joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801126f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0ae0]
mov rbx, rdx
test rax, rax
jne 0x18011279b
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180112750
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0ae0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0ae0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801127c4
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801127f0
cmp dword [rbp - 0x10], 0x10000
je 0x1801127f0
cmp qword [rbp - 0x18], 0x1000
jb 0x1801127f0
cmp dword [rbp - 8], 0x1000000
je 0x1801127ec
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801127f2
mov al, 1
jmp 0x1801127f2
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801146bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c09f0]
mov rbx, rdx
test rax, rax
jne 0x18011475f
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180114714
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c09f0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c09f0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180114788
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801147b4
cmp dword [rbp - 0x10], 0x10000
je 0x1801147b4
cmp qword [rbp - 0x18], 0x1000
jb 0x1801147b4
cmp dword [rbp - 8], 0x1000000
je 0x1801147b0
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801147b6
mov al, 1
jmp 0x1801147b6
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180116680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0888]
mov rbx, rdx
test rax, rax
jne 0x180116723
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801166d8
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0888], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0888]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18011674c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180116778
cmp dword [rbp - 0x10], 0x10000
je 0x180116778
cmp qword [rbp - 0x18], 0x1000
jb 0x180116778
cmp dword [rbp - 8], 0x1000000
je 0x180116774
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18011677a
mov al, 1
jmp 0x18011677a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180116d5c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0890]
mov rbx, rdx
test rax, rax
jne 0x180116dff
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180116db4
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0890], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0890]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180116e28
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180116e54
cmp dword [rbp - 0x10], 0x10000
je 0x180116e54
cmp qword [rbp - 0x18], 0x1000
jb 0x180116e54
cmp dword [rbp - 8], 0x1000000
je 0x180116e50
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180116e56
mov al, 1
jmp 0x180116e56
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180118d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0738]
mov rbx, rdx
test rax, rax
jne 0x180118dc3
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180118d78
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0738], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0738]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180118dec
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180118e18
cmp dword [rbp - 0x10], 0x10000
je 0x180118e18
cmp qword [rbp - 0x18], 0x1000
jb 0x180118e18
cmp dword [rbp - 8], 0x1000000
je 0x180118e14
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180118e1a
mov al, 1
jmp 0x180118e1a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801193fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0808]
mov rbx, rdx
test rax, rax
jne 0x18011949f
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180119454
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0808], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0808]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801194c8
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801194f4
cmp dword [rbp - 0x10], 0x10000
je 0x1801194f4
cmp qword [rbp - 0x18], 0x1000
jb 0x1801194f4
cmp dword [rbp - 8], 0x1000000
je 0x1801194f0
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801194f6
mov al, 1
jmp 0x1801194f6
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18011b3c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0750]
mov rbx, rdx
test rax, rax
jne 0x18011b463
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18011b418
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0750], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0750]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18011b48c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18011b4b8
cmp dword [rbp - 0x10], 0x10000
je 0x18011b4b8
cmp qword [rbp - 0x18], 0x1000
jb 0x18011b4b8
cmp dword [rbp - 8], 0x1000000
je 0x18011b4b4
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18011b4ba
mov al, 1
jmp 0x18011b4ba
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18011d384
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0ad0]
mov rbx, rdx
test rax, rax
jne 0x18011d427
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18011d3dc
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0ad0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0ad0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18011d450
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18011d47c
cmp dword [rbp - 0x10], 0x10000
je 0x18011d47c
cmp qword [rbp - 0x18], 0x1000
jb 0x18011d47c
cmp dword [rbp - 8], 0x1000000
je 0x18011d478
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18011d47e
mov al, 1
jmp 0x18011d47e
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18011da60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c09b8]
mov rbx, rdx
test rax, rax
jne 0x18011db03
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18011dab8
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c09b8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c09b8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18011db2c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18011db58
cmp dword [rbp - 0x10], 0x10000
je 0x18011db58
cmp qword [rbp - 0x18], 0x1000
jb 0x18011db58
cmp dword [rbp - 8], 0x1000000
je 0x18011db54
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18011db5a
mov al, 1
jmp 0x18011db5a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18011e13c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0a68]
mov rbx, rdx
test rax, rax
jne 0x18011e1df
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18011e194
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0a68], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0a68]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18011e208
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18011e234
cmp dword [rbp - 0x10], 0x10000
je 0x18011e234
cmp qword [rbp - 0x18], 0x1000
jb 0x18011e234
cmp dword [rbp - 8], 0x1000000
je 0x18011e230
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18011e236
mov al, 1
jmp 0x18011e236
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18011e818
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0720]
mov rbx, rdx
test rax, rax
jne 0x18011e8bb
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18011e870
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0720], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0720]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18011e8e4
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18011e910
cmp dword [rbp - 0x10], 0x10000
je 0x18011e910
cmp qword [rbp - 0x18], 0x1000
jb 0x18011e910
cmp dword [rbp - 8], 0x1000000
je 0x18011e90c
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18011e912
mov al, 1
jmp 0x18011e912
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801207dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0b68]
mov rbx, rdx
test rax, rax
jne 0x18012087f
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180120834
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0b68], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0b68]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801208a8
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801208d4
cmp dword [rbp - 0x10], 0x10000
je 0x1801208d4
cmp qword [rbp - 0x18], 0x1000
jb 0x1801208d4
cmp dword [rbp - 8], 0x1000000
je 0x1801208d0
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801208d6
mov al, 1
jmp 0x1801208d6
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180120eb8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c07d8]
mov rbx, rdx
test rax, rax
jne 0x180120f5b
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180120f10
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c07d8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c07d8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180120f84
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180120fb0
cmp dword [rbp - 0x10], 0x10000
je 0x180120fb0
cmp qword [rbp - 0x18], 0x1000
jb 0x180120fb0
cmp dword [rbp - 8], 0x1000000
je 0x180120fac
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180120fb2
mov al, 1
jmp 0x180120fb2
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180121594
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0b60]
mov rbx, rdx
test rax, rax
jne 0x180121637
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801215ec
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0b60], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0b60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180121660
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18012168c
cmp dword [rbp - 0x10], 0x10000
je 0x18012168c
cmp qword [rbp - 0x18], 0x1000
jb 0x18012168c
cmp dword [rbp - 8], 0x1000000
je 0x180121688
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18012168e
mov al, 1
jmp 0x18012168e
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180123558
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0788]
mov rbx, rdx
test rax, rax
jne 0x1801235fb
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801235b0
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0788], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0788]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180123624
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180123650
cmp dword [rbp - 0x10], 0x10000
je 0x180123650
cmp qword [rbp - 0x18], 0x1000
jb 0x180123650
cmp dword [rbp - 8], 0x1000000
je 0x18012364c
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180123652
mov al, 1
jmp 0x180123652
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret