joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800252a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, r8d
mov word [rsp + 0x25], 0x7268
mov word [rsp + 0x28], 0x6461
mov dword [rsp + 0x20], 0x6e65704f
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x24], 0x54
mov byte [rsp + 0x27], 0x65
call fcn.180025cf0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180025314
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x40
pop rbx
ret

Function at 0x180025330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov dword [rsp + 0x23], 0x65726854
mov rbx, rcx
mov dword [rsp + 0x2d], 0x747865
mov word [rsp + 0x20], 0x6547
mov dword [rsp + 0x28], 0x6e6f4364
mov byte [rsp + 0x2c], 0x74
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x27], 0x61
call fcn.180025cf0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002539d
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1800253c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
mov ebp, r9d
mov rsi, r8
mov dword [rsp + 0x32], 0x61757472
mov rdi, rdx
mov dword [rsp + 0x3d], 0x784574
mov rbx, rcx
mov dword [rsp + 0x37], 0x746f7250
mov word [rsp + 0x30], 0x6956
mov word [rsp + 0x3b], 0x6365
mov byte [rsp + 0x36], 0x6c
call fcn.180025cf0
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180025444
mov r9d, ebp
mov qword [rsp + 0x20], r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180001330
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180025470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov word [rsp + 0x2b], 0x64
mov dword [rsp + 0x22], 0x656d7573
mov dword [rsp + 0x26], 0x65726854
mov word [rsp + 0x20], 0x6552
mov byte [rsp + 0x2a], 0x61
call fcn.180025cf0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800254db
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x40
pop rbx
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x40
pop rbx
ret
Function at 0x180025500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x20], 0x65536c61
mov dword [rbp - 0x1a], 0x6e6f69
mov dword [rbp - 0x2a], 0x657a696c
mov dword [rbp - 0x2e], 0x61697469
mov word [rbp - 0x1c], 0x7463
mov word [rbp - 0x25], 0x6972
mov word [rbp - 0x30], 0x6e49
mov word [rbp - 0x22], 0x6369
mov byte [rbp - 0x26], 0x43
mov byte [rbp - 0x23], 0x74
call fcn.180025cf0
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180025573
lea rcx, [0x180063a30]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180001330
add rsp, 0x50
pop rbp
ret

Function at 0x180025640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x80]
mov rsi, rdx
mov ebx, 1
call fcn.180025c90
mov rdi, rax
test rax, rax
je 0x1800256e0
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x3a], 0x417845
mov rcx, rax
mov word [rsp + 0x30], 0x6552
mov dword [rsp + 0x33], 0x6e65704f
mov word [rsp + 0x37], 0x654b
mov byte [rsp + 0x32], 0x67
mov byte [rsp + 0x39], 0x79
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800256d7
mov r9d, 0x20019
mov qword [rsp + 0x20], rbp
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000001
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180001330
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x180025710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov word [rsp + 0x29], 0x6946
mov dword [rsp + 0x24], 0x6c75646f
mov dword [rsp + 0x20], 0x4d746547
mov word [rsp + 0x2e], 0x6d61
mov byte [rsp + 0x28], 0x65
mov word [rsp + 0x31], 0x41
mov word [rsp + 0x2c], 0x4e65
mov byte [rsp + 0x2b], 0x6c
mov byte [rsp + 0x30], 0x65
call fcn.180025cf0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002579b
mov r8d, 0x104
mov rdx, rbx
xor ecx, ecx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x40
pop rbx
ret
Function at 0x180025870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, r8
mov word [rsp + 0x2e], 0x6e6f
mov rdi, rdx
mov dword [rsp + 0x29], 0x74637572
mov rbx, rcx
mov word [rsp + 0x31], 0x6361
mov word [rsp + 0x26], 0x736e
mov word [rsp + 0x34], 0x65
mov byte [rsp + 0x30], 0x43
mov dword [rsp + 0x21], 0x6873756c
mov byte [rsp + 0x28], 0x74
mov byte [rsp + 0x20], 0x46
mov byte [rsp + 0x33], 0x68
mov byte [rsp + 0x25], 0x49
mov byte [rsp + 0x2d], 0x69
call fcn.180025cf0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800258fd
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180025920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
mov rbp, rdx
mov r15, qword [rsp + 0xa8]
mov rsi, rcx
mov ebx, 1
call fcn.180025c90
mov rdi, rax
test rax, rax
je 0x1800259d1
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x3c], 0x41784565
mov rcx, rax
mov dword [rsp + 0x38], 0x756c6156
mov word [rsp + 0x33], 0x7551
mov word [rsp + 0x30], 0x6552
mov word [rsp + 0x35], 0x7265
mov byte [rsp + 0x37], 0x79
mov byte [rsp + 0x32], 0x67
mov byte [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800259c8
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, rbp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180001330
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x180025a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov word [rsp + 0x27], 0x4e32
mov rbx, rcx
mov word [rsp + 0x24], 0x6461
mov dword [rsp + 0x29], 0x747865
mov byte [rsp + 0x26], 0x33
mov word [rsp + 0x21], 0x7268
mov byte [rsp + 0x23], 0x65
mov byte [rsp + 0x20], 0x54
call fcn.180025cf0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180025a6b
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180025a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov dword [rsp + 0x23], 0x33646165
mov rbx, rcx
mov word [rsp + 0x29], 0x7269
mov word [rsp + 0x2c], 0x74
mov word [rsp + 0x27], 0x4632
mov word [rsp + 0x21], 0x7268
mov byte [rsp + 0x20], 0x54
mov byte [rsp + 0x2b], 0x73
call fcn.180025cf0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180025afd
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180025b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ebx, edx
mov dword [rbp - 0x1c], 0x746f6873
mov dword [rbp - 0x2e], 0x65746165
mov word [rbp - 0x22], 0x3233
mov word [rbp - 0x28], 0x6c6f
mov word [rbp - 0x30], 0x7243
mov word [rbp - 0x25], 0x6c65
mov word [rbp - 0x1f], 0x616e
mov word [rbp - 0x2a], 0x6f54
mov byte [rbp - 0x26], 0x68
mov byte [rbp - 0x1d], 0x70
mov byte [rbp - 0x18], 0
mov byte [rbp - 0x23], 0x70
mov byte [rbp - 0x20], 0x53
call fcn.180025cf0
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180025ba5
mov edx, ebx
mov ecx, 4
call rax
jmp 0x180025bac
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180001330
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x180025bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x776c6853
mov dword [rsp + 0x24], 0x2e697061
mov word [rsp + 0x29], 0x6c6c
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x28], 0x64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret

Function at 0x180025c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x24], 0x3233
mov dword [rsp + 0x26], 0x6c6c642e
mov word [rsp + 0x21], 0x6573
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x20], 0x55
mov byte [rsp + 0x23], 0x72
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret

Function at 0x180025c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x29], 0x6c6c64
mov dword [rsp + 0x25], 0x2e323369
mov word [rsp + 0x23], 0x7061
mov word [rsp + 0x20], 0x6441
mov byte [rsp + 0x22], 0x76
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret
Function at 0x180025cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x27], 0x6c642e32
mov word [rsp + 0x2b], 0x6c
mov dword [rsp + 0x21], 0x656e7265
mov word [rsp + 0x25], 0x336c
mov byte [rsp + 0x20], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret

Function at 0x180025d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov word [rsp + 0x2f], 0x64
mov dword [rsp + 0x26], 0x746e6572
mov word [rsp + 0x20], 0x6547
mov word [rsp + 0x23], 0x7543
mov dword [rsp + 0x2a], 0x65726854
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x25], 0x72
mov byte [rsp + 0x2e], 0x61
call fcn.180025cf0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180025dc3
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret

Function at 0x180025de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, r9
mov rbp, r8
mov esi, edx
xor ebx, ebx
call fcn.180025c30
mov rdi, rax
test rax, rax
je 0x180025848
lea rdx, [rsp + 0x20]
mov word [rsp + 0x2c], 0x7845
mov rcx, rax
mov byte [rsp + 0x2e], bl
mov dword [rsp + 0x27], 0x6f6f4874
mov dword [rsp + 0x23], 0x78654e6c
mov word [rsp + 0x21], 0x6c61
mov byte [rsp + 0x2b], 0x6b
mov byte [rsp + 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002583f
mov r9, r14
mov r8, rbp
mov edx, esi
xor ecx, ecx
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r9, r8
mov r8, rdx
mov edx, ecx
jmp 0x1800257c0
Function at 0x180025e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp edx, 1
jne 0x180025ed1
lea rdx, [rsp + 0x30]
call fcn.180025710
lea rcx, [rsp + 0x30]
call fcn.180001310
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x26], 0x75732074
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x2c], 0x74726f
mov dword [rsp + 0x21], 0x6174736e
mov word [rsp + 0x2a], 0x7070
mov byte [rsp + 0x20], 0x69
mov byte [rsp + 0x25], 0x6e
call fcn.180024fc0
test rax, rax
jne 0x180025f05
lea rdx, [sym.gphelper.dll_rtt9f2]
lea rcx, [0x180063818]
call fcn.180027250
test eax, eax
je 0x180025f05
lea rdx, [sym.gphelper.dll_voh3d4]
lea rcx, [0x180063800]
call fcn.180027250
test eax, eax
je 0x180025f05
lea rdx, [sym.gphelper.dll_mfrwbp]
lea rcx, [0x180063810]
call fcn.180027250
test eax, eax
je 0x180025f05
lea rdx, [sym.gphelper.dll_j58aom]
lea rcx, [0x180063808]
call fcn.180027250
jmp 0x180025f05
test edx, edx
jne 0x180025f05
lea rcx, [0x180063818]
call fcn.1800274e0
lea rcx, [0x180063800]
call fcn.1800274e0
lea rcx, [0x180063810]
call fcn.1800274e0
lea rcx, [0x180063808]
call fcn.1800274e0
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180001330
add rsp, 0x158
ret
Function at 0x180025f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x3a0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x388], rbx
mov qword [rbp + 0x390], rdi
mov rax, qword [0x180038010]
xor rax, rbp
mov qword [rbp + 0x360], rax
mov rbx, rcx
mov word [rbp + 0x20], 0x4f53
mov dword [rbp + 0x25], 0x5c455241
mov byte [rbp + 0x29], 0
mov word [rbp + 0x23], 0x5754
mov byte [rbp + 0x22], 0x46
mov dword [rbp + 0x11], 0x732573
mov byte [rbp + 0x10], 0x25
call fcn.180001290
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x104
mov edi, eax
call fcn.180002660
lea rax, str.RSpeedupTab
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180025fc0
inc ecx
cmp ecx, 0x3fffffff
jle 0x180025fd8
xor eax, eax
jmp 0x180026011
movsxd rax, ecx
lea r8d, [rcx + rcx]
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180025ff5
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180014db0
sub rsp, rcx
mov r9d, edi
lea rcx, [rsp + 0x30]
call fcn.1800012a0
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
lea rax, [rbp + 0x20]
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x30]
call fcn.180001270
lea rax, [rbp + 8]
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.180025640
test eax, eax
jne 0x18002610e
xor edx, edx
lea rcx, [rbp + 0x250]
mov r8d, 0x104
call fcn.180002660
mov rcx, qword [rbp + 8]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x18]
lea rax, [rbp + 0x250]
mov dword [rbp + 0x1a], 0x736c61
mov qword [rsp + 0x20], rax
mov word [rbp + 0x18], 0x7668
call fcn.180025920
test eax, eax
jne 0x180026105
cmp dword [rbp + 4], eax
jbe 0x180026105
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x104
call fcn.180002660
lea r9, [rbp]
mov word [rbp], 0x6425
mov edx, 0x104
mov byte [rbp + 2], 0
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x140]
call fcn.180001270
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x250]
call fcn.180024fc0
test rax, rax
je 0x180026105
mov rcx, qword [rbp + 8]
call fcn.180025590
mov eax, 1
jmp 0x180026117
mov rcx, qword [rbp + 8]
call fcn.180025590
mov rcx, rbx
call qword [0x180063808]
mov rcx, qword [rbp + 0x360]
xor rcx, rbp
call fcn.180001330
mov rbx, qword [rbp + 0x388]
mov rdi, qword [rbp + 0x390]
lea rsp, [rbp + 0x370]
pop rbp
ret
Function at 0x180026150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x3a0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x388], rbx
mov qword [rbp + 0x390], rdi
mov rax, qword [0x180038010]
xor rax, rbp
mov qword [rbp + 0x360], rax
mov rbx, rcx
mov dword [rbp + 0x22], 0x41575446
mov word [rbp + 0x20], 0x4f53
mov dword [rbp + 0x26], 0x5c4552
mov word [rbp + 0x10], 0x7325
mov word [rbp + 0x13], 0x73
mov byte [rbp + 0x12], 0x25
call fcn.180001290
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x104
mov edi, eax
call fcn.180002660
lea rcx, str.RSpeedupTab
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800261d0
inc eax
cmp eax, 0x3fffffff
jle 0x1800261e7
xor eax, eax
jmp 0x18002621f
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180026203
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180014db0
sub rsp, rcx
mov r9d, edi
lea rcx, [rsp + 0x30]
call fcn.1800012a0
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
lea rax, [rbp + 0x20]
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x30]
call fcn.180001270
lea rax, [rbp + 8]
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.180025640
test eax, eax
jne 0x18002631a
xor edx, edx
lea rcx, [rbp + 0x250]
mov r8d, 0x104
call fcn.180002660
mov rcx, qword [rbp + 8]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x18]
lea rax, [rbp + 0x250]
mov dword [rbp + 0x1a], 0x736c61
mov qword [rsp + 0x20], rax
mov word [rbp + 0x18], 0x7668
call fcn.180025920
test eax, eax
jne 0x180026311
cmp dword [rbp + 4], eax
jbe 0x180026311
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x104
call fcn.180002660
lea r9, [rbp]
mov word [rbp], 0x6425
mov edx, 0x104
mov byte [rbp + 2], 0
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x140]
call fcn.180001270
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x250]
call fcn.180024fc0
test rax, rax
je 0x180026311
mov rcx, qword [rbp + 8]
call fcn.180025590
mov rax, rbx
jmp 0x180026323
mov rcx, qword [rbp + 8]
call fcn.180025590
mov rcx, rbx
call qword [0x180063810]
mov rcx, qword [rbp + 0x360]
xor rcx, rbp
call fcn.180001330
mov rbx, qword [rbp + 0x388]
mov rdi, qword [rbp + 0x390]
lea rsp, [rbp + 0x370]
pop rbp
ret
Function at 0x180026350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x3a0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x388], rbx
mov qword [rbp + 0x390], rdi
mov rax, qword [0x180038010]
xor rax, rbp
mov qword [rbp + 0x360], rax
mov rbx, rcx
mov dword [rbp + 0x21], 0x5754464f
mov dword [rbp + 0x25], 0x5c455241
mov byte [rbp + 0x20], 0x53
mov byte [rbp + 0x29], 0
mov word [rbp + 0x10], 0x7325
mov word [rbp + 0x13], 0x73
mov byte [rbp + 0x12], 0x25
call fcn.180001290
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x104
mov edi, eax
call fcn.180002660
lea rax, str.RSpeedupTab
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1800263d0
inc ecx
cmp ecx, 0x3fffffff
jle 0x1800263e8
xor eax, eax
jmp 0x180026421
movsxd rax, ecx
lea r8d, [rcx + rcx]
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180026405
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180014db0
sub rsp, rcx
mov r9d, edi
lea rcx, [rsp + 0x30]
call fcn.1800012a0
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
lea rax, [rbp + 0x20]
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x30]
call fcn.180001270
lea rax, [rbp + 8]
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.180025640
test eax, eax
jne 0x180026525
xor edx, edx
lea rcx, [rbp + 0x250]
mov r8d, 0x104
call fcn.180002660
mov rcx, qword [rbp + 8]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x18]
lea rax, [rbp + 0x250]
mov word [rbp + 0x1b], 0x736c
mov qword [rsp + 0x20], rax
mov word [rbp + 0x18], 0x7668
mov byte [rbp + 0x1d], 0
mov byte [rbp + 0x1a], 0x61
call fcn.180025920
test eax, eax
jne 0x18002651c
cmp dword [rbp + 4], eax
jbe 0x18002651c
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x104
call fcn.180002660
lea r9, [rbp]
mov word [rbp], 0x6425
mov edx, 0x104
mov byte [rbp + 2], 0
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x140]
call fcn.180001270
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x250]
call fcn.180024fc0
test rax, rax
je 0x18002651c
mov rcx, qword [rbp + 8]
call fcn.180025590
mov eax, 1
jmp 0x18002652e
mov rcx, qword [rbp + 8]
call fcn.180025590
mov rcx, rbx
call qword [0x180063800]
mov rcx, qword [rbp + 0x360]
xor rcx, rbp
call fcn.180001330
mov rbx, qword [rbp + 0x388]
mov rdi, qword [rbp + 0x390]
lea rsp, [rbp + 0x370]
pop rbp
ret
Function at 0x180026560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x3b8
lea rbp, [rsp + 0x40]
mov rax, qword [0x180038010]
xor rax, rbp
mov qword [rbp + 0x360], rax
mov r15d, r9d
mov word [rbp + 0x22], 0x5446
mov r14d, r8d
mov word [rbp + 0x28], 0x5c
mov rsi, rdx
mov word [rbp + 0x25], 0x5241
mov rbx, rcx
mov word [rbp + 0x20], 0x4f53
mov byte [rbp + 0x27], 0x45
mov byte [rbp + 0x24], 0x57
mov dword [rbp + 0x10], 0x73257325
mov byte [rbp + 0x14], 0
call fcn.180001290
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x104
mov edi, eax
call fcn.180002660
lea rax, str.RSpeedupTab
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1800265e3
inc ecx
cmp ecx, 0x3fffffff
jle 0x1800265fb
xor eax, eax
jmp 0x180026634
movsxd rax, ecx
lea r8d, [rcx + rcx]
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180026618
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180014db0
sub rsp, rcx
mov r9d, edi
lea rcx, [rsp + 0x40]
call fcn.1800012a0
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
lea rax, [rbp + 0x20]
mov edx, 0x104
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x30]
call fcn.180001270
lea rax, [rbp + 8]
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.180025640
test eax, eax
jne 0x180026731
xor edx, edx
lea rcx, [rbp + 0x250]
mov r8d, 0x104
call fcn.180002660
mov rcx, qword [rbp + 8]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x18]
lea rax, [rbp + 0x250]
mov dword [rbp + 0x1a], 0x736c61
mov qword [rsp + 0x20], rax
mov word [rbp + 0x18], 0x7668
call fcn.180025920
test eax, eax
jne 0x180026728
cmp dword [rbp + 4], eax
jbe 0x180026728
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x104
call fcn.180002660
lea r9, [rbp]
mov word [rbp], 0x6425
mov edx, 0x104
mov byte [rbp + 2], 0
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x140]
call fcn.180001270
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x250]
call fcn.180024fc0
test rax, rax
je 0x180026728
mov rcx, qword [rbp + 8]
call fcn.180025590
mov eax, 1
jmp 0x180026761
mov rcx, qword [rbp + 8]
call fcn.180025590
mov eax, dword [rbp + 0x3e0]
mov r9d, r15d
mov dword [rsp + 0x30], eax
mov r8d, r14d
mov eax, dword [rbp + 0x3d8]
mov rdx, rsi
mov dword [rsp + 0x28], eax
mov rcx, rbx
mov eax, dword [rbp + 0x3d0]
mov dword [rsp + 0x20], eax
call qword [0x180063818]
mov rcx, qword [rbp + 0x360]
xor rcx, rbp
call fcn.180001330
lea rsp, [rbp + 0x378]
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret