joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006c1c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1402f9040]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, qword [0x140302380]
cmp dword [rdi + 0xac], 1
jne 0x14006c1f2
xor al, al
jmp 0x14006c2e9
mov ecx, reloc.WS2_32.dll_recv
mov qword [rsp + 0x70], rbx
mov dword [rbp - 0x40], 0x5e6db562
mov dword [rbp - 0x3c], 0x14f7cdaf
mov dword [rbp - 0x38], 0xdd919622
mov dword [rbp - 0x34], 0xdab5f5b9
call fcn.14022f7fc
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x18], rax
mov rcx, rax
lea rbx, [rax + 0x10]
mov qword [rbp - 0x10], rbx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [rdi + 0x20]
shr eax, 0xc
mov qword [rbp - 0x18], rbx
test al, 1
je 0x14006c276
mov rax, qword [rbp - 0x20]
cmp rax, rbx
je 0x14006c276
mov ecx, dword [rdi + 0x208]
nop dword [rax]
cmp dword [rax], ecx
je 0x14006c26d
add rax, 4
cmp rax, rbx
jne 0x14006c260
cmp rax, rbx
jne 0x14006c300
cmp dword [rdi + 0x208], 0xc04f2c7f
jne 0x14006c2d6
movdqa xmm0, xmmword [0x1402c95b0]
lea rcx, [rbp - 0x3f]
mov edx, 0xf30c40c9
mov dword [rbp - 0x30], 0x72726566
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x2c], 0x72757465
mov word [rbp - 0x28], WSASetLastError
mov byte [rbp - 0x26], 0
call fcn.14002b8c0
mov rcx, qword [rdi + 0x180]
mov rdx, qword [rdi + 0x188]
cmp rcx, rdx
je 0x14006c2d6
cmp dword [rcx + 0x30], eax
je 0x14006c300
add rcx, 0x50
cmp rcx, rdx
jne 0x14006c2c8
mov bl, 1
lea rcx, [rbp - 0x20]
call fcn.14002ab70
movzx eax, bl
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14022f560
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
xor bl, bl
jmp 0x14006c2d8

Function at 0x14006dba0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x46], 0
mov rsi, r8
mov rdi, rcx
je 0x14006dc3a
xor ecx, ecx
mov edx, 0x1000
mov r8d, edx
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x14006dbe7
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movups xmm0, xmmword [rdi + 0x28]
mov r8d, Ordinal_41
mov rdx, rsi
movups xmmword [rax], xmm0
movsd xmm1, qword [rdi + 0x38]
lea ecx, [r8 - 0x27]
movsd qword [rax + 0x10], xmm1
mov eax, dword [rdi + 0x40]
mov dword [rbx + 0x18], eax
movzx eax, word [rdi + 0x44]
mov word [rbx + 0x1c], ax
call rbx
xor edx, edx
mov r8d, 0x1000
mov rcx, rbx
mov edi, eax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14006dc4f
mov r8d, Ordinal_41
mov rdx, rsi
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov edi, eax
mov rbx, qword [rsp + 0x30]
test edi, edi
mov rsi, qword [rsp + 0x38]
setg al
add rsp, 0x20
pop rdi
ret
Function at 0x14006ea00
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1402f9040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
movzx ecx, dx
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ecx, ecx
mov qword [rsp + 0x20], 1
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov word [rsp + 0x28], cx
mov rcx, rbx
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 8
call fcn.14006dba0
movzx eax, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14022f560
add rsp, 0x50
pop rbx
ret

Function at 0x14006ea80
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1402f9040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
movzx ecx, dx
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ecx, ecx
mov qword [rsp + 0x20], 1
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov word [rsp + 0x28], cx
mov rcx, rbx
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 0xa
call fcn.14006dba0
movzx eax, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14022f560
add rsp, 0x50
pop rbx
ret

Function at 0x14006f210
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1402f9040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, r8
mov rsi, rcx
mov rax, qword [0x1403022c0]
cmp byte [rax + 0x6c], 0
jne 0x14006f378
mov rbp, qword [0x140302380]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov rdx, qword [0x140305598]
sub rdx, qword [0x140305590]
je 0x14006f2a5
lea rcx, [rsp + 0x30]
call fcn.140012ed0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [0x140305598]
mov rdx, qword [0x140305590]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + rdi]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x170]
call fcn.140062670
test al, al
jne 0x14006f378
mov rax, qword [0x1403022e0]
cmp dword [rax + 0x15c], 1
je 0x14006f378
movss xmm0, dword [rsi]
addss xmm0, dword [0x1402c80d0]
comiss xmm0, dword [0x140302194]
ja 0x14006f378
xor edx, edx
call fcn.14006e850
movzx ebx, ax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x14006f378
mov rcx, qword [0x1403027b8]
test rcx, rcx
jne 0x14006f331
mov ecx, 0x36e490
call fcn.14022f7fc
mov qword [rsp + 0x28], rax
mov rcx, rax
call fcn.1401debe0
mov rcx, rax
mov qword [0x1403027b8], rax
movsd xmm0, qword [r14]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [r14 + 8]
mov dword [rsp + 0x38], eax
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x28]
call fcn.1401de270
mov rdx, qword [rsp + 0x28]
call fcn.14006dc70
movzx edx, bx
mov rcx, rsi
call fcn.14006ea80
movss xmm0, dword [0x140302194]
movss dword [rsi], xmm0
mov al, 1
jmp 0x14006f37a
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14022f560
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14007f610
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14007f66d
lea rbx, [0x1402b5540]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14007f654
cmp r10, 2
jb 0x14007f654
cmp byte [r9], r8b
jne 0x14007f654
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14007f630
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14007f6af
lea rbx, [0x1402b5540]
cmp r8b, 0x23
jne 0x14007f693
cmp byte [r9], r8b
jne 0x14007f693
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14007f680
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x14007f7f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14007f80a
mov qword [r8], 0
lea rdx, [0x1402bea14]
call fcn.14007f6c0
mov rbx, rax
test rax, rax
jne 0x14007f82a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x14007f901
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14007f901
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14007f901
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14007f901
cmp rdi, 0xffffffffffffffff
je 0x14007f901
mov rax, qword [0x140302260]
test rax, rax
je 0x14007f89e
inc dword [rax + 0xec]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14007f901
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14007f8ee
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140302260]
test rax, rax
je 0x14007f8e3
dec dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14007f90a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14007f8fc
mov qword [r14], rdi
mov rax, rsi
jmp 0x14007f90c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140081720
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xd0]
mov rax, qword [rcx + 0xd8]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x1402b5540]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x140302260]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3f5c], ebx
jne 0x1400817b6
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.1400922d0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14008c160
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1402f9040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140302260]
mov edi, ecx
cmp byte [rbx + 0x42cd], 0
jne 0x14008c1c1
cmp byte [rbx + 0x42ce], 0
jne 0x14008c1c1
movsx r9d, word [rbx + 0x53b2]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.14007f590
test dil, 1
je 0x14008c2e8
jmp 0x14008c24a
movss xmm1, dword [rbx + 0x38b0]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x53b2]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1402c808c]
mulss xmm1, dword [0x1402c8060]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd94]
addss xmm1, dword [rbx + 0xd98]
mov qword [rbx + 0x4048], rax
mov dword [rbx + 0x4034], 1
movss dword [rbx + 0x4040], xmm0
movss dword [rbx + 0x4044], xmm1
movss xmm0, dword [rbx + 0x390c]
mulss xmm0, dword [0x1402c7c48]
or dword [rbx + 0x4030], 0x41
movss dword [rbx + 0x4090], xmm0
call fcn.14007f590
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14008c2a0
lea r11, [0x1402b5540]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x14008c283
cmp byte [r8], r9b
jne 0x14008c283
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14008c270
not ecx
call fcn.140085b20
test rax, rax
je 0x14008c2e8
cmp byte [rax + 0x96], 0
je 0x14008c2e8
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x53b2]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x53b2]
call fcn.14007f590
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.140088220
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14022f560
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140090f60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5460], 0
lea rbx, [rcx + 0x5468]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140091007
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140090fba
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140092e50
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14007fc50
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5460]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5470]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1403021d1]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14009100f
mov rcx, rbx
call fcn.14007fc50
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140091580
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140302260]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1400915e3
mov qword [rsp], rbx
lea rbx, [0x1402b5540]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400915c3
cmp byte [r8], r9b
jne 0x1400915c3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1400915b0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5410]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140091617
mov r10, qword [r10 + 0x5418]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14009161e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140091604
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x1400b0540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x1400b0574
cmp ecx, r10d
jge 0x1400b0562
mov rcx, rbx
call fcn.1400afd50
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x1400b05ae
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x1400b0590
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x1400b05d6
mov rax, qword gs:[0x58]
mov edx, Ordinal_41
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x1400b0605
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x1400b05ef
xor dl, dl
jmp 0x1400b05f8
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1400b05e6
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x1400b05b2
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x1400b066f
mov rax, qword gs:[0x58]
mov edx, Ordinal_41
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x1400b0689
mov rcx, rbx
call fcn.1400afe90
test eax, eax
je 0x1400b0662
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1400c2c70
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rbx, qword [rsi + 0x50]
cmp rbx, qword [rsi + 0x58]
je 0x1400c2d26
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
lea r15, [rbx + 0x2d0]
nop word [rax + rax]
mov rdx, rbx
mov rcx, rsi
call fcn.1400c3be0
test al, al
jne 0x1400c2d03
mov rbp, qword [rsi + 0x58]
mov rdi, r15
cmp r15, rbp
je 0x1400c2ce9
mov r14, rbx
sub r14, r15
lea rcx, [r14 + rdi]
mov rdx, rdi
call fcn.1400c73a0
add rdi, 0x2d0
cmp rdi, rbp
jne 0x1400c2cd1
mov rcx, qword [rsi + 0x58]
sub rcx, 0x2d0
call fcn.1400c5f00
add qword [rsi + 0x58], 0xfffffffffffffd30
jmp 0x1400c2d11
add rbx, 0x2d0
add r15, 0x2d0
cmp rbx, qword [rsi + 0x58]
jne 0x1400c2cb0
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
cmp byte [rsi + 0x6c], 0
je 0x1400c2dde
movss xmm0, dword [rsi + 0x70]
ucomiss xmm0, dword [0x140302828]
jp 0x1400c2d60
jne 0x1400c2d60
movss xmm0, dword [rsi + 0x74]
ucomiss xmm0, dword [0x14030282c]
jp 0x1400c2d60
jne 0x1400c2d60
movss xmm0, dword [rsi + 0x78]
ucomiss xmm0, dword [0x140302830]
jp 0x1400c2d60
je 0x1400c2dde
mov rax, qword [rsi + 0xb0]
cmp byte [rax + 0x2b2], 0
je 0x1400c2dde
cmp byte [0x140302199], 0
jne 0x1400c2e55
cmp byte [0x140302198], 0
jne 0x1400c2e55
call fcn.1401465b0
mov dl, 1
mov rcx, rax
call fcn.1400becd0
call fcn.140146b10
mov ecx, dword [rsi + 0x78]
lea rdx, [rsp + 0x20]
movsd xmm0, qword [rsi + 0x70]
mov dword [rsp + 0x28], ecx
mov rcx, rax
movsd qword [rsp + 0x20], xmm0
call fcn.14006e270
call fcn.1401465b0
xor edx, edx
mov rcx, rax
call fcn.1400becd0
mov rax, qword [0x1403022e0]
mov word [rax + 0x1a0], 0
jmp 0x1400c2e00
cmp byte [0x140302199], 0
jne 0x1400c2e55
cmp byte [0x140302198], 0
jne 0x1400c2e55
mov rax, qword [0x1403022e0]
mov word [rax + 0x1a0], 0x101
mov rcx, rsi
call fcn.1400c45d0
mov rdi, qword [rsi + 0x58]
mov rbx, qword [rsi + 0x50]
cmp rbx, rdi
je 0x1400c2e55
nop word [rax + rax]
mov rdx, qword [0x140302380]
lea rcx, [rbx + 0x228]
add rdx, 8
call fcn.1400bee00
test al, al
jne 0x1400c2e49
cmp byte [rbx + 0x2c9], al
je 0x1400c2e49
mov byte [rbx + 0x2c8], al
add rbx, 0x2d0
cmp rbx, rdi
jne 0x1400c2e20
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400ce9c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rcx, qword [0x140302380]
mov rbx, rdx
movsxd rax, dword [rcx + 0x3e8]
cmp eax, 1
jge 0x1400ce9fa
xorps xmm0, xmm0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
movss xmm0, dword [rcx + 0x70]
cvtps2pd xmm0, xmm0
mov dword [rbp - 0x60], 0x43af0000
mov dword [rbp - 0x5c], 0x43fa0000
mov dword [rbp - 0x58], 0x44228000
movss xmm1, dword [rbp + rax*4 - 0x64]
addss xmm1, dword [rcx + 0x60]
mulsd xmm0, qword [0x1402c7d90]
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm7
cvtps2pd xmm2, xmm1
addsd xmm2, xmm0
cvtpd2ps xmm2, xmm2
call fcn.14006f8f0
mov edx, 0xe00c22e0
mov dword [rbp - 0x60], 0x65727a65
lea rcx, [rbp - 0x5f]
mov dword [rbp - 0x5c], 0x61776c61
movaps xmm7, xmm0
mov dword [rbp - 0x58], 0x63617474
xorps xmm6, xmm6
mov word [rbp - 0x54], 0x68
mov byte [rbp - 0x52], 0
call fcn.14002b8c0
mov rcx, qword [rbx + 0x180]
mov rdx, qword [rbx + 0x188]
cmp rcx, rdx
je 0x1400ceb0e
nop
cmp dword [rcx + 0x30], eax
je 0x1400ceaa0
add rcx, 0x50
cmp rcx, rdx
jne 0x1400cea90
jmp 0x1400ceb0e
mov rcx, qword [0x140302380]
movsxd rax, dword [rcx + 0x318]
cmp eax, 1
jl 0x1400ceb0e
movaps xmm1, xmmword [0x1402c9050]
mov rdx, rbx
movaps xmm0, xmmword [0x1402c9150]
movups xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0x40], 0x42b40000
movups xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x28], 0x43960000
movss xmm0, dword [rbp + rax*4 - 0x54]
mulss xmm0, dword [rcx + 0x70]
addss xmm0, dword [rbp + rax*4 - 0x3c]
cvtps2pd xmm1, xmm0
movss xmm0, dword [rcx + 0x60]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x1402c7d50]
addsd xmm1, xmm0
cvtpd2ps xmm2, xmm1
call fcn.14006f8f0
movaps xmm6, xmm0
mov rbx, qword [rsp + 0x90]
addss xmm6, xmm7
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbp
ret
Function at 0x1400e6680
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov eax, dword [r8 + 0x90]
mov rbp, r8
mov r15, rdx
test eax, eax
je 0x1400e66e3
movzx ecx, word [r8 + 0x14]
xor r9d, r9d
add rcx, 0x18
mov r10d, eax
add rcx, r8
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x1400e66e3
mov edx, dword [rcx + 0xc]
cmp r10, rdx
jb 0x1400e66d7
mov eax, dword [rcx + 8]
add eax, edx
cmp r10, rax
jb 0x1400e66fe
inc r9d
add rcx, 0x28
cmp r9d, r8d
jl 0x1400e66c5
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov r8d, dword [rcx + 0x14]
sub r8, rdx
add r8, r10
add r8, r15
je 0x1400e66e3
cmp dword [r8 + 0x10], 0
lea r14, [r8 + 0x10]
je 0x1400e66e3
nop dword [rax + rax]
movzx edx, word [rbp + 0x14]
xor r8d, r8d
movzx r11d, word [rbp + 6]
add rdx, 0x18
mov r10d, dword [r14 - 4]
add rdx, rbp
mov rcx, rdx
test r11d, r11d
je 0x1400e66e3
nop
mov r9d, dword [rcx + 0xc]
cmp r10, r9
jb 0x1400e6754
mov eax, dword [rcx + 8]
add eax, r9d
cmp r10, rax
jb 0x1400e6762
inc r8d
add rcx, 0x28
cmp r8d, r11d
jl 0x1400e6740
jmp 0x1400e66e3
mov esi, dword [rcx + 0x14]
sub rsi, r9
add rsi, r10
add rsi, r15
je 0x1400e66e3
mov r9d, dword [r14]
xor ecx, ecx
nop dword [rax]
mov r8d, dword [rdx + 0xc]
cmp r9, r8
jb 0x1400e6798
mov eax, dword [rdx + 8]
add eax, r8d
cmp r9, rax
jb 0x1400e6825
inc ecx
add rdx, 0x28
cmp ecx, r11d
jl 0x1400e6780
xor edi, edi
mov r9, qword [rdi]
test r9, r9
je 0x1400e6812
nop dword [rax]
movzx eax, word [rbp + 0x14]
xor edx, edx
movzx r10d, word [rbp + 6]
add rax, 0x18
add rax, rbp
test r10d, r10d
je 0x1400e67e6
mov r8d, dword [rax + 0xc]
cmp r9, r8
jb 0x1400e67db
mov ecx, dword [rax + 8]
add ecx, r8d
cmp r9, rcx
jb 0x1400e6836
inc edx
add rax, 0x28
cmp edx, r10d
jl 0x1400e67c7
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400e6844
lea rdx, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi], rax
add rdi, 8
mov r9, qword [rdi]
test r9, r9
jne 0x1400e67b0
add r14, 0x14
cmp dword [r14], 0
jne 0x1400e6720
jmp 0x1400e66e3
mov edi, dword [rdx + 0x14]
sub rdi, r8
add rdi, r9
add rdi, r15
jmp 0x1400e67a5
mov ebx, dword [rax + 0x14]
sub rbx, r8
add rbx, r9
add rbx, r15
jmp 0x1400e67e8
jmp 0x1400e66e5
Function at 0x1400e6850
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
push r14
push r15
mov eax, dword [r8 + 0xb0]
mov r14, r9
mov rdi, r8
mov r15, rdx
test eax, eax
je 0x1400e68a5
movzx ecx, word [r8 + 0x14]
xor r9d, r9d
add rcx, 0x18
mov r10d, eax
add rcx, r8
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x1400e68a5
mov edx, dword [rcx + 0xc]
cmp r10, rdx
jb 0x1400e6899
mov eax, dword [rcx + 8]
add eax, edx
cmp r10, rax
jb 0x1400e68ae
inc r9d
add rcx, 0x28
cmp r9d, r8d
jl 0x1400e6887
xor al, al
pop r15
pop r14
pop rdi
pop rsi
ret
mov esi, dword [rcx + 0x14]
mov rax, rdx
sub rsi, rdx
add rsi, r10
add rsi, r15
je 0x1400e68a5
mov qword [rsp + 0x30], rbp
xor ebp, ebp
cmp dword [rdi + 0xb4], ebp
jbe 0x1400e69a0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], r12
mov r12d, 0xf000
mov qword [rsp + 0x40], r13
mov r13d, 0xa000
nop dword [rax]
mov ebx, dword [rsi + 4]
lea r10, [rsi + 8]
movzx eax, word [rdi + 0x14]
sub rbx, 8
movzx r9d, word [rdi + 6]
add rax, 0x18
mov r11d, dword [rsi]
add rax, rdi
shr rbx, 1
xor edx, edx
test r9d, r9d
je 0x1400e693f
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp r11, r8
jb 0x1400e6934
mov ecx, dword [rax + 8]
add ecx, r8d
cmp r11, rcx
jb 0x1400e69ac
inc edx
add rax, 0x28
cmp edx, r9d
jl 0x1400e6920
xor r9d, r9d
xor ecx, ecx
test rbx, rbx
je 0x1400e697f
nop dword [rax]
movzx eax, word [r10]
movzx edx, ax
and ax, r12w
cmp ax, r13w
jne 0x1400e6972
and edx, 0xfff
mov rax, r14
sub rax, qword [rdi + 0x30]
add qword [rdx + r9], rax
inc ecx
add r10, 2
mov eax, ecx
cmp rax, rbx
jb 0x1400e6950
add ebp, dword [rsi + 4]
mov rsi, r10
cmp ebp, dword [rdi + 0xb4]
jb 0x1400e68f0
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
pop r15
pop r14
pop rdi
pop rsi
ret
mov r9d, dword [rax + 0x14]
sub r9, r8
add r9, r11
add r9, r15
jmp 0x1400e6942