joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006c540
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
xor esi, esi
test rcx, rcx
je 0x14006c690
mov rdi, rcx
lea rcx, str.INTEL_ISA_DISABLE
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x14006c690
mov rdx, rax
movzx eax, byte [rax]
xor esi, esi
test al, al
je 0x14006c690
lea r8, [0x1400a3370]
xor r9d, r9d
mov rcx, rdx
inc rdx
mov r10d, 1
xor r11d, r11d
cmp al, 0x2c
jne 0x14006c5b3
nop
movzx eax, byte [rcx + r11 + 1]
inc r11
dec r10
inc rdx
cmp al, 0x2c
je 0x14006c5a0
movzx eax, al
test eax, eax
je 0x14006c690
nop
mov rax, rdx
movzx ebx, byte [rdx]
inc rdx
cmp ebx, 0x2c
je 0x14006c5e0
test ebx, ebx
je 0x14006c5e0
mov r9, rax
jmp 0x14006c5c0
mov rax, r9
sub rax, rcx
inc rax
dec rdx
cmp rax, r11
jne 0x14006c5fd
movzx eax, byte [rdx]
test al, al
jne 0x14006c58b
jmp 0x14006c690
cmp byte [0x1400a3360], 0
jne 0x14006c60b
call fcn.14006ba80
mov rax, rcx
neg rax
lea rbx, [rcx + r11]
sub rcx, r9
add r11, rcx
dec r11
mov ecx, 1
jmp 0x14006c639
inc rcx
cmp rcx, 0x47
je 0x14006c5f1
lea r14, [rcx + rcx*2]
mov r14, qword [r8 + r14*8 + 0x10]
test r14, r14
je 0x14006c630
xor r15d, r15d
nop word [rax + rax]
movzx ebp, byte [rbx + r15]
cmp bpl, byte [r14 + r15]
jne 0x14006c630
inc r15
mov r12, r11
add r12, r15
jne 0x14006c650
add r14, r9
add r14, rax
cmp byte [r10 + r14], 0
jne 0x14006c630
cmp ecx, 2
jb 0x14006c5f1
mov rax, rdi
call fcn.14006c4e0
cmp eax, 1
adc rsi, 0
jmp 0x14006c5f1
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400710bc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140071140
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140075010]
cmp byte [rcx + rax], 0
je 0x140071140
dec r8
sub rdx, 1
jne 0x140071126
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14007184c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140071896
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140071896
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140071896
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140071896
cmp dword [rcx + 0x84], 0xe
jbe 0x140071896
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140071898
xor al, al
add rsp, 0x28
ret
Function at 0x140001f98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0xa8
mov word [rsp + 0x20], 0x3f
mov word [rsp + 0x22], 0x35
mov word [rsp + 0x24], 0x48
mov word [rsp + 0x26], 0x4a
mov word [rsp + 0x28], 0x4c
mov word [rsp + 0x2a], 0x56
mov word [rsp + 0x2c], 0x57
mov word [rsp + 0x2e], 0x55
mov word [rsp + 0x30], 0x5c
mov word [rsp + 0x32], 0x3f
mov word [rsp + 0x34], 0x30
mov word [rsp + 0x36], 0x44
mov word [rsp + 0x38], 0x46
mov word [rsp + 0x3a], 0x4b
mov word [rsp + 0x3c], 0x4c
mov word [rsp + 0x3e], 0x51
mov word [rsp + 0x40], 0x48
mov word [rsp + 0x42], 0x3f
mov word [rsp + 0x44], 0x36
mov word [rsp + 0x46], 0x3c
mov word [rsp + 0x48], 0x36
mov word [rsp + 0x4a], 0x37
mov word [rsp + 0x4c], 0x28
mov word [rsp + 0x4e], 0x30
mov word [rsp + 0x50], 0x3f
mov word [rsp + 0x52], 0x26
mov word [rsp + 0x54], 0x58
mov word [rsp + 0x56], 0x55
mov word [rsp + 0x58], 0x55
mov word [rsp + 0x5a], 0x48
mov word [rsp + 0x5c], 0x51
mov word [rsp + 0x5e], 0x57
mov word [rsp + 0x60], 0x26
mov word [rsp + 0x62], 0x52
mov word [rsp + 0x64], 0x51
mov word [rsp + 0x66], 0x57
mov word [rsp + 0x68], 0x55
mov word [rsp + 0x6a], 0x52
mov word [rsp + 0x6c], 0x4f
mov word [rsp + 0x6e], 0x36
mov word [rsp + 0x70], 0x48
mov word [rsp + 0x72], 0x57
mov word [rsp + 0x74], 0x3f
mov word [rsp + 0x76], 0x36
mov word [rsp + 0x78], 0x48
mov word [rsp + 0x7a], 0x55
mov word [rsp + 0x7c], 0x59
mov word [rsp + 0x7e], 0x4c
mov word [rsp + 0x80], 0x46
mov word [rsp + 0x82], 0x48
mov word [rsp + 0x84], 0x56
mov word [rsp + 0x86], 0x3f
mov word [rsp + 0x88], 0x38
mov word [rsp + 0x8a], 0x56
mov word [rsp + 0x8c], 0x52
mov word [rsp + 0x8e], 0x36
mov word [rsp + 0x90], 0x59
mov word [rsp + 0x92], 0x46
mov word [rsp + 0x94], 0xe3
cmp byte [0x1409d2088], 0
jne 0x14000219f
mov byte [0x1409d2116], 1
mov eax, 0
lea rcx, [0x1409d20a0]
movzx edx, word [rsp + rax*2 + 0x20]
mov word [rcx + rax*2], dx
add rax, 1
cmp rax, 0x3b
jne 0x140002179
mov byte [0x1409d2088], 1
lea rcx, [0x14000161f]
call fcn.1400014f0
lea rax, [0x1409d20a0]
add rsp, 0xa8
ret
Function at 0x1400021ae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0xa8
mov word [rsp + 0x20], 0x79
mov word [rsp + 0x22], 0x6f
mov word [rsp + 0x24], 0x82
mov word [rsp + 0x26], 0x84
mov word [rsp + 0x28], 0x86
mov word [rsp + 0x2a], 0x90
mov word [rsp + 0x2c], 0x91
mov word [rsp + 0x2e], 0x8f
mov word [rsp + 0x30], 0x96
mov word [rsp + 0x32], 0x79
mov word [rsp + 0x34], 0x6a
mov word [rsp + 0x36], 0x7e
mov word [rsp + 0x38], pe_nt_image_headers64
mov word [rsp + 0x3a], 0x85
mov word [rsp + 0x3c], 0x86
mov word [rsp + 0x3e], 0x8b
mov word [rsp + 0x40], 0x82
mov word [rsp + 0x42], 0x79
mov word [rsp + 0x44], 0x70
mov word [rsp + 0x46], 0x76
mov word [rsp + 0x48], 0x70
mov word [rsp + 0x4a], 0x71
mov word [rsp + 0x4c], 0x62
mov word [rsp + 0x4e], 0x6a
mov word [rsp + 0x50], 0x79
mov word [rsp + 0x52], 0x60
mov word [rsp + 0x54], 0x92
mov word [rsp + 0x56], 0x8f
mov word [rsp + 0x58], 0x8f
mov word [rsp + 0x5a], 0x82
mov word [rsp + 0x5c], 0x8b
mov word [rsp + 0x5e], 0x91
mov word [rsp + 0x60], 0x60
mov word [rsp + 0x62], 0x8c
mov word [rsp + 0x64], 0x8b
mov word [rsp + 0x66], 0x91
mov word [rsp + 0x68], 0x8f
mov word [rsp + 0x6a], 0x8c
mov word [rsp + 0x6c], 0x89
mov word [rsp + 0x6e], 0x70
mov word [rsp + 0x70], 0x82
mov word [rsp + 0x72], 0x91
mov word [rsp + 0x74], 0x79
mov word [rsp + 0x76], 0x70
mov word [rsp + 0x78], 0x82
mov word [rsp + 0x7a], 0x8f
mov word [rsp + 0x7c], 0x93
mov word [rsp + 0x7e], 0x86
mov word [rsp + pe_nt_image_headers64], 0x80
mov word [rsp + 0x82], 0x82
mov word [rsp + 0x84], 0x90
mov word [rsp + 0x86], 0x79
mov word [rsp + 0x88], 0x94
mov word [rsp + 0x8a], 0x92
mov word [rsp + 0x8c], 0x7e
mov word [rsp + 0x8e], 0x92
mov word [rsp + 0x90], 0x90
mov word [rsp + 0x92], 0x82
mov word [rsp + 0x94], 0x8f
mov word [rsp + 0x96], 0x93
mov word [rsp + 0x98], 0x1d
cmp byte [0x1409d1ee0], 0
jne 0x1400023c9
mov byte [0x1409d1f7a], 1
mov eax, 0
lea rcx, [0x1409d1f00]
movzx edx, word [rsp + rax*2 + 0x20]
mov word [rcx + rax*2], dx
add rax, 1
cmp rax, 0x3d
jne 0x1400023a3
mov byte [0x1409d1ee0], 1
lea rcx, [0x14000168a]
call fcn.1400014f0
lea rax, [0x1409d1f00]
add rsp, 0xa8
ret

Function at 0x1400025e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x67
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x64
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d1cf0], 0
jne 0x140002674
mov byte [0x1409d1d0f], 1
mov eax, 0
lea rcx, [0x1409d1d00]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x14000264f
mov byte [0x1409d1cf0], 1
lea rcx, [0x140001758]
call fcn.1400014f0
lea rax, [0x1409d1d00]
add rsp, 0x38
ret
Function at 0x140002680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x64
mov byte [rsp + 0x23], 0x54
mov byte [rsp + 0x24], 0x52
mov byte [rsp + 0x25], 0x5f
mov byte [rsp + 0x26], 0x58
mov byte [rsp + 0x27], 0x66
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x55
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d1c98], 0
jne 0x140002710
mov byte [0x1409d1caf], 1
mov eax, 0
lea rcx, [0x1409d1ca0]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x1400026eb
mov byte [0x1409d1c98], 1
lea rcx, [0x1400017a0]
call fcn.1400014f0
lea rax, [0x1409d1ca0]
add rsp, 0x38
ret

Function at 0x14000271c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x61
mov byte [rsp + 0x23], 0x54
mov byte [rsp + 0x24], 0x61
mov byte [rsp + 0x25], 0x63
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x65
mov byte [rsp + 0x28], 0x56
mov byte [rsp + 0x29], 0x54
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d1c18], 0
jne 0x1400027ac
mov byte [0x1409d1c2f], 1
mov eax, 0
lea rcx, [0x1409d1c20]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002787
mov byte [0x1409d1c18], 1
lea rcx, [0x140001800]
call fcn.1400014f0
lea rax, [0x1409d1c20]
add rsp, 0x38
ret

Function at 0x1400027b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x66
mov byte [rsp + 0x23], 0x64
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x5f
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x63
mov byte [rsp + 0x28], 0x65
mov byte [rsp + 0x29], 0x60
mov byte [rsp + 0x2a], 0x5f
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d1b58], 0
jne 0x140002848
mov byte [0x1409d1b6f], 1
mov eax, 0
lea rcx, [0x1409d1b60]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002823
mov byte [0x1409d1b58], 1
lea rcx, [0x140001890]
call fcn.1400014f0
lea rax, [0x1409d1b60]
add rsp, 0x38
ret
Function at 0x140002854
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x64
mov byte [rsp + 0x23], 0x66
mov byte [rsp + 0x24], 0x63
mov byte [rsp + 0x25], 0x57
mov byte [rsp + 0x26], 0x64
mov byte [rsp + 0x27], 0x59
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x5c
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d1a68], 0
jne 0x1400028e4
mov byte [0x1409d1a7f], 1
mov eax, 0
lea rcx, [0x1409d1a70]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x1400028bf
mov byte [0x1409d1a68], 1
lea rcx, [0x140001950]
call fcn.1400014f0
lea rax, [0x1409d1a70]
add rsp, 0x38
ret

Function at 0x1400028f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x67
mov byte [rsp + 0x28], 0x5a
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x52
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d1a10], 0
jne 0x140002980
mov byte [0x1409d1a2f], 1
mov eax, 0
lea rcx, [0x1409d1a20]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x14000295b
mov byte [0x1409d1a10], 1
lea rcx, [0x140001998]
call fcn.1400014f0
lea rax, [0x1409d1a20]
add rsp, 0x38
ret

Function at 0x14000298c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x5e
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x24], 0x54
mov byte [rsp + 0x25], 0x63
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x64
mov byte [rsp + 0x28], 0x60
mov byte [rsp + 0x29], 0x57
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d1988], 0
jne 0x140002a1c
mov byte [0x1409d199f], 1
mov eax, 0
lea rcx, [0x1409d1990]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x1400029f7
mov byte [0x1409d1988], 1
lea rcx, [0x140001a10]
call fcn.1400014f0
lea rax, [0x1409d1990]
add rsp, 0x38
ret
Function at 0x140002a28
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x5c
mov byte [rsp + 0x23], 0x52
mov byte [rsp + 0x24], 0x64
mov byte [rsp + 0x25], 0x61
mov byte [rsp + 0x26], 0x56
mov byte [rsp + 0x27], 0x63
mov byte [rsp + 0x28], 0x64
mov byte [rsp + 0x29], 0x5c
mov byte [rsp + 0x2a], 0x6a
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d1908], 0
jne 0x140002ab8
mov byte [0x1409d191f], 1
mov eax, 0
lea rcx, [0x1409d1910]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002a93
mov byte [0x1409d1908], 1
lea rcx, [0x140001a70]
call fcn.1400014f0
lea rax, [0x1409d1910]
add rsp, 0x38
ret

Function at 0x140002ac4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x67
mov byte [rsp + 0x28], 0x5a
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x52
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d1750], 0
jne 0x140002b54
mov byte [0x1409d176f], 1
mov eax, 0
lea rcx, [0x1409d1760]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002b2f
mov byte [0x1409d1750], 1
lea rcx, [0x140001bc0]
call fcn.1400014f0
lea rax, [0x1409d1760]
add rsp, 0x38
ret

Function at 0x140002b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x53
mov byte [rsp + 0x23], 0x66
mov byte [rsp + 0x24], 0x5d
mov byte [rsp + 0x25], 0x5d
mov byte [rsp + 0x26], 0x58
mov byte [rsp + 0x27], 0x66
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x55
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d16f0], 0
jne 0x140002bf0
mov byte [0x1409d170f], 1
mov eax, 0
lea rcx, [0x1409d1700]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002bcb
mov byte [0x1409d16f0], 1
lea rcx, [0x140001c08]
call fcn.1400014f0
lea rax, [0x1409d1700]
add rsp, 0x38
ret
Function at 0x140002bfc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x68
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x55
mov byte [rsp + 0x27], 0x63
mov byte [rsp + 0x28], 0x68
mov byte [rsp + 0x29], 0x56
mov byte [rsp + 0x2a], 0x53
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d1698], 0
jne 0x140002c8c
mov byte [0x1409d16af], 1
mov eax, 0
lea rcx, [0x1409d16a0]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002c67
mov byte [0x1409d1698], 1
lea rcx, [0x140001c50]
call fcn.1400014f0
lea rax, [0x1409d16a0]
add rsp, 0x38
ret

Function at 0x140002c98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x21], 0x11
mov byte [rsp + 0x22], 0x6b
mov byte [rsp + 0x23], 0x60
mov byte [rsp + 0x24], 0x5f
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x5d
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x63
mov byte [rsp + 0x2a], 0x5e
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x1409d1588], 0
jne 0x140002d28
mov byte [0x1409d159f], 1
mov eax, 0
lea rcx, [0x1409d1590]
movzx edx, byte [rsp + rax + 0x21]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xf
jne 0x140002d03
mov byte [0x1409d1588], 1
lea rcx, [0x140001d28]
call fcn.1400014f0
lea rax, [0x1409d1590]
add rsp, 0x38
ret

Function at 0x140002d34
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x65
mov byte [rsp + 0x26], 0x60
mov byte [rsp + 0x27], 0x65
mov byte [rsp + 0x28], 0x52
mov byte [rsp + 0x29], 0x5d
mov byte [rsp + 0x2a], 0x52
mov byte [rsp + 0x2b], 0x67
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x1409d1cb0], 0
jne 0x140002dce
mov byte [0x1409d1cd1], 1
mov eax, 0
lea rcx, [0x1409d1cc0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140002da9
mov byte [0x1409d1cb0], 1
lea rcx, [0x140001788]
call fcn.1400014f0
lea rax, [0x1409d1cc0]
add rsp, 0x48
ret
Function at 0x140002dda
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x53
mov byte [rsp + 0x22], 0x5a
mov byte [rsp + 0x23], 0x65
mov byte [rsp + 0x24], 0x55
mov byte [rsp + 0x25], 0x56
mov byte [rsp + 0x26], 0x57
mov byte [rsp + 0x27], 0x56
mov byte [rsp + 0x28], 0x5f
mov byte [rsp + 0x29], 0x55
mov byte [rsp + 0x2a], 0x56
mov byte [rsp + 0x2b], 0x63
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x1409d1b98], 0
jne 0x140002e74
mov byte [0x1409d1bb1], 1
mov eax, 0
lea rcx, [0x1409d1ba0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140002e4f
mov byte [0x1409d1b98], 1
lea rcx, [0x140001860]
call fcn.1400014f0
lea rax, [0x1409d1ba0]
add rsp, 0x48
ret

Function at 0x140002e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x55
mov byte [rsp + 0x26], 0x61
mov byte [rsp + 0x27], 0x53
mov byte [rsp + 0x28], 0x60
mov byte [rsp + 0x29], 0x5d
mov byte [rsp + 0x2a], 0x67
mov byte [rsp + 0x2b], 0x68
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x5f
mov byte [rsp + 0x2e], 0x56
mov byte [rsp + 0x2f], 0x65
mov byte [rsp + 0x30], 0xf1
cmp byte [0x1409d1860], 0
jne 0x140002f1a
mov byte [0x1409d1881], 1
mov eax, 0
lea rcx, [0x1409d1870]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140002ef5
mov byte [0x1409d1860], 1
lea rcx, [0x140001ae8]
call fcn.1400014f0
lea rax, [0x1409d1870]
add rsp, 0x48
ret

Function at 0x140002f26
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x59
mov byte [rsp + 0x22], 0x60
mov byte [rsp + 0x23], 0x5e
mov byte [rsp + 0x24], 0x56
mov byte [rsp + 0x25], 0x1f
mov byte [rsp + 0x26], 0x64
mov byte [rsp + 0x27], 0x60
mov byte [rsp + 0x28], 0x61
mov byte [rsp + 0x29], 0x59
mov byte [rsp + 0x2a], 0x60
mov byte [rsp + 0x2b], 0x64
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x1409d1808], 0
jne 0x140002fc0
mov byte [0x1409d1821], 1
mov eax, 0
lea rcx, [0x1409d1810]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140002f9b
mov byte [0x1409d1808], 1
lea rcx, [0x140001b30]
call fcn.1400014f0
lea rax, [0x1409d1810]
add rsp, 0x48
ret
Function at 0x140002fcc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x52
mov byte [rsp + 0x26], 0x55
mov byte [rsp + 0x27], 0x52
mov byte [rsp + 0x28], 0x68
mov byte [rsp + 0x29], 0x52
mov byte [rsp + 0x2a], 0x63
mov byte [rsp + 0x2b], 0x56
mov byte [rsp + 0x2c], 0x1f
mov byte [rsp + 0x2d], 0x54
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x5e
mov byte [rsp + 0x30], 0xf1
cmp byte [0x1409d17c0], 0
jne 0x140003066
mov byte [0x1409d17e1], 1
mov eax, 0
lea rcx, [0x1409d17d0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x11
jne 0x140003041
mov byte [0x1409d17c0], 1
lea rcx, [0x140001b60]
call fcn.1400014f0
lea rax, [0x1409d17d0]
add rsp, 0x48
ret

Function at 0x140003072
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x64
mov byte [rsp + 0x26], 0x54
mov byte [rsp + 0x27], 0x52
mov byte [rsp + 0x28], 0x5f
mov byte [rsp + 0x29], 0x58
mov byte [rsp + 0x2a], 0x66
mov byte [rsp + 0x2b], 0x52
mov byte [rsp + 0x2c], 0x63
mov byte [rsp + 0x2d], 0x55
mov byte [rsp + 0x2e], 0x1f
mov byte [rsp + 0x2f], 0x54
mov byte [rsp + 0x30], 0x60
mov byte [rsp + 0x31], 0x5e
mov byte [rsp + 0x32], 0xf1
cmp byte [0x1409d1c78], 0
jne 0x140003116
mov byte [0x1409d1c93], 1
mov eax, 0
lea rcx, [0x1409d1c80]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x13
jne 0x1400030f1
mov byte [0x1409d1c78], 1
lea rcx, [0x1400017b8]
call fcn.1400014f0
lea rax, [0x1409d1c80]
add rsp, 0x48
ret

Function at 0x140003122
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x61
mov byte [rsp + 0x26], 0x54
mov byte [rsp + 0x27], 0x61
mov byte [rsp + 0x28], 0x63
mov byte [rsp + 0x29], 0x60
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x2b], 0x56
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x65
mov byte [rsp + 0x2e], 0x1f
mov byte [rsp + 0x2f], 0x54
mov byte [rsp + 0x30], 0x60
mov byte [rsp + 0x31], 0x5e
mov byte [rsp + 0x32], 0xf1
cmp byte [0x1409d1bf0], 0
jne 0x1400031c6
mov byte [0x1409d1c13], 1
mov eax, 0
lea rcx, [0x1409d1c00]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x13
jne 0x1400031a1
mov byte [0x1409d1bf0], 1
lea rcx, [0x140001818]
call fcn.1400014f0
lea rax, [0x1409d1c00]
add rsp, 0x48
ret