joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180023670
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1800236ff
mov rdx, qword [rbx + 0x18]
add rdx, 0x20
call fcn.1800a1fd0
cmp qword [rbx + 8], 0
jne 0x18002369a
xor ecx, ecx
jmp 0x1800236ae
lea rdx, [rbx + 0x24]
mov rcx, rbx
call fcn.180023750
mov rcx, qword [rbx + 8]
test al, al
jne 0x1800236b5
mov dword [rbx + 0x24], 0
call fcn.1800a1f20
mov rax, qword [rbx + 8]
lea rdx, [rbx + 0x10]
test rax, rax
je 0x1800236ff
test rdx, rdx
je 0x1800236ff
mov dword [rsp + 0x40], 0
mov rax, qword [rax]
test rax, rax
je 0x1800236ff
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x1800236ff
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x30
pop rbx
ret

Function at 0x180023750
Capabilities:
Encode data using xor
Get file size
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 8]
mov rbp, rcx
mov r14, rdx
mov rcx, qword [rax]
test rcx, rcx
je 0x180023868
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x180023868
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, 0xffffffff
mov edi, eax
cmp eax, ebx
jne 0x1800237b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180023868
mov ecx, dword [rsp + 0x20]
mov rax, rdi
shl rcx, 0x20
add rcx, rdi
cmp rcx, 0x20
jb 0x180023868
jne 0x1800237de
xor eax, eax
mov dword [r14], eax
mov al, 1
jmp 0x18002386a
lea edi, [rcx - 0x20]
mov edx, 0x20
mov rcx, rbp
call fcn.180023890
mov ecx, edi
lea rdx, [0x18020b5ac]
call fcn.1800d8be4
mov rsi, rax
test rax, rax
je 0x180023868
cmp qword [rbp + 8], 0
je 0x180023860
mov r8d, edi
mov rdx, rax
mov rcx, rbp
call fcn.180024110
test al, al
je 0x180023860
xor eax, eax
test edi, edi
je 0x180023851
mov rdx, rsi
lea r8, [0x18019cee0]
nop dword [rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
mov eax, dword [r8 + rax*4]
xor eax, ebx
mov ebx, eax
sub edi, 1
jne 0x180023830
not eax
mov rcx, rsi
mov dword [r14], eax
call fcn.1800d80b0
mov al, 1
jmp 0x18002386a
mov rcx, rsi
call fcn.1800d80b0
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800d8050
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x180024110
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, r8d
test rdx, rdx
je 0x180024162
test ebx, ebx
jne 0x18002412a
mov al, 1
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
test rax, rax
je 0x180024162
cmp qword [rax], 0xffffffffffffffff
je 0x180024162
xor eax, eax
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], eax
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180024162
cmp dword [rsp + 0x48], ebx
je 0x180024122
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x180024170
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov ebx, r8d
test rax, rax
je 0x1800241c9
test rdx, rdx
je 0x1800241c9
test ebx, ebx
jne 0x180024193
mov al, 1
add rsp, 0x30
pop rbx
ret
xor r8d, r8d
mov dword [rsp + 0x40], r8d
mov rax, qword [rax]
test rax, rax
je 0x1800241c9
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x1800241c9
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x40]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800241c9
cmp ebx, dword [rsp + 0x40]
je 0x18002418b
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x1800241e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov rcx, rdi
lea rdx, [0x180194414]
mov r14, r8
call fcn.180004070
mov rcx, qword [rsi + 8]
xor ebp, ebp
mov dword [r14], ebp
test rcx, rcx
je 0x180024362
mov dword [rsp + 0x60], ebp
mov rax, qword [rcx]
test rax, rax
je 0x180024362
cmp qword [rax], 0xffffffffffffffff
je 0x180024362
mov dword [rsp + 0x50], ebp
lea r9, [rsp + 0x50]
mov rcx, qword [rcx]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rbp
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180024362
cmp dword [rsp + 0x50], 4
jne 0x180024362
mov eax, dword [rsp + 0x60]
cmp eax, 0x7d0
ja 0x180024362
shr eax, 1
mov rcx, rdi
mov qword [rsp + 0x58], rbx
lea ebx, [rax + 1]
call fcn.180006030
mov rcx, rdi
cmp rbx, rax
ja 0x1800242b6
call fcn.1800038c0
mov rcx, rax
mov word [rsp + 0x50], bp
mov qword [rax + 0x10], rbx
call fcn.180003ef0
lea rdx, [rsp + 0x50]
lea rcx, [rax + rbx*2]
call fcn.180004340
jmp 0x1800242c4
sub rbx, rax
xor r8d, r8d
mov rdx, rbx
call fcn.180024880
mov rcx, rdi
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp qword [rsi + 8], rbp
je 0x18002434f
mov r8d, dword [rsp + 0x60]
mov rdx, rax
mov rcx, rsi
call fcn.180024110
test al, al
je 0x18002434f
mov esi, dword [rsp + 0x60]
mov rcx, rdi
add esi, 4
call fcn.180005c00
test al, al
jne 0x180024337
mov rcx, rdi
call fcn.1800038c0
mov rcx, rdi
mov rbx, qword [rax + 0x10]
dec rbx
call fcn.1800038c0
mov rcx, rax
mov word [rsp + 0x50], bp
mov qword [rax + 0x10], rbx
call fcn.180003ef0
lea rdx, [rsp + 0x50]
lea rcx, [rax + rbx*2]
call fcn.180004340
mov dword [r14], esi
mov al, 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
lea rdx, [0x180194414]
mov rcx, rdi
call fcn.180004070
xor al, al
jmp 0x18002433c
mov rbp, qword [rsp + 0x68]
xor al, al
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x180024380
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rbx, r8
mov rcx, rdx
mov rdi, rdx
call fcn.180006030
add eax, eax
mov dword [rsp + 0x40], eax
mov rax, qword [rsi + 8]
test rax, rax
je 0x180024421
xor edx, edx
mov dword [rsp + 0x58], edx
mov rax, qword [rax]
test rax, rax
je 0x180024421
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x180024421
mov qword [rsp + 0x20], rdx
lea r8d, [rdx + 4]
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180024421
cmp dword [rsp + 0x58], 4
jne 0x180024421
mov rcx, rdi
call fcn.180003a80
mov r8d, dword [rsp + 0x40]
mov rdx, rax
mov rcx, rsi
call fcn.180024170
test al, al
je 0x180024421
mov eax, dword [rsp + 0x40]
add eax, 4
mov dword [rbx], eax
mov al, 1
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
xor al, al
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180024440
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
mov r14, r8
mov rcx, rdx
mov rdi, rdx
call fcn.18000a130
mov rcx, qword [rbp + 8]
xor r15d, r15d
mov dword [r14], r15d
test rcx, rcx
je 0x180024550
mov dword [rsp + 0x60], r15d
mov rax, qword [rcx]
test rax, rax
je 0x180024550
cmp qword [rax], 0xffffffffffffffff
je 0x180024550
mov dword [rsp + 0x70], r15d
lea r9, [rsp + 0x70]
mov rcx, qword [rcx]
lea rdx, [rsp + 0x60]
mov esi, 4
mov qword [rsp + 0x20], r15
mov r8d, esi
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180024550
cmp dword [rsp + 0x70], esi
jne 0x180024550
mov eax, dword [rsp + 0x60]
cmp eax, 0x3e8
ja 0x180024550
mov edx, eax
mov qword [rsp + 0x68], rbx
mov r8, rdi
mov rcx, rdi
call fcn.18001c390
mov ebx, r15d
cmp dword [rsp + 0x60], ebx
jbe 0x18002451f
nop
mov edx, ebx
mov rcx, rdi
mov dword [rsp + 0x70], r15d
call fcn.18000a040
mov rdx, rax
lea r8, [rsp + 0x70]
mov rcx, rbp
call fcn.1800241e0
add esi, dword [rsp + 0x70]
test al, al
je 0x180024535
inc ebx
cmp ebx, dword [rsp + 0x60]
jb 0x1800244f0
mov rbx, qword [rsp + 0x68]
mov al, 1
mov dword [r14], esi
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call fcn.18000a130
mov rbx, qword [rsp + 0x68]
xor al, al
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor al, al
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180024560
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, rcx
mov r15, r8
mov rcx, rdx
mov r14, rdx
call fcn.18000a060
mov dword [rsp + 0x88], eax
mov rax, qword [rbp + 8]
test rax, rax
je 0x1800246ab
xor r12d, r12d
mov dword [rsp + 0x70], r12d
mov rax, qword [rax]
test rax, rax
je 0x1800246ab
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x1800246ab
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], r12
lea r8d, [r12 + 4]
lea rdx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800246ab
cmp dword [rsp + 0x70], 4
jne 0x1800246ab
lea esi, [r12 + 4]
mov edi, r12d
cmp dword [rsp + 0x88], r12d
jbe 0x1800246a4
mov rcx, r14
call fcn.1800038c0
mov ebx, edi
shl rbx, 5
add rbx, qword [rax]
cmp qword [rbp + 8], r12
je 0x1800246ab
mov rcx, rbx
call fcn.180006030
add eax, eax
mov dword [rsp + 0x70], eax
mov rax, qword [rbp + 8]
test rax, rax
je 0x1800246ab
mov dword [rsp + 0x30], r12d
mov rax, qword [rax]
test rax, rax
je 0x1800246ab
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x1800246ab
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r12
mov r8d, 4
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800246ab
cmp dword [rsp + 0x30], 4
jne 0x1800246ab
mov rcx, rbx
call fcn.180003a80
mov r8d, dword [rsp + 0x70]
mov rdx, rax
mov rcx, rbp
call fcn.180024170
test al, al
je 0x1800246ab
mov eax, dword [rsp + 0x70]
inc edi
add eax, 4
add esi, eax
cmp edi, dword [rsp + 0x88]
jb 0x180024602
mov dword [r15], esi
mov al, 1
jmp 0x1800246ad
xor al, al
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18002a270
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbx, r9
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x18002a2cd
test rdx, rdx
je 0x18002a2cd
test rbx, rbx
je 0x18002a2cd
mov dword [r9], 0
test r8d, r8d
je 0x18002a2c9
call fcn.1801000e0
mov r8d, edi
mov r9, rbp
mov edx, 1
mov rcx, rsi
call fcn.1801006f0
cmp eax, edi
jne 0x18002a2cd
mov dword [rbx], eax
xor eax, eax
jmp 0x18002a2d2
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800362b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, rdx
mov rdx, rcx
lea rcx, [rbp - 0x28]
call fcn.1800096b0
nop
lea rcx, [rbp - 0x28]
call fcn.180006030
mov r14, rax
xor edi, edi
mov esi, edi
test rax, rax
je 0x18003633c
lea rcx, [rbp - 0x28]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
movzx ecx, word [rax + rsi*2]
call fcn.180100c60
movzx ebx, ax
lea rcx, [rbp - 0x28]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
mov word [rax + rsi*2], bx
inc rsi
cmp rsi, r14
jb 0x180036302
lea rcx, [rbp - 0x28]
call fcn.180006030
lea rcx, [rbp - 0x28]
cmp rax, 2
jbe 0x180036495
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax], 0x5c
jne 0x180036382
lea rcx, [rbp - 0x28]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax + 2], 0x5c
je 0x18003651a
lea rcx, [rbp - 0x28]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax], 0x2f
jne 0x1800363b5
lea rcx, [rbp - 0x28]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax + 2], 0x2f
je 0x180036467
lea rcx, [rbp - 0x28]
call fcn.180006030
mov rbx, rax
test rax, rax
je 0x180036405
mov esi, 0x5c
lea r14d, [rsi - 0x2d]
nop
lea rcx, [rbp - 0x28]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp r14w, word [rax + rdi*2]
jne 0x1800363fd
lea rcx, [rbp - 0x28]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
mov word [rax + rdi*2], si
inc rdi
cmp rdi, rbx
jb 0x1800363d0
lea rcx, [rbp - 0x28]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax + 2], 0x3a
jne 0x180036467
lea rcx, [rbp - 0x28]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax + 4], 0x5c
jne 0x180036467
lea rcx, [rbp - 0x28]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax], 0x61
jb 0x180036467
lea rcx, [rbp - 0x28]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax], 0x7a
jbe 0x1800364f7
xor bl, bl
lea rcx, [rbp - 0x28]
call fcn.180003b80
movzx eax, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800d8050
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.180006030
nop
cmp rax, 2
jne 0x180036467
lea rcx, [rbp - 0x28]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax + 2], 0x3a
jne 0x180036467
lea rcx, [rbp - 0x28]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax], 0x61
jb 0x180036467
lea rcx, [rbp - 0x28]
call fcn.1800038c0
mov rcx, rax
call fcn.180003ef0
cmp word [rax], 0x7a
ja 0x180036467
lea rdx, [0x18019b328]
lea rcx, [rbp - 0x28]
call fcn.1800147a0
lea rcx, [rbp - 0x28]
call fcn.180003a80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180036467
shr eax, 4
and al, 1
mov byte [r15], al
mov bl, 1
jmp 0x180036469
Function at 0x18003b8d0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x5f0]
sub rsp, 0x6f0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x738], rbx
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rbp + 0x5e0], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
add rcx, 0x88
call fcn.180003c60
nop
mov byte [rdi + 0xa8], 1
xor r15d, r15d
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
mov dword [rdi + 0x20], r15d
lea rcx, [rdi + 0x24]
xor edx, edx
lea r8d, [r15 + 0x60]
call fcn.1800f7810
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.1800096b0
nop
lea rcx, [rsp + 0x68]
call fcn.180005c00
test al, al
je 0x18003ba55
lea rcx, [rsp + 0x60]
call fcn.18001cb20
lea rdx, [0x18020e2d8]
lea rcx, [rsp + 0x60]
call fcn.1800038d0
nop
lea rcx, [0x18020e2f8]
call fcn.180005c00
test al, al
jne 0x18003b9b2
lea rdx, [0x18020e2f8]
lea rcx, [rsp + 0x68]
call fcn.180003ae0
jmp 0x18003ba4b
xor edx, edx
mov r8d, 0x20c
lea rcx, [rbp - 0x50]
call fcn.1800f7810
lea rdx, [rbp - 0x50]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x18003ba4b
mov word [rbp + 0x1ba], r15w
xor edx, edx
mov r8d, 0x412
lea rcx, [rbp + 0x1c0]
call fcn.1800f7810
mov r8d, 0x208
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea ecx, [rax - 1]
cmp ecx, 0x207
ja 0x18003ba3c
mov eax, eax
add rax, rax
cmp rax, 0x412
jae 0x18003bb36
mov word [rbp + rax + 0x1c0], r15w
lea rdx, [rbp + 0x1c0]
jmp 0x18003ba40
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x68]
call fcn.180004070
nop
lea rcx, [rsp + 0x60]
call fcn.180003920
lea rcx, [rsp + 0x68]
call fcn.180005c00
test al, al
jne 0x18003baf9
mov rcx, rsi
call fcn.180005c00
test al, al
jne 0x18003baf9
mov r8, rsi
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.180099c60
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.180005c40
nop
lea rcx, [rsp + 0x40]
call fcn.180003b80
mov dword [rbp - 0x78], 0x43002e
mov dword [rbp - 0x74], 0x650068
mov dword [rbp - 0x70], 0x6b0063
mov dword [rbp - 0x6c], 0x740053
mov dword [rbp - 0x68], 0x740061
mov dword [rbp - 0x64], 0x64002e
mov dword [rbp - 0x60], 0x740061
mov dword [rbp - 0x5c], 0x61
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.1800147a0
lea rdx, [rsp + 0x68]
lea rcx, [rdi + 0x88]
call fcn.180003ae0
mov rcx, rdi
call fcn.18003bbc0
nop
lea rcx, [rsp + 0x68]
call fcn.180003b80
nop
mov rax, rdi
mov rcx, qword [rbp + 0x5e0]
xor rcx, rsp
call fcn.1800d8050
mov rbx, qword [rsp + 0x738]
add rsp, 0x6f0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1800d86e0
nop
int3
Function at 0x1800403e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1800405c2
mov dword [rbp + 0x17], 0x2d2d4352
mov dword [rbp + 0x1b], 0xf7babac9
mov dword [rbp + 0x1f], 0x61726f43
mov dword [rbp + 0x23], 0x776f7242
mov dword [rbp + 0x27], 0x2d756e45
mov dword [rbp + 0x2b], 0x61746144
mov dword [rbp + 0x2f], 0x37313630
mov dword [rbp + 0x33], 0x30313032
movdqa xmm2, xmmword [0x1801a4a70]
xor r14d, r14d
mov eax, r14d
mov ecx, 1
movd xmm3, ecx
lea rcx, [rbp + 0x17]
nop word [rax + rax]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movdqu xmm0, xmmword [rcx]
pslld xmm0, xmm3
paddd xmm1, xmm0
movdqu xmmword [rcx], xmm1
add eax, 4
lea rcx, [rcx + 0x10]
cmp eax, 8
jl 0x180040480
mov rcx, rsi
call fcn.180003800
mov rax, qword [rsi]
mov qword [rsi + 8], rax
xor eax, eax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp - 1], r14
mov qword [rbp + 7], r14
mov qword [rbp + 0xf], r14
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, rdx
test rdx, rdx
je 0x180040598
lea r9, [rbp - 1]
mov r8d, eax
lea rcx, [rbp + 0x17]
call fcn.180047020
test al, al
je 0x180040598
mov rax, qword [rbp + 7]
cmp qword [rbp - 1], rax
je 0x180040598
mov rdx, rsi
mov ecx, 0xa
call fcn.1800469a0
mov ecx, dword [rbp + 7]
sub ecx, dword [rbp - 1]
mov rdx, rsi
call fcn.1800469a0
mov rax, qword [rsi + 8]
mov qword [rbp - 0x29], rax
mov rdx, rsi
lea rcx, [rbp - 0x29]
call fcn.180003810
mov rbx, qword [rbp - 0x29]
mov rax, qword [rbp + 7]
mov qword [rbp - 0x21], rax
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x21]
call fcn.180003810
mov rax, qword [rbp - 1]
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x19]
call fcn.180003810
mov rdi, rbx
sub rdi, qword [rsi]
mov r9, qword [rbp - 0x21]
mov r8, qword [rbp - 0x19]
mov rdx, rbx
mov rcx, rsi
call fcn.180040920
mov rcx, qword [rsi]
add rcx, rdi
mov qword [rbp - 0x11], rcx
mov rdx, rsi
lea rcx, [rbp - 0x11]
call fcn.180003810
nop
lea rcx, [rbp - 1]
call fcn.180003800
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x1800405c2
mov rdx, qword [rbp + 0xf]
sub rdx, rcx
call fcn.180005040
xorps xmm0, xmm0
movdqu xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r14
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1800d8050
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1800405f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx]
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov rsi, r8
mov rbx, rdx
cmp rax, rcx
je 0x1800407fd
mov rdx, qword [rdx]
sub rcx, rax
cmp rdx, rcx
jae 0x1800407fd
lea rax, [rdx + 5]
cmp rax, rcx
ja 0x1800407fd
lea r8, [rdx + 1]
mov qword [rbx], r8
mov rax, qword [rdi]
cmp byte [rdx + rax], 2
jne 0x1800407fd
lea rcx, [r8 + 1]
mov qword [rbx], rcx
lea rdx, [rcx + 1]
mov rax, qword [rdi]
movzx r9d, byte [rax + r8]
lea r8, [rdx + 1]
mov qword [rbx], rdx
mov rax, qword [rdi]
shl r9d, 0x18
movzx ecx, byte [rcx + rax]
mov qword [rbx], r8
mov rax, qword [rdi]
shl ecx, 0x10
or r9d, ecx
movzx ecx, byte [rax + rdx]
lea rdx, [r8 + 1]
mov qword [rbx], rdx
mov r10, qword [rdi]
shl ecx, 8
or r9d, ecx
movzx eax, byte [r10 + r8]
or r9d, eax
cmp r9d, 0xa
jne 0x1800407fd
mov rcx, qword [rdi + 8]
lea rax, [rdx + 5]
sub rcx, r10
cmp rax, rcx
ja 0x1800407fd
lea r8, [rdx + 1]
mov qword [rbx], r8
mov rax, qword [rdi]
cmp byte [rdx + rax], 2
jne 0x1800407fd
lea rcx, [r8 + 1]
mov qword [rbx], rcx
lea rdx, [rcx + 1]
mov rax, qword [rdi]
movzx ebp, byte [rax + r8]
lea r8, [rdx + 1]
mov qword [rbx], rdx
mov rax, qword [rdi]
shl ebp, 0x18
movzx ecx, byte [rax + rcx]
mov qword [rbx], r8
mov rax, qword [rdi]
shl ecx, 0x10
or ebp, ecx
movzx ecx, byte [rax + rdx]
shl ecx, 8
or ebp, ecx
lea rcx, [r8 + 1]
mov qword [rbx], rcx
mov rdx, qword [rdi]
movzx eax, byte [rdx + r8]
or ebp, eax
mov rax, qword [rdi + 8]
sub rax, rcx
mov r14d, ebp
sub rax, rdx
cmp r14, rax
ja 0x1800407fd
movdqa xmm2, xmmword [0x1801a4a70]
mov ecx, 1
mov dword [rsp + 0x20], 0x2d2d4352
xor eax, eax
mov dword [rsp + 0x24], 0xf7babac9
mov dword [rsp + 0x28], 0x61726f43
movd xmm3, ecx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x2c], 0x776f7242
mov dword [rsp + 0x30], 0x2d756e45
mov dword [rsp + 0x34], 0x61746144
mov dword [rsp + 0x38], 0x37313630
mov dword [rsp + 0x3c], 0x30313032
nop dword [rax]
movdqu xmm0, xmmword [rcx]
lea rcx, [rcx + 0x10]
movd xmm1, eax
add eax, 4
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
pslld xmm0, xmm3
paddd xmm1, xmm0
movdqu xmmword [rcx - 0x10], xmm1
cmp eax, 8
jl 0x180040790
mov rcx, rsi
call fcn.180003800
mov rax, qword [rsi]
mov qword [rsi + 8], rax
mov rcx, qword [rbx]
mov rax, qword [rdi]
lea rdx, [rcx + rax]
test rdx, rdx
jne 0x1800407e2
xor al, al
add rcx, r14
mov qword [rbx], rcx
jmp 0x1800407ff
mov r9, rsi
lea rcx, [rsp + 0x20]
mov r8d, ebp
call fcn.180047280
mov rcx, qword [rbx]
add rcx, r14
mov qword [rbx], rcx
jmp 0x1800407ff
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800d8050
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret