joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180013940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rbx, rdx
mov r8, rcx
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x20], rdx
or r9d, 0xffffffff
xor ecx, ecx
xor edx, edx
mov qword [rbp + 0x77], 0
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [0x18007b950]
test rax, rax
jne 0x1800139df
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x6c64746e
mov dword [rbp - 0x15], 0x6c642e6c
mov word [rbp - 0x11], 0x6c
mov dword [rbp + 7], 0x496c7452
mov dword [rbp + 0xb], 0x5574696e
mov dword [rbp + 0xf], 0x6f63696e
mov dword [rbp + 0x13], 0x74536564
mov dword [rbp + 0x17], 0x676e6972
mov byte [rbp + 0x1b], al
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007b950], rax
lea rcx, [rbp - 9]
mov rdx, rbx
call rax
mov rax, qword [0x18007b068]
xor edx, edx
lea r9, [rbp + 0x77]
lea r8, [rbp - 9]
lea rcx, [rbp + 0x1f]
test rax, rax
jne 0x180013a09
call fcn.180013b90
jmp 0x180013a0b
call rax
test eax, eax
jns 0x180013a29
mov ecx, eax
call fcn.180013d90
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
mov r8, qword [rbp + 0x77]
lea rcx, [rbp + 0x7f]
mov edx, 0xf001f
call fcn.180013e20
test eax, eax
js 0x180013a0f
mov rax, qword [rbp + 0x7f]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
Function at 0x180013b90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov r14, rcx
lea rcx, [rbp - 0x50]
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov dword [rbp - 0x50], 0x6e72656b
mov dword [rbp - 0x4c], 0x61626c65
mov dword [rbp - 0x48], 0x642e6573
mov word [rbp - 0x44], 0x6c6c
mov byte [rbp - 0x42], 0
mov dword [rbp - 0x28], 0x65736142
mov dword [rbp - 0x24], 0x6d726f46
mov dword [rbp - 0x20], 0x624f7461
mov dword [rbp - 0x1c], 0x7463656a
mov dword [rbp - 0x18], 0x72747441
mov dword [rbp - 0x14], 0x74756269
mov word [rbp - 0x10], 0x7365
mov byte [rbp - 0xe], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007b068], rax
test rax, rax
jne 0x180013c8f
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x40], 0x6e65704f
mov dword [rbp - 0x3c], 0x656c6946
mov dword [rbp - 0x38], 0x7070614d
mov dword [rbp - 0x34], 0x57676e69
mov byte [rbp - 0x30], al
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
mov rdx, rax
mov eax, r8d
mov ecx, r8d
cmp byte [rcx + rdx], 0xff
jne 0x180013c7d
cmp byte [rcx + rdx + 1], 0x15
je 0x180013cb7
inc rcx
inc eax
cmp rcx, 0x70
jl 0x180013c70
mov rax, qword [0x18007b068]
mov r9, rbx
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
cdqe
add rdx, rax
mov rax, r8
nop
cmp byte [rax + rdx], 0xe8
je 0x180013cd4
inc rax
inc r8d
cmp rax, 0x70
jl 0x180013cc0
jmp 0x180013c88
movsxd rax, r8d
movsxd rcx, dword [rax + rdx + 1]
add rcx, rax
lea rax, [rdx + 5]
add rax, rcx
mov qword [0x18007b068], rax
jmp 0x180013c8f

Function at 0x180013d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18007b898]
mov ebx, ecx
test rax, rax
jne 0x180013e06
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x6e72656b
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x28], 0x6c6c642e
mov byte [rbp - 0x24], al
mov dword [rbp - 0x20], 0x65736142
mov dword [rbp - 0x1c], 0x4c746553
mov dword [rbp - 0x18], 0x4e747361
mov dword [rbp - 0x14], 0x72724554
mov word [rbp - 0x10], 0x726f
mov byte [rbp - 0xe], al
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007b898], rax
mov ecx, ebx
call rax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x180013e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rbx, qword [0x18007b958]
mov r15, r8
mov r12d, edx
mov rsi, rcx
test rbx, rbx
jne 0x180013fc6
lea rcx, [rbp - 0x21]
mov dword [rbp - 0x21], 0x6c64746e
mov dword [rbp - 0x1d], 0x6c642e6c
mov word [rbp - 0x19], 0x6c
mov dword [rbp - 1], 0x704f744e
mov dword [rbp + 3], 0x65536e65
mov dword [rbp + 7], 0x6f697463
mov word [rbp + 0xb], 0x6e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x21]
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x7f]
lea rcx, [rbp - 0x21]
mov dword [rbp + 0x7f], ebx
mov r14, rax
call fcn.1800127b0
mov rdi, rax
test rax, rax
je 0x180013ee6
mov r8d, dword [rbp + 0x7f]
mov rdx, r14
mov rcx, rax
call fcn.180012d20
mov rcx, rdi
test eax, eax
jne 0x180013efe
call fcn.1800031d0
mov rbx, qword [0x18007b958]
test rbx, rbx
jne 0x180013fc6
or eax, 0xffffffff
jmp 0x180013fda
mov edx, r13d
sub edx, r14d
call fcn.180012e80
mov rcx, rdi
mov r11d, eax
mov rax, qword [r11 + rdi]
mov qword [rbp + 0xf], rax
mov rax, qword [r11 + rdi + 8]
mov qword [rbp + 0x17], rax
call fcn.1800031d0
lea rcx, [rbp - 0x11]
mov dword [rbp - 0x11], 0x65696253
mov dword [rbp - 0xd], 0x2e6c6c44
mov dword [rbp - 9], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x10
lea r9, [rbp - 0x29]
test rax, rax
lea rdx, [rbp + 0x7f]
mov dword [rsp + 0x28], 0x40
cmovne r8d, ebx
or rcx, 0xffffffffffffffff
mov qword [rbp + 0x7f], rbx
lea eax, [r8 + 1]
mov byte [rbp + r8 + 0xf], 0xff
lea edi, [r8 + 0xe]
mov byte [rbp + rax + 0xf], 0x25
lea rax, [r8 + r13]
mov dword [rbp + r8 + 0x11], ebx
mov qword [rbp - 0x29], rdi
mov dword [rsp + 0x20], 0x3000
mov qword [rbp + r8 + 0x15], rax
call fcn.180012250
test eax, eax
cmovns rbx, qword [rbp + 0x7f]
mov qword [0x18007b958], rbx
test rbx, rbx
je 0x180013ef6
lea rdx, [rbp + 0xf]
mov r8d, edi
mov rcx, rbx
call fcn.1800029a0
jmp 0x180013eed
test rsi, rsi
je 0x180013ef6
mov r8, r15
mov edx, r12d
mov rcx, rsi
call rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180014010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rbx, qword [0x18007ade0]
mov r15, rdx
mov rsi, rcx
test rbx, rbx
jne 0x1800141b8
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x6c64746e
mov dword [rbp - 0x25], 0x6c642e6c
mov word [rbp - 0x21], 0x6c
mov dword [rbp - 9], 0x6e55744e
mov dword [rbp - 5], 0x5670616d
mov dword [rbp - 1], 0x4f776569
mov dword [rbp + 3], 0x63655366
mov dword [rbp + 7], 0x6e6f6974
mov byte [rbp + 0xb], bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x29]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x29]
mov dword [rbp + 0x77], ebx
mov r14, rax
call fcn.1800127b0
mov rdi, rax
test rax, rax
je 0x1800140d8
mov r8d, dword [rbp + 0x77]
mov rdx, r14
mov rcx, rax
call fcn.180012d20
mov rcx, rdi
test eax, eax
jne 0x1800140f0
call fcn.1800031d0
mov rbx, qword [0x18007ade0]
test rbx, rbx
jne 0x1800141b8
or eax, 0xffffffff
jmp 0x1800141c9
mov edx, r12d
sub edx, r14d
call fcn.180012e80
mov rcx, rdi
mov r11d, eax
mov rax, qword [r11 + rdi]
mov qword [rbp + 0xf], rax
mov rax, qword [r11 + rdi + 8]
mov qword [rbp + 0x17], rax
call fcn.1800031d0
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x65696253
mov dword [rbp - 0x15], 0x2e6c6c44
mov dword [rbp - 0x11], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x10
lea r9, [rbp + 0x7f]
test rax, rax
lea rdx, [rbp + 0x77]
mov dword [rsp + 0x28], 0x40
cmovne r8d, ebx
or rcx, 0xffffffffffffffff
mov qword [rbp + 0x77], rbx
lea eax, [r8 + 1]
mov byte [rbp + r8 + 0xf], 0xff
lea edi, [r8 + 0xe]
mov byte [rbp + rax + 0xf], 0x25
lea rax, [r8 + r12]
mov dword [rbp + r8 + 0x11], ebx
mov qword [rbp + 0x7f], rdi
mov dword [rsp + 0x20], 0x3000
mov qword [rbp + r8 + 0x15], rax
call fcn.180012250
test eax, eax
cmovns rbx, qword [rbp + 0x77]
mov qword [0x18007ade0], rbx
test rbx, rbx
je 0x1800140e8
lea rdx, [rbp + 0xf]
mov r8d, edi
mov rcx, rbx
call fcn.1800029a0
jmp 0x1800140df
test rsi, rsi
je 0x1800140e8
mov rdx, r15
mov rcx, rsi
call rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1800141f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xb0
mov rbx, qword [0x18007b8b8]
xor r13d, r13d
mov rdi, r8
mov r14, rdx
mov r15, rcx
test rbx, rbx
jne 0x1800143ac
lea rcx, [rbp - 0x59]
mov dword [rbp - 0x59], 0x6c64746e
mov dword [rbp - 0x55], 0x6c642e6c
mov word [rbp - 0x51], 0x6c
mov dword [rbp - 0x39], 0x614d744e
mov dword [rbp - 0x35], 0x65695670
mov dword [rbp - 0x31], 0x53664f77
mov dword [rbp - 0x2d], 0x69746365
mov word [rbp - 0x29], 0x6e6f
mov byte [rbp - 0x27], r13b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x39]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x59]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x59]
mov dword [rbp + 0x6f], r13d
mov rsi, rax
call fcn.1800127b0
mov rbx, rax
test rax, rax
je 0x1800142ca
mov r8d, dword [rbp + 0x6f]
mov rdx, rsi
mov rcx, rax
call fcn.180012d20
mov rcx, rbx
test eax, eax
jne 0x1800142e2
call fcn.1800031d0
mov rbx, qword [0x18007b8b8]
test rbx, rbx
jne 0x1800143ac
or eax, 0xffffffff
jmp 0x1800143ee
mov edx, r12d
sub edx, esi
call fcn.180012e80
mov rcx, rbx
mov r11d, eax
mov rax, qword [r11 + rbx]
mov qword [rbp - 0x21], rax
mov rax, qword [r11 + rbx + 8]
mov qword [rbp - 0x19], rax
call fcn.1800031d0
lea rcx, [rbp - 0x49]
mov dword [rbp - 0x49], 0x65696253
mov dword [rbp - 0x45], 0x2e6c6c44
mov dword [rbp - 0x41], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x10
lea r9, [rbp + 0x57]
test rax, rax
lea rdx, [rbp + 0x4f]
mov dword [rsp + 0x28], 0x40
cmovne r8d, r13d
or rcx, 0xffffffffffffffff
mov qword [rbp + 0x4f], r13
lea eax, [r8 + 1]
mov byte [rbp + r8 - 0x21], 0xff
lea esi, [r8 + 0xe]
mov byte [rbp + rax - 0x21], 0x25
lea rax, [r8 + r12]
mov dword [rbp + r8 - 0x1f], r13d
mov qword [rbp + 0x57], rsi
mov dword [rsp + 0x20], 0x3000
mov qword [rbp + r8 - 0x1b], rax
call fcn.180012250
mov rbx, r13
test eax, eax
cmovns rbx, qword [rbp + 0x4f]
mov qword [0x18007b8b8], rbx
test rbx, rbx
je 0x1800142da
lea rdx, [rbp - 0x21]
mov r8d, esi
mov rcx, rbx
call fcn.1800029a0
jmp 0x1800142d1
test rdi, rdi
je 0x1800142da
mov eax, dword [rbp + 0x7f]
xor r9d, r9d
mov r8, rdi
mov dword [rsp + 0x48], eax
mov rax, qword [rbp + 0x67]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x5f]
mov qword [rsp + 0x28], rax
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], r13
call rbx
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180014820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x30
lea rcx, [rsp + 0x20]
mov rbx, rdx
mov dword [rsp + 0x20], 0x72657375
mov dword [rsp + 0x24], 0x642e3233
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x2a], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rax
test rax, rax
je 0x1800148e8
mov ecx, dword [rbx + 0x100045c]
mov dword [0x18007b048], ecx
cmp ecx, 0xffff
jne 0x180014894
mov eax, dword [rbx + 0x1000458]
add rax, 6
add rax, rdx
mov qword [0x18007b878], rax
call fcn.180017c30
mov eax, 1
add rsp, 0x30
pop rbx
ret
cmp ecx, 0xfffe
jne 0x1800148a8
mov ecx, dword [rbx + 0x1000458]
add rcx, 0xb
jmp 0x1800148ce
cmp ecx, 0xfffd
jne 0x1800148bc
mov ecx, dword [rbx + 0x1000458]
add rcx, 6
jmp 0x1800148ce
cmp ecx, 0xfffc
mov ecx, dword [rbx + 0x1000458]
je 0x1800148b6
add rcx, 7
add rcx, rax
mov qword [0x18007b878], rcx
call fcn.180017c30
mov eax, 1
add rsp, 0x30
pop rbx
ret
add rsp, 0x30
pop rbx
ret
Function at 0x1800183e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x18007c0b0]
xor ebx, ebx
lea rcx, [0x18007ad70]
lea r8d, [rbx + 0x60]
xor edx, edx
mov dword [0x18007b940], ebx
mov dword [0x180076d50], ebx
mov dword [0x18007b894], ebx
mov dword [0x18007b970], ebx
mov dword [0x18007b890], ebx
mov dword [0x18007b060], ebx
mov dword [0x18007ad60], ebx
mov dword [0x18007b968], ebx
mov dword [0x18007adf0], ebx
mov dword [0x18007ad6c], ebx
mov dword [0x18007b874], ebx
mov dword [0x180048620], 1
mov dword [0x18004861c], 1
mov dword [0x18007b948], ebx
mov dword [0x180076d54], ebx
mov dword [0x180048624], 1
mov dword [0x18007b03c], ebx
mov dword [0x18007b064], ebx
mov dword [0x18007b934], ebx
mov qword [0x180076d48], rbx
mov qword [0x18007b888], rbx
mov qword [0x18007b040], rbx
mov qword [0x18007b928], rbx
mov dword [0x180048618], 1
mov dword [0x180048610], 1
mov dword [0x18007b05c], ebx
mov dword [0x18007b8b4], ebx
mov dword [0x18007b8ac], ebx
mov qword [0x180076d38], rbx
mov qword [0x18007c0b8], rax
call fcn.180008040
lea r8d, [rbx + 0x60]
lea rcx, [0x18007b8c0]
xor edx, edx
call fcn.180008040
mov dword [0x18007b04c], ebx
mov dword [0x18007ad64], ebx
movsd xmm0, qword [0x180041618]
movsd qword [0x180048628], xmm0
mov dword [0x180076d44], ebx
mov dword [0x18007b8a4], ebx
mov dword [0x18007b870], ebx
mov dword [0x18007adf8], ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x180076d58]
mov dword [0x18007b930], eax
mov dword [0x18007b8b0], eax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x180076d58]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x6d6e6977
mov dword [rbp - 0x1c], 0x6c642e6d
mov word [rbp - 0x18], 0x6c
mov qword [0x180076d30], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800185ab
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x10], 0x656d6974
mov dword [rbp - 0xc], 0x54746547
mov dword [rbp - 8], 0x656d69
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800185ab
call rax
mov dword [0x18007adfc], eax
mov dword [0x18007b058], eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1800185c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18007add0]
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x180018646
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x6c64746e
mov dword [rbp - 0x2c], 0x6c642e6c
mov word [rbp - 0x28], 0x6c
mov dword [rbp - 0x20], 0x466c7452
mov dword [rbp - 0x1c], 0x6873756c
mov dword [rbp - 0x18], 0x75636553
mov dword [rbp - 0x14], 0x654d6572
mov dword [rbp - 0x10], 0x79726f6d
mov dword [rbp - 0xc], 0x68636143
mov word [rbp - 8], 0x65
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007add0], rax
mov rdx, rbx
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180019e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp qword [0x18007b9c8], 0
je 0x180019e6e
mov eax, 1
add rsp, 0x50
pop rbp
ret
mov rcx, qword [sym.imp.USER32.dll_GetCursorPos]
mov r8d, 0x14
call fcn.18001a310
mov rcx, qword [sym.imp.USER32.dll_GetCursorPos]
mov r8d, 0xa
mov qword [0x18007b9c8], rax
call fcn.18001a210
mov dword [0x18007b998], eax
call fcn.180019f50
test eax, eax
jne 0x180019f2c
mov rcx, qword [sym.imp.USER32.dll_SetCursorPos]
lea r8d, [rax + 0xd]
call fcn.18001a210
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x72657375
mov dword [rbp - 0x2c], 0x642e3233
mov word [rbp - 0x28], 0x6c6c
mov byte [rbp - 0x26], 0
mov dword [0x18007b9a8], eax
mov dword [rbp - 0x20], 0x50746553
mov dword [rbp - 0x1c], 0x69737968
mov dword [rbp - 0x18], 0x436c6163
mov dword [rbp - 0x14], 0x6f737275
mov dword [rbp - 0x10], 0x736f5072
mov byte [rbp - 0xc], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, 0xd
mov rcx, rax
call fcn.18001a210
mov dword [0x18007b978], eax
xor eax, eax
cmp qword [0x18007b9c8], rax
setne al
add rsp, 0x50
pop rbp
ret

Function at 0x180019f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
cmp qword [0x18007b9a0], 0
jne 0x18001a07b
cmp qword [0x18007b980], 0
jne 0x18001a07b
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x336e6977
mov dword [rbp - 0x4c], 0x642e7532
mov word [rbp - 0x48], 0x6c6c
mov byte [rbp - 0x46], 0
mov dword [rbp - 0x20], 0x7355744e
mov dword [rbp - 0x1c], 0x65537265
mov dword [rbp - 0x18], 0x72754374
mov dword [rbp - 0x14], 0x50726f73
mov word [rbp - 0x10], 0x736f
mov byte [rbp - 0xe], 0
mov dword [rbp - 0x40], 0x72657375
mov dword [rbp - 0x3c], 0x642e3233
mov word [rbp - 0x38], 0x6c6c
mov byte [rbp - 0x36], 0
mov dword [rbp - 0x30], 0x43746553
mov dword [rbp - 0x2c], 0x6f737275
mov dword [rbp - 0x28], 0x736f5072
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001a05f
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [rax], 0xff
jne 0x18001a015
cmp byte [rax + 1], 0x25
je 0x18001a021
cmp byte [rax + 1], 0xff
jne 0x18001a041
cmp byte [rax + 2], 0x25
jne 0x18001a041
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007b980], rax
jmp 0x18001a05f
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007b9a0], rax
cmp qword [0x18007b9a0], 0
jne 0x18001a07b
cmp qword [0x18007b980], 0
jne 0x18001a07b
xor eax, eax
add rsp, 0x70
pop rbp
ret
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x18001ad90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
xor r13d, r13d
mov r15, rcx
lea rcx, [rsp + 0x50]
mov edi, r13d
mov r12, rdx
mov dword [rsp + 0x50], 0x6c64746e
mov dword [rsp + 0x54], 0x6c642e6c
mov dword [rsp + 0x58], 0x6c
mov dword [rsp + 0x30], 0x7551775a
mov byte [rsp + 0x5c], dil
mov dword [rsp + 0x48], edi
mov byte [rsp + 0x4c], dil
mov dword [rsp + 0x34], 0x56797265
mov dword [rsp + 0x38], 0x75747269
mov dword [rsp + 0x3c], 0x654d6c61
mov qword [rsp + 0x40], 0x79726f6d
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x18001af2e
mov qword [rsp + 0x360], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, rax
test rax, rax
je 0x18001af24
lea rcx, [rbp - 0x60]
xor edx, edx
mov r8d, 0x80
call fcn.180008040
lea rax, [rbp - 0x60]
or r9d, 0xffffffff
mov r8, r15
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x3c
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r15d, 0x80000000
nop dword [rax + rax]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x30
call r14
test eax, eax
js 0x18001af14
cmp dword [rbp - 0x68], 0x1000000
jne 0x18001af14
cmp qword [rsp + 0x78], rdi
je 0x18001af14
lea r9, [rbp + 0x20]
mov r8d, 2
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x20c
call r14
test eax, eax
js 0x18001af14
mov rcx, qword [rbp + 0x28]
mov edx, 0x5c
call fcn.1800038b4
lea rcx, [rbp - 0x60]
lea rdx, [rax + 2]
call fcn.180003740
test eax, eax
jne 0x18001af14
cmp rbx, r12
jne 0x18001af4b
test rdi, rdi
jne 0x18001af4b
mov rdi, qword [rsp + 0x78]
add rbx, 0x10000
cmp rbx, r15
jb 0x18001ae90
xor eax, eax
mov rsi, qword [rsp + 0x360]
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, rbx
jmp 0x18001af26
Function at 0x18001d070
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6778645c
mov dword [rsp + 0x24], 0x6c642e69
mov word [rsp + 0x28], 0x6c
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d0e8
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d0dd
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d100
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x2e747570
mov dword [rsp + 0x28], 0x6c6c64
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d179
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d16e
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d190
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x2e747570
mov dword [rsp + 0x28], 0x6c6c64
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d209
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d1fe
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d220
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x38747570
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d29e
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d293
add rax, rbx
add rsp, 0x230
pop rbx
ret