joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400208d0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rax, qword [0x140065ec0]
mov qword [rsp + 0x40], rax
mov r12d, dword [rdx + 0x1c]
xor edi, edi
xor esi, esi
sub r12d, 6
mov rbp, rdx
test r12d, r12d
movsxd rbx, r12d
jle 0x140020912
mov rdx, rcx
mov r8, rbx
lea rcx, [rsp + 0x20]
shl r8, 2
call fcn.140027770
xor r8d, r8d
xor edx, edx
test r12d, r12d
jle 0x14002095c
lea r9d, [r8 + 8]
cmp edi, dword [rbp + 0x1c]
jg 0x14002095c
jmp 0x140020942
cmp rdx, 4
jge 0x14002094b
mov eax, dword [rsp + r8*4 + 0x20]
lea rcx, [r9 + rdx]
inc r8
inc esi
inc rdx
mov dword [rbp + rcx*4], eax
cmp r8, rbx
jl 0x140020927
cmp rdx, 4
jne 0x140020957
inc edi
add r9, 4
xor esi, esi
xor edx, edx
cmp r8, rbx
jl 0x140020920
cmp edi, dword [rbp + 0x1c]
movsxd r10, edi
movsxd r9, esi
jg 0x140020a87
lea r11, [0x140065250]
lea rsi, str.cw
movzx ecx, byte [rsp + rbx*4 + 0x1d]
mov al, byte [rsp + 0x20]
xor al, byte [rcx + rsi]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + rbx*4 + 0x1e]
mov al, byte [rax + rsi]
xor byte [rsp + 0x21], al
movzx eax, byte [rsp + rbx*4 + 0x1f]
mov al, byte [rax + rsi]
xor byte [rsp + 0x22], al
movzx eax, byte [rsp + rbx*4 + 0x1c]
mov al, byte [rax + rsi]
xor byte [rsp + 0x23], al
mov al, byte [r11]
add r11, 4
xor byte [rsp + 0x20], al
cmp r12d, 8
je 0x1400209d7
mov ecx, 1
jmp 0x1400209d0
mov eax, dword [rsp + rcx*4 + 0x1c]
xor dword [rsp + rcx*4 + 0x20], eax
inc rcx
cmp rcx, rbx
jl 0x1400209c5
jmp 0x140020a34
lea rcx, [rsp + 0x24]
mov edx, 3
mov eax, dword [rcx - 4]
xor dword [rcx], eax
add rcx, 4
dec rdx
jne 0x1400209e1
movzx eax, byte [rsp + 0x2c]
lea ecx, [rdx + 5]
mov al, byte [rax + rsi]
xor byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x2d]
mov al, byte [rax + rsi]
xor byte [rsp + 0x31], al
movzx eax, byte [rsp + 0x2e]
mov al, byte [rax + rsi]
xor byte [rsp + 0x32], al
movzx eax, byte [rsp + 0x2f]
mov al, byte [rax + rsi]
xor byte [rsp + 0x33], al
jmp 0x140020a2f
mov eax, dword [rsp + rcx*4 + 0x1c]
xor dword [rsp + rcx*4 + 0x20], eax
inc rcx
cmp rcx, rbx
jl 0x140020a24
xor edx, edx
test r12d, r12d
jle 0x140020a7e
lea r8, [r10*4 + 8]
cmp edi, dword [rbp + 0x1c]
jg 0x140020a87
jmp 0x140020a62
cmp r9, 4
jge 0x140020a6b
mov eax, dword [rsp + rdx*4 + 0x20]
lea rcx, [r9 + r8]
inc rdx
mov dword [rbp + rcx*4], eax
inc r9
cmp rdx, rbx
jl 0x140020a4a
cmp r9, 4
jne 0x140020a79
inc edi
inc r10
add r8, 4
xor r9d, r9d
cmp rdx, rbx
jl 0x140020a43
cmp edi, dword [rbp + 0x1c]
jle 0x140020979
mov rcx, qword [rsp + 0x40]
call fcn.1400274a0
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140020ab0
Capabilities:
Encode data using xor

Disassembly:
mov r10d, 1
mov r8, rcx
cmp dword [rcx + 0x1c], r10d
jle 0x140020bbe
lea r9, [rcx + 0x32]
lea r11, [0x140000000]
movzx edx, byte [r9 + 1]
movzx eax, byte [r9 - 1]
inc r10d
mov ecx, dword [r11 + rdx*4 + 0x64e50]
xor ecx, dword [r11 + rax*4 + 0x64650]
movzx eax, byte [r9]
add r9, 0x10
xor ecx, dword [r11 + rax*4 + 0x64a50]
movzx eax, byte [r9 - 0x12]
xor ecx, dword [r11 + rax*4 + 0x64250]
mov dword [r9 - 0x12], ecx
movzx ecx, byte [r9 - 0xb]
movzx eax, byte [r9 - 0xc]
mov edx, dword [r11 + rcx*4 + 0x64e50]
xor edx, dword [r11 + rax*4 + 0x64a50]
movzx eax, byte [r9 - 0xd]
xor edx, dword [r11 + rax*4 + 0x64650]
movzx eax, byte [r9 - 0xe]
xor edx, dword [r11 + rax*4 + 0x64250]
mov dword [r9 - 0xe], edx
movzx ecx, byte [r9 - 7]
movzx eax, byte [r9 - 8]
mov edx, dword [r11 + rcx*4 + 0x64e50]
xor edx, dword [r11 + rax*4 + 0x64a50]
movzx eax, byte [r9 - 9]
xor edx, dword [r11 + rax*4 + 0x64650]
movzx eax, byte [r9 - 0xa]
xor edx, dword [r11 + rax*4 + 0x64250]
mov dword [r9 - 0xa], edx
movzx eax, byte [r9 - 4]
movzx ecx, byte [r9 - 3]
mov edx, dword [r11 + rcx*4 + 0x64e50]
xor edx, dword [r11 + rax*4 + 0x64a50]
movzx eax, byte [r9 - 5]
xor edx, dword [r11 + rax*4 + 0x64650]
movzx eax, byte [r9 - 6]
xor edx, dword [r11 + rax*4 + 0x64250]
mov dword [r9 - 6], edx
cmp r10d, dword [r8 + 0x1c]
jl 0x140020ace
ret
Function at 0x140021610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x140065ec0]
mov qword [rsp + 0x38], rax
mov edi, 8
lea rdx, [0x1400655e0]
lea rcx, [rsp + 0x20]
mov r8d, edi
call fcn.14001fff0
mov rbx, qword [rsp + 0x20]
lea rdx, [0x1400655d8]
lea rcx, [rsp + 0x20]
mov r8d, edi
call fcn.14001fff0
mov rdi, qword [rsp + 0x20]
lea r8, [rsp + 0x28]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x475f4352
mov dword [rsp + 0x2c], 0x646e6172
mov dword [rsp + 0x30], 0x6e65704f
mov dword [rsp + 0x34], 0x676f44
call rbx
test rax, rax
mov rbx, rax
je 0x14002169a
mov edx, 0xffffffff
mov rcx, rax
call rdi
mov rax, rbx
mov rcx, qword [rsp + 0x38]
call fcn.1400274a0
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x1400216b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov eax, dword [0x140065570]
xor edi, edi
mov rbx, rcx
and eax, 3
cmp eax, edi
je 0x140021745
dec eax
je 0x140021721
dec eax
je 0x1400216fd
dec eax
jne 0x140021767
mov eax, dword [0x140065580]
lea rdx, [rcx + 2]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
call fcn.1400217c0
add dword [0x140065580], 0x3f2
jmp 0x140021767
mov eax, dword [0x14006557c]
lea rdx, [rcx + 2]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
call fcn.1400217c0
add dword [0x14006557c], 0x3f2
jmp 0x140021767
mov eax, dword [0x140065578]
lea rdx, [rcx + 2]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
call fcn.1400217c0
add dword [0x140065578], 0x3f2
jmp 0x140021767
mov eax, dword [0x140065574]
lea rdx, [rcx + 2]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
call fcn.1400217c0
add dword [0x140065574], 0x3f2
movzx eax, word [rbx + 2]
add dword [0x140065570], 0x3eb
lea rdx, [rbx + 0x12]
xor word [rbx], ax
mov eax, edi
inc edi
and eax, 3
shl eax, 2
mov ecx, dword [rax + rbx + 2]
xor dword [rdx], ecx
add rdx, 4
cmp edi, 0xa
jb 0x14002177c
mov al, byte [rbx + 0x10]
mov rcx, rbx
xor byte [rbx + 0x42], al
mov al, byte [rbx + 0x11]
xor byte [rbx + 0x43], al
call fcn.140021890
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x140021a60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
test r8b, 0xf
mov r13d, r8d
mov rbp, rdx
mov r12, rcx
je 0x140021a93
mov eax, 1
jmp 0x140021bbb
test r8d, r8d
je 0x140021bb9
add rcx, 0x14
lea rdx, [r12 + 0x10]
mov eax, dword [rbp]
mov r14d, dword [rbp + 4]
mov r15d, dword [rbp + 8]
add r14d, dword [r12 + 8]
mov dword [rsp + 0x24], eax
mov eax, dword [rbp + 0xc]
add rbp, 0x10
add r13d, 0xfffffff0
add eax, dword [r12 + 0xc]
mov qword [rsp + 0x98], rbp
mov ebp, dword [rsp + 0x24]
mov dword [rsp + 0xa0], r13d
mov r12d, eax
mov r13, rcx
mov qword [rsp + 0x28], 0x14
mov rsi, rdx
lea ecx, [r14 + r14 + 1]
mov edx, 5
imul ecx, r14d
call fcn.140021be0
lea ecx, [r12 + r12 + 1]
mov edx, 5
mov edi, eax
imul ecx, r12d
call fcn.140021be0
mov ecx, edi
mov edx, eax
xor ecx, ebp
mov ebx, eax
call fcn.140021be0
xor ebx, r15d
mov edx, edi
add eax, dword [rsi]
mov ecx, ebx
mov ebp, r14d
mov dword [rsp + 0x24], eax
call fcn.140021be0
add rsi, 8
mov r14d, eax
mov eax, dword [rsp + 0x24]
mov r15d, r12d
add r14d, dword [r13]
add r13, 8
dec qword [rsp + 0x28]
mov r12d, eax
jne 0x140021aef
mov rsi, qword [rsp + 0xa8]
mov r12, qword [rsp + 0x90]
mov r13d, dword [rsp + 0xa0]
mov ecx, dword [r12 + 0xb0]
add r15d, dword [r12 + 0xb4]
lea edx, [rbp + rcx]
mov rbp, qword [rsp + 0x98]
lea rcx, [r12 + 0x14]
mov dword [rsi], edx
mov dword [rsi + 4], r14d
mov dword [rsi + 8], r15d
mov dword [rsi + 0xc], eax
add rsi, 0x10
test r13d, r13d
mov qword [rsp + 0xa8], rsi
lea rdx, [r12 + 0x10]
jne 0x140021aa5
xor eax, eax
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140021cd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov rax, rcx
mov esi, r8d
mov ecx, 4
mov rbp, rdx
xor dword [rax], 0x41dfac36
add rax, 4
dec rcx
jne 0x140021cea
mov eax, dword [rdi + 0x10]
mov r8d, eax
lea ecx, [rax + rsi*8]
shr r8d, 3
mov eax, esi
shl eax, 3
and r8d, 0x3f
mov dword [rdi + 0x10], ecx
cmp ecx, eax
jae 0x140021d19
inc dword [rdi + 0x14]
mov eax, esi
mov ebx, 0x40
shr eax, 0x1d
sub ebx, r8d
add dword [rdi + 0x14], eax
cmp esi, ebx
jb 0x140021d64
lea rcx, [r8 + rdi + 0x18]
mov r8d, ebx
call 0x1400226c0
lea rdx, [rdi + 0x18]
mov rcx, rdi
call fcn.140021e40
jmp 0x140021d58
mov edx, ebx
mov rcx, rdi
add rdx, rbp
call fcn.140021e40
add ebx, 0x40
lea eax, [rbx + 0x3f]
cmp eax, esi
jb 0x140021d48
xor r8d, r8d
jmp 0x140021d66
xor ebx, ebx
sub esi, ebx
lea rcx, [r8 + rdi + 0x18]
mov edx, ebx
add rdx, rbp
mov r8d, esi
add rsp, 0x28
pop rdi
pop rsi
pop rbp
pop rbx
jmp 0x1400226c0
test r8d, r8d
je 0x1400226d8
sub rdx, rcx
mov r8d, r8d
mov al, byte [rdx + rcx]
mov byte [rcx], al
inc rcx
dec r8
jne 0x1400226cb
ret
Function at 0x140022720
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140022770
movzx r11d, word [rbx + 2]
xor word [rbx], r11w
xor edx, edx
lea r8, [rbx + 0x12]
mov eax, edx
inc edx
and eax, 3
shl eax, 2
mov ecx, dword [rax + rbx + 2]
xor dword [r8], ecx
add r8, 4
cmp edx, 0xa
jb 0x14002273d
mov al, byte [rbx + 0x10]
xor byte [rbx + 0x42], al
mov al, byte [rbx + 0x11]
xor byte [rbx + 0x43], al
add rsp, 0x20
pop rbx
ret

Function at 0x140022850
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
test r8b, 0xf
mov r14d, r8d
mov r13, rdx
mov r15, rcx
je 0x140022883
mov eax, 1
jmp 0x14002299d
test r8d, r8d
je 0x14002299b
lea rdx, [rcx + 0xa8]
mov edi, dword [r13 + 8]
mov eax, dword [r13]
mov ecx, dword [r13 + 0xc]
mov r12d, dword [r13 + 4]
sub edi, dword [r15 + 0xb4]
add r13, 0x10
add r14d, 0xfffffff0
sub eax, dword [r15 + 0xb0]
mov qword [rsp + 0x88], r13
mov dword [rsp + 0x90], r14d
mov r15d, ecx
mov r13, rdx
mov r14d, 0x14
mov ebp, r15d
mov r15d, edi
mov edx, 5
lea ecx, [r15 + r15 + 1]
mov edi, r12d
mov ebx, eax
mov r12d, eax
imul ecx, r15d
call fcn.140021be0
lea ecx, [r12 + r12 + 1]
mov edx, 5
mov esi, eax
imul ecx, ebx
call fcn.140021be0
sub edi, dword [r13 + 4]
mov ecx, edi
mov edx, eax
mov ebx, eax
call fcn.1400229c0
sub ebp, dword [r13]
mov edx, esi
mov edi, eax
mov ecx, ebp
xor edi, esi
call fcn.1400229c0
dec r14
xor eax, ebx
sub r13, 8
test r14, r14
jg 0x1400228d5
mov r14d, dword [rsp + 0x90]
mov r13, qword [rsp + 0x88]
mov edx, r12d
mov r12, qword [rsp + 0x98]
mov dword [rsp + 0x20], r15d
mov r15, qword [rsp + 0x80]
sub edx, dword [r15 + 8]
mov ecx, dword [rsp + 0x20]
sub ecx, dword [r15 + 0xc]
mov dword [r12], eax
mov dword [r12 + 4], edx
mov dword [r12 + 8], edi
add r12, 0x10
test r14d, r14d
mov dword [r12 - 4], ecx
mov qword [rsp + 0x98], r12
lea rdx, [r15 + 0xa8]
jne 0x140022893
xor eax, eax
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140023410
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x160
mov rax, qword [0x140065ec0]
mov qword [rsp + 0x158], rax
mov esi, ecx
mov edi, 8
lea rdx, [0x140065620]
lea rcx, [rsp + 0x30]
mov r8d, edi
call fcn.14001fff0
mov rbx, qword [rsp + 0x30]
lea rdx, [0x1400655f0]
lea rcx, [rsp + 0x30]
mov r8d, edi
call fcn.14001fff0
mov rbp, qword [rsp + 0x30]
lea rdx, [0x140065628]
lea rcx, [rsp + 0x30]
mov r8d, edi
call fcn.14001fff0
mov r12, qword [rsp + 0x30]
lea r8d, [rdi + 0xc]
lea rcx, [rsp + 0x140]
xor edx, edx
call fcn.140022700
cmp esi, 1
lea r8d, [rdi + 8]
lea rcx, [rsp + 0x140]
jne 0x1400234cc
lea rdx, [0x140065598]
call fcn.14001fff0
lea r11, [rsp + 0x140]
lea eax, [rdi - 4]
xor dword [r11], 0x3dd17ea6
add r11, 4
dec rax
jne 0x1400234ba
jmp 0x1400234fd
lea rdx, [0x1400655a8]
call fcn.14001fff0
lea r11, [rsp + 0x140]
mov eax, 4
xor dword [r11], 0x3dd17ea6
add r11, 4
dec rax
jne 0x1400234e5
mov byte [rsp + 0x151], 0x6c
lea rcx, [rsp + 0x140]
mov byte [rsp + 0x150], 0x6c
call rbx
test rax, rax
mov rdi, rax
je 0x1400235d1
lea rdx, [0x1400652f0]
mov r8d, 0x100
mov rcx, rax
call fcn.140023880
test eax, eax
je 0x14002358b
call fcn.140023660
cmp eax, 3
je 0x140023595
cmp eax, 4
je 0x140023595
cmp eax, 5
je 0x140023595
cmp qword [0x1400653f0], 0xffffffffffffffff
jne 0x140023595
lea rax, [rsp + 0x38]
lea r9, [0x1400652f0]
lea r8, [0x140023ca0]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.140023960
cmp dword [0x1400652e8], 0
mov qword [0x1400653f0], rax
jne 0x140023595
mov eax, 0xa816001f
jmp 0x140023631
mov ebx, 1
mov rdx, rbx
mov rcx, rdi
call r12
test rax, rax
mov qword [rsp + rbx*8 + 0x40], rax
je 0x1400235cc
inc rbx
cmp rbx, 0x1f
jb 0x14002359a
cmp esi, 1
mov rax, qword [rsp + 0x120]
jne 0x1400235d8
mov qword [0x140065560], rax
jmp 0x1400235df
mov rcx, rdi
call rbp
mov eax, 0xa8160005
jmp 0x140023631
mov qword [0x140065568], rax
mov rcx, qword [rsp + 0x68]
call fcn.140023a50
test eax, eax
je 0x1400235f4
mov eax, 0xa8160006
jmp 0x140023631
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xf8]
call fcn.140023b80
test eax, eax
je 0x140023614
mov eax, 0xa8160007
jmp 0x140023631
cmp esi, 1
jne 0x140023625
mov dword [0x140065558], 2
jmp 0x14002362f
mov dword [0x14006555c], 2
xor eax, eax
mov rcx, qword [rsp + 0x158]
call fcn.1400274a0
add rsp, 0x160
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140023660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
mov r11, rsp
sub rsp, 0xe0
mov rax, qword [0x140065ec0]
mov qword [rsp + 0xd8], rax
xor edx, edx
lea rcx, [r11 - 0x20]
lea r8d, [rdx + 0x14]
call fcn.1400237b0
mov byte [rsp + 0xc0], 0x47
mov byte [rsp + 0xc5], 0x72
mov byte [rsp + 0xca], 0x45
mov byte [rsp + 0xc1], 0x65
mov byte [rsp + 0xc6], 0x73
mov byte [rsp + 0xcb], 0x78
mov byte [rsp + 0xc2], 0x74
mov byte [rsp + 0xc7], 0x69
mov byte [rsp + 0xcc], 0x41
mov byte [rsp + 0xc3], 0x56
mov byte [rsp + 0xc8], 0x6f
mov byte [rsp + 0xcd], 0
mov byte [rsp + 0xc4], 0x65
mov byte [rsp + 0xc9], 0x6e
mov dword [rsp + 0x20], SysAllocStringByteLen
call fcn.1400237d0
lea rdx, [rsp + 0xc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0xc0]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.1400237b0
lea rcx, [rsp + 0x20]
call rbx
test eax, eax
jne 0x140023750
lea r8d, [rax + 0x14]
lea rcx, [rsp + 0xc0]
xor edx, edx
call fcn.1400237b0
xor eax, eax
jmp 0x140023787
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140023782
dec eax
je 0x14002376c
dec eax
jne 0x14002374c
cmp dword [rsp + 0x24], 5
sbb eax, eax
add eax, 7
jmp 0x140023787
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x14002377b
mov eax, 4
jmp 0x140023787
mov eax, 5
jmp 0x140023787
mov eax, 3
mov rcx, qword [rsp + 0xd8]
call fcn.1400274a0
add rsp, 0xe0
pop rbx
ret

Function at 0x1400237d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140065ec0]
mov qword [rsp + 0x38], rax
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
call fcn.1400237b0
cmp qword [0x1400652c8], 1
mov byte [rsp + 0x28], 0x2e
mov byte [rsp + 0x29], 0x64
mov byte [rsp + 0x2a], 0x6c
mov byte [rsp + 0x2b], 0x6c
mov byte [rsp + 0x20], 0x6b
mov byte [rsp + 0x21], 0x65
mov byte [rsp + 0x22], 0x72
mov byte [rsp + 0x23], 0x6e
mov byte [rsp + 0x24], 0x65
mov byte [rsp + 0x25], 0x6c
mov byte [rsp + 0x26], 0x33
mov byte [rsp + 0x27], 0x32
mov byte [rsp + 0x2c], 0
jne 0x14002384d
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1400652c8], rax
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
call fcn.1400237b0
mov rax, qword [0x1400652c8]
mov rcx, qword [rsp + 0x38]
call fcn.1400274a0
add rsp, 0x48
ret
Function at 0x140023880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x140065ec0]
mov qword [rsp + 0x38], rax
mov rbp, rdx
xor edx, edx
mov edi, r8d
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
call fcn.1400237b0
mov byte [rsp + 0x20], 0x47
mov byte [rsp + 0x25], 0x64
mov byte [rsp + 0x2a], 0x69
mov byte [rsp + 0x2f], 0x6d
mov byte [rsp + 0x21], 0x65
mov byte [rsp + 0x27], 0x6c
mov byte [rsp + 0x2c], 0x65
mov byte [rsp + 0x30], 0x65
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x26], 0x75
mov byte [rsp + 0x2b], 0x6c
mov byte [rsp + 0x31], 0x41
mov byte [rsp + 0x23], 0x4d
mov byte [rsp + 0x28], 0x65
mov byte [rsp + 0x2d], 0x4e
mov byte [rsp + 0x32], 0
mov byte [rsp + 0x24], 0x6f
mov byte [rsp + 0x29], 0x46
mov byte [rsp + 0x2e], 0x61
call fcn.1400237d0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.1400237b0
test rbx, rbx
jne 0x14002393d
lea eax, [rbx + 1]
jmp 0x140023948
mov r8d, edi
mov rdx, rbp
mov rcx, rsi
call rbx
mov rcx, qword [rsp + 0x38]
call fcn.1400274a0
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140023960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x58
mov rax, qword [0x140065ec0]
mov qword [rsp + 0x48], rax
mov r13, qword [rsp + 0xb8]
mov rdi, rdx
xor edx, edx
mov rbp, r8
mov rsi, rcx
lea r8d, [rdx + 0x14]
lea rcx, [rsp + 0x30]
mov r12, r9
call fcn.1400237b0
mov byte [rsp + 0x30], 0x43
mov byte [rsp + 0x35], 0x65
mov byte [rsp + 0x3a], 0x61
mov byte [rsp + 0x31], 0x72
mov byte [rsp + 0x36], 0x54
mov byte [rsp + 0x3b], 0x64
mov byte [rsp + 0x32], 0x65
mov byte [rsp + 0x37], 0x68
mov byte [rsp + 0x3c], 0
mov byte [rsp + 0x33], 0x61
mov byte [rsp + 0x38], 0x72
mov byte [rsp + 0x34], 0x74
mov byte [rsp + 0x39], 0x65
call fcn.1400237d0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.1400237b0
test rbx, rbx
jne 0x140023a0f
lea rax, [rbx - 1]
jmp 0x140023a2d
mov eax, dword [rsp + 0xb0]
mov r9, r12
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], eax
call rbx
mov rcx, qword [rsp + 0x48]
call fcn.1400274a0
add rsp, 0x58
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140024080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140065ec0]
mov qword [rsp + 0x38], rax
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
call fcn.1400237b0
mov byte [rsp + 0x20], 0x47
mov byte [rsp + 0x25], 0x73
mov byte [rsp + 0x2a], 0x6f
mov byte [rsp + 0x21], 0x65
mov byte [rsp + 0x26], 0x74
mov byte [rsp + 0x2b], 0x72
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x27], 0x45
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x23], 0x4c
mov byte [rsp + 0x28], 0x72
mov byte [rsp + 0x24], 0x61
mov byte [rsp + 0x29], 0x72
call fcn.1400237d0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.1400237b0
test rbx, rbx
jne 0x140024112
xor eax, eax
jmp 0x140024114
call rbx
mov rcx, qword [rsp + 0x38]
call fcn.1400274a0
add rsp, 0x40
pop rbx
ret

Function at 0x140024180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x68
mov rax, qword [0x140065ec0]
mov qword [rsp + 0x58], rax
mov r13, qword [rsp + 0xd0]
mov esi, edx
xor edx, edx
mov edi, r8d
mov rbp, rcx
lea r8d, [rdx + 0x14]
lea rcx, [rsp + 0x40]
mov r12, r9
call fcn.1400237b0
mov byte [rsp + 0x40], 0x43
mov byte [rsp + 0x45], 0x65
mov byte [rsp + 0x4a], 0x41
mov byte [rsp + 0x41], 0x72
mov byte [rsp + 0x46], 0x46
mov byte [rsp + 0x4b], 0
mov byte [rsp + 0x42], 0x65
mov byte [rsp + 0x47], 0x69
mov byte [rsp + 0x43], 0x61
mov byte [rsp + 0x48], 0x6c
mov byte [rsp + 0x44], 0x74
mov byte [rsp + 0x49], 0x65
call fcn.1400237d0
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.1400237b0
test rbx, rbx
jne 0x140024227
xor eax, eax
jmp 0x14002424f
mov eax, dword [rsp + 0xc8]
mov qword [rsp + 0x30], r13
mov r9, r12
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xc0]
mov r8d, edi
mov edx, esi
mov rcx, rbp
mov dword [rsp + 0x20], eax
call rbx
mov rcx, qword [rsp + 0x58]
call fcn.1400274a0
add rsp, 0x68
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140024270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x140065ec0]
mov qword [rsp + 0x38], rax
xor edx, edx
mov rdi, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
call fcn.1400237b0
mov byte [rsp + 0x20], 0x43
mov byte [rsp + 0x25], 0x48
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x21], 0x6c
mov byte [rsp + 0x26], 0x61
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x22], 0x6f
mov byte [rsp + 0x27], 0x6e
mov byte [rsp + 0x23], 0x73
mov byte [rsp + 0x28], 0x64
mov byte [rsp + 0x24], 0x65
mov byte [rsp + 0x29], 0x6c
call fcn.1400237d0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x14]
mov rbx, rax
call fcn.1400237b0
test rbx, rbx
jne 0x140024301
xor eax, eax
jmp 0x140024306
mov rcx, rdi
call rbx
mov rcx, qword [rsp + 0x38]
call fcn.1400274a0
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x140028628
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x140028652
call fcn.14002c2bc
and dword [rax], 0
call fcn.14002c29c
mov ebx, 0x16
mov dword [rax], ebx
call fcn.14002c234
mov eax, ebx
jmp 0x1400286a2
test edx, 0xfffffff9
jne 0x140028635
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14002867b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14002c2dc
call fcn.14002c29c
mov eax, dword [rax]
jmp 0x1400286a2
test al, 0x10
jne 0x1400286a0
test al, 1
je 0x1400286a0
test bl, 2
je 0x1400286a0
call fcn.14002c2bc
mov dword [rax], 5
call fcn.14002c29c
mov dword [rax], 0xd
jmp 0x140028672
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14002bd6b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140065ec0]
jne 0x1400274ba
rol rcx, 0x10
test cx, 0xffff
jne 0x1400274b6
repz ret
ror rcx, 0x10
jmp 0x14002bcc4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14006be10]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14006bf08]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14002bd49
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14006be10]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14002bd6b
mov rax, qword [rsp + 0x88]
mov qword [0x14006bf08], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14006bea8], rax
mov rax, qword [0x14006bf08]
mov qword [0x14006bd80], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14006be90], rax
mov dword [0x14006bd70], 0xc0000409
mov dword [0x14006bd74], 1
mov rax, qword [0x140065ec0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140065ec8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14006be08], eax
mov ecx, 1
call fcn.140036fe4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14004d5a0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14006be08], 0
jne 0x14002bdf2
mov ecx, 1
call fcn.140036fe4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14002c8d4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14002c744