22], 0x75
mov byte [rsp + 0x23], 0x62
mov byte [rsp + 0x24], 0x7e
mov byte [rsp + 0x25], 0x75
mov byte [rsp + 0x26], 0x7c
mov byte [rsp + 0x27], 0x23
mov byte [rsp + 0x28], 0x22
mov byte [rsp + 0x29], 0x3e
mov byte [rsp + 0x2a], 0x74
mov byte [rsp + 0x2b], 0x7c
mov byte [rsp + 0x2c], 0x7c
mov byte [rsp + 0x2d], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d758], eax
jle 0x14003dc9d
lea rcx, [0x14023d758]
call fcn.140124ec8
cmp dword [0x14023d758], 0xffffffff
jne 0x14003dc9d
mov edx, 8
lea rcx, [0x14023d768]
call fcn.140009120
lea rdx, [0x14023d768]
lea rcx, [rsp + 0x20]
call fcn.140042e10
lea rcx, [0x140131120]
call fcn.140125274
nop
lea rcx, [0x14023d758]
call fcn.140124e5c
nop
lea rcx, [0x14023d768]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x14003dcc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x57
mov byte [rsp + 0x22], 0x75
mov byte [rsp + 0x23], 0x64
mov byte [rsp + 0x24], 0x40
mov byte [rsp + 0x25], 0x62
mov byte [rsp + 0x26], 0x7f
mov byte [rsp + 0x27], 0x73
mov byte [rsp + 0x28], 0x51
mov byte [rsp + 0x29], 0x74
mov byte [rsp + 0x2a], 0x74
mov byte [rsp + 0x2b], 0x62
mov byte [rsp + 0x2c], 0x75
mov byte [rsp + 0x2d], 0x63
mov byte [rsp + 0x2e], 0x63
mov byte [rsp + 0x2f], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d944], eax
jle 0x14003dd97
lea rcx, [0x14023d944]
call fcn.140124ec8
cmp dword [0x14023d944], 0xffffffff
jne 0x14003dd97
mov edx, 8
lea rcx, [0x14023d960]
call fcn.140009120
lea rdx, [0x14023d960]
lea rcx, [rsp + 0x20]
call fcn.140042690
lea rcx, [0x140131100]
call fcn.140125274
nop
lea rcx, [0x14023d944]
call fcn.140124e5c
nop
lea rcx, [0x14023d960]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret
Function at 0x14003ddc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x5c
mov byte [rsp + 0x22], 0x7f
mov byte [rsp + 0x23], 0x71
mov byte [rsp + 0x24], 0x74
mov byte [rsp + 0x25], 0x5c
mov byte [rsp + 0x26], 0x79
mov byte [rsp + 0x27], 0x72
mov byte [rsp + 0x28], 0x62
mov byte [rsp + 0x29], 0x71
mov byte [rsp + 0x2a], 0x62
mov byte [rsp + 0x2b], 0x69
mov byte [rsp + 0x2c], 0x51
mov byte [rsp + 0x2d], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d820], eax
jle 0x14003de8d
lea rcx, [0x14023d820]
call fcn.140124ec8
cmp dword [0x14023d820], 0xffffffff
jne 0x14003de8d
mov edx, 8
lea rcx, [0x14023d770]
call fcn.140009120
lea rdx, [0x14023d770]
lea rcx, [rsp + 0x20]
call fcn.140042e10
lea rcx, [0x1401310e0]
call fcn.140125274
nop
lea rcx, [0x14023d820]
call fcn.140124e5c
nop
lea rcx, [0x14023d770]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x14003deb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x65
mov byte [rsp + 0x22], 0x63
mov byte [rsp + 0x23], 0x75
mov byte [rsp + 0x24], 0x62
mov byte [rsp + 0x25], 0x23
mov byte [rsp + 0x26], 0x22
mov byte [rsp + 0x27], 0x3e
mov byte [rsp + 0x28], 0x74
mov byte [rsp + 0x29], 0x7c
mov byte [rsp + 0x2a], 0x7c
mov byte [rsp + 0x2b], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d870], eax
jle 0x14003df73
lea rcx, [0x14023d870]
call fcn.140124ec8
cmp dword [0x14023d870], 0xffffffff
jne 0x14003df73
mov edx, 8
lea rcx, [0x14023d878]
call fcn.140009120
lea rdx, [0x14023d878]
lea rcx, [rsp + 0x20]
call fcn.140042c90
lea rcx, [0x1401310c0]
call fcn.140125274
nop
lea rcx, [0x14023d870]
call fcn.140124e5c
nop
lea rcx, [0x14023d878]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret
Function at 0x14003dfa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x57
mov byte [rsp + 0x22], 0x75
mov byte [rsp + 0x23], 0x64
mov byte [rsp + 0x24], 0x44
mov byte [rsp + 0x25], 0x7f
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x47
mov byte [rsp + 0x28], 0x79
mov byte [rsp + 0x29], 0x7e
mov byte [rsp + 0x2a], 0x74
mov byte [rsp + 0x2b], 0x7f
mov byte [rsp + 0x2c], 0x67
mov byte [rsp + 0x2d], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d724], eax
jle 0x14003e06d
lea rcx, [0x14023d724]
call fcn.140124ec8
cmp dword [0x14023d724], 0xffffffff
jne 0x14003e06d
mov edx, 8
lea rcx, [0x14023d6d8]
call fcn.140009120
lea rdx, [0x14023d6d8]
lea rcx, [rsp + 0x20]
call fcn.140042e10
lea rcx, [0x1401310a0]
call fcn.140125274
nop
lea rcx, [0x14023d724]
call fcn.140124e5c
nop
lea rcx, [0x14023d6d8]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x14003e170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x57
mov byte [rsp + 0x22], 0x75
mov byte [rsp + 0x23], 0x64
mov byte [rsp + 0x24], 0x47
mov byte [rsp + 0x25], 0x79
mov byte [rsp + 0x26], 0x7e
mov byte [rsp + 0x27], 0x74
mov byte [rsp + 0x28], 0x7f
mov byte [rsp + 0x29], 0x67
mov byte [rsp + 0x2a], 0x44
mov byte [rsp + 0x2b], 0x75
mov byte [rsp + 0x2c], 0x68
mov byte [rsp + 0x2d], 0x64
mov byte [rsp + 0x2e], 0x5c
mov byte [rsp + 0x2f], 0x75
mov byte [rsp + 0x30], 0x7e
mov byte [rsp + 0x31], 0x77
mov byte [rsp + 0x32], 0x64
mov byte [rsp + 0x33], 0x78
mov byte [rsp + 0x34], 0x47
mov byte [rsp + 0x35], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d898], eax
jle 0x14003e265
lea rcx, [0x14023d898]
call fcn.140124ec8
cmp dword [0x14023d898], 0xffffffff
jne 0x14003e265
mov edx, 8
lea rcx, [0x14023d9a0]
call fcn.140009120
lea rdx, [0x14023d9a0]
lea rcx, [rsp + 0x20]
call fcn.140042510
lea rcx, [0x140131060]
call fcn.140125274
nop
lea rcx, [0x14023d898]
call fcn.140124e5c
nop
lea rcx, [0x14023d9a0]
call fcn.14000a080
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret
Function at 0x14003e290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x57
mov byte [rsp + 0x22], 0x75
mov byte [rsp + 0x23], 0x64
mov byte [rsp + 0x24], 0x47
mov byte [rsp + 0x25], 0x79
mov byte [rsp + 0x26], 0x7e
mov byte [rsp + 0x27], 0x74
mov byte [rsp + 0x28], 0x7f
mov byte [rsp + 0x29], 0x67
mov byte [rsp + 0x2a], 0x44
mov byte [rsp + 0x2b], 0x75
mov byte [rsp + 0x2c], 0x68
mov byte [rsp + 0x2d], 0x64
mov byte [rsp + 0x2e], 0x47
mov byte [rsp + 0x2f], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d720], eax
jle 0x14003e367
lea rcx, [0x14023d720]
call fcn.140124ec8
cmp dword [0x14023d720], 0xffffffff
jne 0x14003e367
mov edx, 8
lea rcx, [0x14023d950]
call fcn.140009120
lea rdx, [0x14023d950]
lea rcx, [rsp + 0x20]
call fcn.140042690
lea rcx, [0x140131040]
call fcn.140125274
nop
lea rcx, [0x14023d720]
call fcn.140124e5c
nop
lea rcx, [0x14023d950]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x14003ed50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x43
mov byte [rsp + 0x22], 0x69
mov byte [rsp + 0x23], 0x63
mov byte [rsp + 0x24], 0x79
mov byte [rsp + 0x25], 0x7e
mov byte [rsp + 0x26], 0x64
mov byte [rsp + 0x27], 0x75
mov byte [rsp + 0x28], 0x62
mov byte [rsp + 0x29], 0x7e
mov byte [rsp + 0x2a], 0x71
mov byte [rsp + 0x2b], 0x7c
mov byte [rsp + 0x2c], 0x63
mov byte [rsp + 0x2d], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d824], eax
jle 0x14003ee1d
lea rcx, [0x14023d824]
call fcn.140124ec8
cmp dword [0x14023d824], 0xffffffff
jne 0x14003ee1d
mov edx, 8
lea rcx, [0x14023d818]
call fcn.140009120
lea rdx, [0x14023d818]
lea rcx, [rsp + 0x20]
call fcn.140042e10
lea rcx, [0x140131480]
call fcn.140125274
nop
lea rcx, [0x14023d824]
call fcn.140124e5c
nop
lea rcx, [0x14023d818]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret
Function at 0x14003ee40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x40
mov byte [rsp + 0x22], 0x62
mov byte [rsp + 0x23], 0x7f
mov byte [rsp + 0x24], 0x73
mov byte [rsp + 0x25], 0x75
mov byte [rsp + 0x26], 0x63
mov byte [rsp + 0x27], 0x63
mov byte [rsp + 0x28], 0x30
mov byte [rsp + 0x29], 0x58
mov byte [rsp + 0x2a], 0x71
mov byte [rsp + 0x2b], 0x73
mov byte [rsp + 0x2c], 0x7b
mov byte [rsp + 0x2d], 0x75
mov byte [rsp + 0x2e], 0x62
mov byte [rsp + 0x2f], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d708], eax
jle 0x14003ef17
lea rcx, [0x14023d708]
call fcn.140124ec8
cmp dword [0x14023d708], 0xffffffff
jne 0x14003ef17
mov edx, 8
lea rcx, [0x14023d8f8]
call fcn.140009120
lea rdx, [0x14023d8f8]
lea rcx, [rsp + 0x20]
call fcn.140042690
lea rcx, [0x140131460]
call fcn.140125274
nop
lea rcx, [0x14023d708]
call fcn.140124e5c
nop
lea rcx, [0x14023d8f8]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x14003ef40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x40
mov byte [rsp + 0x22], 0x62
mov byte [rsp + 0x23], 0x7f
mov byte [rsp + 0x24], 0x73
mov byte [rsp + 0x25], 0x75
mov byte [rsp + 0x26], 0x63
mov byte [rsp + 0x27], 0x63
mov byte [rsp + 0x28], 0x30
mov byte [rsp + 0x29], 0x5d
mov byte [rsp + 0x2a], 0x7f
mov byte [rsp + 0x2b], 0x7e
mov byte [rsp + 0x2c], 0x79
mov byte [rsp + 0x2d], 0x64
mov byte [rsp + 0x2e], 0x7f
mov byte [rsp + 0x2f], 0x62
mov byte [rsp + 0x30], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d968], eax
jle 0x14003f01c
lea rcx, [0x14023d968]
call fcn.140124ec8
cmp dword [0x14023d968], 0xffffffff
jne 0x14003f01c
mov edx, 8
lea rcx, [0x14023d7b0]
call fcn.140009120
lea rdx, [0x14023d7b0]
lea rcx, [rsp + 0x20]
call fcn.1400422d0
lea rcx, [0x140131440]
call fcn.140125274
nop
lea rcx, [0x14023d968]
call fcn.140124e5c
nop
lea rcx, [0x14023d7b0]
call fcn.14000a080
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret
Function at 0x14003f450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x47
mov byte [rsp + 0x22], 0x79
mov byte [rsp + 0x23], 0x62
mov byte [rsp + 0x24], 0x75
mov byte [rsp + 0x25], 0x63
mov byte [rsp + 0x26], 0x78
mov byte [rsp + 0x27], 0x71
mov byte [rsp + 0x28], 0x62
mov byte [rsp + 0x29], 0x7b
mov byte [rsp + 0x2a], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d86c], eax
jle 0x14003f50e
lea rcx, [0x14023d86c]
call fcn.140124ec8
cmp dword [0x14023d86c], 0xffffffff
jne 0x14003f50e
mov edx, 8
lea rcx, [0x14023d918]
call fcn.140009120
lea rdx, [0x14023d918]
lea rcx, [rsp + 0x20]
call fcn.1400425d0
lea rcx, [0x140131380]
call fcn.140125274
nop
lea rcx, [0x14023d86c]
call fcn.140124e5c
nop
lea rcx, [0x14023d918]
call fcn.14000a080
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret

Function at 0x14003f530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x140171340]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x20], 0x10
mov byte [rsp + 0x21], 0x59
mov byte [rsp + 0x22], 0x7d
mov byte [rsp + 0x23], 0x60
mov byte [rsp + 0x24], 0x7f
mov byte [rsp + 0x25], 0x62
mov byte [rsp + 0x26], 0x64
mov byte [rsp + 0x27], 0x30
mov byte [rsp + 0x28], 0x42
mov byte [rsp + 0x29], 0x75
mov byte [rsp + 0x2a], 0x73
mov byte [rsp + 0x2b], 0x7f
mov byte [rsp + 0x2c], 0x7e
mov byte [rsp + 0x2d], 0x63
mov byte [rsp + 0x2e], 0x64
mov byte [rsp + 0x2f], 0x62
mov byte [rsp + 0x30], 0x65
mov byte [rsp + 0x31], 0x73
mov byte [rsp + 0x32], 0x64
mov byte [rsp + 0x33], 0x7f
mov byte [rsp + 0x34], 0x62
mov byte [rsp + 0x35], 0x10
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14023d6e8], eax
jle 0x14003f625
lea rcx, [0x14023d6e8]
call fcn.140124ec8
cmp dword [0x14023d6e8], 0xffffffff
jne 0x14003f625
mov edx, 8
lea rcx, [0x14023d800]
call fcn.140009120
lea rdx, [0x14023d800]
lea rcx, [rsp + 0x20]
call fcn.140042510
lea rcx, [0x140131360]
call fcn.140125274
nop
lea rcx, [0x14023d6e8]
call fcn.140124e5c
nop
lea rcx, [0x14023d800]
call fcn.14000a080
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140124e00
add rsp, 0x48
ret