joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180018780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180199728]
mov rbx, rdx
test rax, rax
jne 0x180018823
mov byte [rbp - 0x40], 0x5c
xor ecx, ecx
mov byte [rbp - 0x3f], 0x6f
mov byte [rbp - 0x3e], 0x78
mov byte [rbp - 0x3d], 0x7a
mov byte [rbp - 0x3c], 0x7b
mov byte [rbp - 0x3b], 0x67
mov byte [rbp - 0x3a], 0x72
mov byte [rbp - 0x39], 0x57
mov byte [rbp - 0x38], 0x7b
mov byte [rbp - 0x37], 0x6b
mov byte [rbp - 0x36], 0x78
mov byte [rbp - 0x35], 0x7f
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 6
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1800187d8
lea rcx, [0x180164c98]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x180199728], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199728]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18001884c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180018878
cmp dword [rbp - 0x10], 0x10000
je 0x180018878
cmp qword [rbp - 0x18], 0x1000
jb 0x180018878
cmp dword [rbp - 8], 0x1000000
je 0x180018874
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18001887a
mov al, 1
jmp 0x18001887a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180018e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180199720]
mov rbx, rdx
test rax, rax
jne 0x180018f33
mov byte [rbp - 0x40], 0x5c
xor ecx, ecx
mov byte [rbp - 0x3f], 0x6f
mov byte [rbp - 0x3e], 0x78
mov byte [rbp - 0x3d], 0x7a
mov byte [rbp - 0x3c], 0x7b
mov byte [rbp - 0x3b], 0x67
mov byte [rbp - 0x3a], 0x72
mov byte [rbp - 0x39], 0x57
mov byte [rbp - 0x38], 0x7b
mov byte [rbp - 0x37], 0x6b
mov byte [rbp - 0x36], 0x78
mov byte [rbp - 0x35], 0x7f
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 6
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180018ee8
lea rcx, [0x180164c98]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x180199720], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199720]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180018f5c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180018f88
cmp dword [rbp - 0x10], 0x10000
je 0x180018f88
cmp qword [rbp - 0x18], 0x1000
jb 0x180018f88
cmp dword [rbp - 8], 0x1000000
je 0x180018f84
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180018f8a
mov al, 1
jmp 0x180018f8a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800195a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180199738]
mov rbx, rdx
test rax, rax
jne 0x180019643
mov byte [rbp - 0x40], 0x5c
xor ecx, ecx
mov byte [rbp - 0x3f], 0x6f
mov byte [rbp - 0x3e], 0x78
mov byte [rbp - 0x3d], 0x7a
mov byte [rbp - 0x3c], 0x7b
mov byte [rbp - 0x3b], 0x67
mov byte [rbp - 0x3a], 0x72
mov byte [rbp - 0x39], 0x57
mov byte [rbp - 0x38], 0x7b
mov byte [rbp - 0x37], 0x6b
mov byte [rbp - 0x36], 0x78
mov byte [rbp - 0x35], 0x7f
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 6
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1800195f8
lea rcx, [0x180164c98]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x180199738], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199738]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18001966c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180019698
cmp dword [rbp - 0x10], 0x10000
je 0x180019698
cmp qword [rbp - 0x18], 0x1000
jb 0x180019698
cmp dword [rbp - 8], 0x1000000
je 0x180019694
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18001969a
mov al, 1
jmp 0x18001969a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180019cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180199750]
mov rbx, rdx
test rax, rax
jne 0x180019d53
mov byte [rbp - 0x40], 0x5c
xor ecx, ecx
mov byte [rbp - 0x3f], 0x6f
mov byte [rbp - 0x3e], 0x78
mov byte [rbp - 0x3d], 0x7a
mov byte [rbp - 0x3c], 0x7b
mov byte [rbp - 0x3b], 0x67
mov byte [rbp - 0x3a], 0x72
mov byte [rbp - 0x39], 0x57
mov byte [rbp - 0x38], 0x7b
mov byte [rbp - 0x37], 0x6b
mov byte [rbp - 0x36], 0x78
mov byte [rbp - 0x35], 0x7f
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 6
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180019d08
lea rcx, [0x180164c98]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x180199750], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199750]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180019d7c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180019da8
cmp dword [rbp - 0x10], 0x10000
je 0x180019da8
cmp qword [rbp - 0x18], 0x1000
jb 0x180019da8
cmp dword [rbp - 8], 0x1000000
je 0x180019da4
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180019daa
mov al, 1
jmp 0x180019daa
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18001a3c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180199678]
mov rbx, rdx
test rax, rax
jne 0x18001a463
mov byte [rbp - 0x40], 0x5c
xor ecx, ecx
mov byte [rbp - 0x3f], 0x6f
mov byte [rbp - 0x3e], 0x78
mov byte [rbp - 0x3d], 0x7a
mov byte [rbp - 0x3c], 0x7b
mov byte [rbp - 0x3b], 0x67
mov byte [rbp - 0x3a], 0x72
mov byte [rbp - 0x39], 0x57
mov byte [rbp - 0x38], 0x7b
mov byte [rbp - 0x37], 0x6b
mov byte [rbp - 0x36], 0x78
mov byte [rbp - 0x35], 0x7f
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 6
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18001a418
lea rcx, [0x180164c98]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x180199678], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199678]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18001a48c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18001a4b8
cmp dword [rbp - 0x10], 0x10000
je 0x18001a4b8
cmp qword [rbp - 0x18], 0x1000
jb 0x18001a4b8
cmp dword [rbp - 8], 0x1000000
je 0x18001a4b4
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18001a4ba
mov al, 1
jmp 0x18001a4ba
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18001aad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1801996d0]
mov rbx, rdx
test rax, rax
jne 0x18001ab73
mov byte [rbp - 0x40], 0x5c
xor ecx, ecx
mov byte [rbp - 0x3f], 0x6f
mov byte [rbp - 0x3e], 0x78
mov byte [rbp - 0x3d], 0x7a
mov byte [rbp - 0x3c], 0x7b
mov byte [rbp - 0x3b], 0x67
mov byte [rbp - 0x3a], 0x72
mov byte [rbp - 0x39], 0x57
mov byte [rbp - 0x38], 0x7b
mov byte [rbp - 0x37], 0x6b
mov byte [rbp - 0x36], 0x78
mov byte [rbp - 0x35], 0x7f
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 6
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18001ab28
lea rcx, [0x180164c98]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1801996d0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1801996d0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18001ab9c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18001abc8
cmp dword [rbp - 0x10], 0x10000
je 0x18001abc8
cmp qword [rbp - 0x18], 0x1000
jb 0x18001abc8
cmp dword [rbp - 8], 0x1000000
je 0x18001abc4
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18001abca
mov al, 1
jmp 0x18001abca
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18001b1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180199708]
mov rbx, rdx
test rax, rax
jne 0x18001b283
mov byte [rbp - 0x40], 0x5c
xor ecx, ecx
mov byte [rbp - 0x3f], 0x6f
mov byte [rbp - 0x3e], 0x78
mov byte [rbp - 0x3d], 0x7a
mov byte [rbp - 0x3c], 0x7b
mov byte [rbp - 0x3b], 0x67
mov byte [rbp - 0x3a], 0x72
mov byte [rbp - 0x39], 0x57
mov byte [rbp - 0x38], 0x7b
mov byte [rbp - 0x37], 0x6b
mov byte [rbp - 0x36], 0x78
mov byte [rbp - 0x35], 0x7f
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 6
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18001b238
lea rcx, [0x180164c98]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x180199708], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199708]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18001b2ac
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18001b2d8
cmp dword [rbp - 0x10], 0x10000
je 0x18001b2d8
cmp qword [rbp - 0x18], 0x1000
jb 0x18001b2d8
cmp dword [rbp - 8], 0x1000000
je 0x18001b2d4
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18001b2da
mov al, 1
jmp 0x18001b2da
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18001fde0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x18001fe44
lea r8, [r9 + 8]
mov r11d, 0x7fffffff
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, r11d
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x18001fe04
mov ecx, dword [r9]
jmp 0x18001ff1d
cmp ecx, 0x4e0
jb 0x18001ff1d
lea r10, [r9 + 0x9c4]
mov esi, 0xe3
mov edi, dword [r10]
mov r11d, 0x7fffffff
mov eax, edi
mov edi, dword [r10 + 4]
mov edx, edi
lea r10, [r10 + 4]
xor edx, eax
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rsi, 1
jne 0x18001fe65
lea r10, [r9 + 0xd50]
mov esi, 0x18c
mov edi, dword [r10]
mov eax, edi
mov edi, dword [r10 + 4]
mov edx, edi
lea r10, [r10 + 4]
xor edx, eax
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rsi, 1
jne 0x18001fead
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rsi, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret
Function at 0x18002558c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xb
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x180025599
xor edx, edx
mov word [rcx + 0x1a], dx
ret
Function at 0x180026de0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1801997c0]
mov rbx, rdx
test rax, rax
jne 0x180026e91
mov dword [rbp - 0x50], 0xe
xor edx, edx
mov byte [rbp - 0x4c], 0x58
mov byte [rbp - 0x4b], 0x67
mov byte [rbp - 0x4a], 0x7c
mov byte [rbp - 0x49], 0x7a
mov byte [rbp - 0x48], 0x7b
mov byte [rbp - 0x47], 0x6f
mov byte [rbp - 0x46], 0x62
mov byte [rbp - 0x45], 0x5f
mov byte [rbp - 0x44], 0x7b
mov byte [rbp - 0x43], 0x6b
mov byte [rbp - 0x42], 0x7c
mov byte [rbp - 0x41], 0x77
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180026e3f
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1801997c0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1801997c0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180026eba
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180026ee6
cmp dword [rbp - 0x18], 0x10000
je 0x180026ee6
cmp qword [rbp - 0x20], 0x1000
jb 0x180026ee6
cmp dword [rbp - 0x10], 0x1000000
je 0x180026ee2
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180026ee8
mov al, 1
jmp 0x180026ee8
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180028694
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1801997c8]
mov rbx, rdx
test rax, rax
jne 0x180028745
mov dword [rbp - 0x50], 0xe
xor edx, edx
mov byte [rbp - 0x4c], 0x58
mov byte [rbp - 0x4b], 0x67
mov byte [rbp - 0x4a], 0x7c
mov byte [rbp - 0x49], 0x7a
mov byte [rbp - 0x48], 0x7b
mov byte [rbp - 0x47], 0x6f
mov byte [rbp - 0x46], 0x62
mov byte [rbp - 0x45], 0x5f
mov byte [rbp - 0x44], 0x7b
mov byte [rbp - 0x43], 0x6b
mov byte [rbp - 0x42], 0x7c
mov byte [rbp - 0x41], 0x77
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1800286f3
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1801997c8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1801997c8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18002876e
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18002879a
cmp dword [rbp - 0x18], 0x10000
je 0x18002879a
cmp qword [rbp - 0x20], 0x1000
jb 0x18002879a
cmp dword [rbp - 0x10], 0x1000000
je 0x180028796
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18002879c
mov al, 1
jmp 0x18002879c
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180029f48
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199818]
mov rbx, rdx
test rax, rax
jne 0x180029ff9
mov dword [rbp - 0x50], 0xe
xor edx, edx
mov byte [rbp - 0x4c], 0x58
mov byte [rbp - 0x4b], 0x67
mov byte [rbp - 0x4a], 0x7c
mov byte [rbp - 0x49], 0x7a
mov byte [rbp - 0x48], 0x7b
mov byte [rbp - 0x47], 0x6f
mov byte [rbp - 0x46], 0x62
mov byte [rbp - 0x45], 0x5f
mov byte [rbp - 0x44], 0x7b
mov byte [rbp - 0x43], 0x6b
mov byte [rbp - 0x42], 0x7c
mov byte [rbp - 0x41], 0x77
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180029fa7
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199818], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199818]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18002a022
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18002a04e
cmp dword [rbp - 0x18], 0x10000
je 0x18002a04e
cmp qword [rbp - 0x20], 0x1000
jb 0x18002a04e
cmp dword [rbp - 0x10], 0x1000000
je 0x18002a04a
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18002a050
mov al, 1
jmp 0x18002a050
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18002b7fc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199800]
mov rbx, rdx
test rax, rax
jne 0x18002b8ad
mov dword [rbp - 0x50], 0xe
xor edx, edx
mov byte [rbp - 0x4c], 0x58
mov byte [rbp - 0x4b], 0x67
mov byte [rbp - 0x4a], 0x7c
mov byte [rbp - 0x49], 0x7a
mov byte [rbp - 0x48], 0x7b
mov byte [rbp - 0x47], 0x6f
mov byte [rbp - 0x46], 0x62
mov byte [rbp - 0x45], 0x5f
mov byte [rbp - 0x44], 0x7b
mov byte [rbp - 0x43], 0x6b
mov byte [rbp - 0x42], 0x7c
mov byte [rbp - 0x41], 0x77
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18002b85b
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199800], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199800]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18002b8d6
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18002b902
cmp dword [rbp - 0x18], 0x10000
je 0x18002b902
cmp qword [rbp - 0x20], 0x1000
jb 0x18002b902
cmp dword [rbp - 0x10], 0x1000000
je 0x18002b8fe
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18002b904
mov al, 1
jmp 0x18002b904
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18002d0b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199840]
mov rbx, rdx
test rax, rax
jne 0x18002d161
mov dword [rbp - 0x50], 0xe
xor edx, edx
mov byte [rbp - 0x4c], 0x58
mov byte [rbp - 0x4b], 0x67
mov byte [rbp - 0x4a], 0x7c
mov byte [rbp - 0x49], 0x7a
mov byte [rbp - 0x48], 0x7b
mov byte [rbp - 0x47], 0x6f
mov byte [rbp - 0x46], 0x62
mov byte [rbp - 0x45], 0x5f
mov byte [rbp - 0x44], 0x7b
mov byte [rbp - 0x43], 0x6b
mov byte [rbp - 0x42], 0x7c
mov byte [rbp - 0x41], 0x77
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18002d10f
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199840], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199840]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18002d18a
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18002d1b6
cmp dword [rbp - 0x18], 0x10000
je 0x18002d1b6
cmp qword [rbp - 0x20], 0x1000
jb 0x18002d1b6
cmp dword [rbp - 0x10], 0x1000000
je 0x18002d1b2
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18002d1b8
mov al, 1
jmp 0x18002d1b8
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18002e964
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1801997d0]
mov rbx, rdx
test rax, rax
jne 0x18002ea15
mov dword [rbp - 0x50], 0xe
xor edx, edx
mov byte [rbp - 0x4c], 0x58
mov byte [rbp - 0x4b], 0x67
mov byte [rbp - 0x4a], 0x7c
mov byte [rbp - 0x49], 0x7a
mov byte [rbp - 0x48], 0x7b
mov byte [rbp - 0x47], 0x6f
mov byte [rbp - 0x46], 0x62
mov byte [rbp - 0x45], 0x5f
mov byte [rbp - 0x44], 0x7b
mov byte [rbp - 0x43], 0x6b
mov byte [rbp - 0x42], 0x7c
mov byte [rbp - 0x41], 0x77
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18002e9c3
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1801997d0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1801997d0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18002ea3e
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18002ea6a
cmp dword [rbp - 0x18], 0x10000
je 0x18002ea6a
cmp qword [rbp - 0x20], 0x1000
jb 0x18002ea6a
cmp dword [rbp - 0x10], 0x1000000
je 0x18002ea66
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18002ea6c
mov al, 1
jmp 0x18002ea6c
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret