joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800bff40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1c8]
mov eax, dword [rbp + 0x1a0]
imul rax, rax, 0x38
mov rcx, qword [0x18037a270]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov qword [rbp + 0x48], 5
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800bffc5
mov rax, qword [rbp + 0x68]
sub rax, 5
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
add rax, 2
mov qword [rbp + 0x48], rax
lea r9, [rbp + 0x24]
mov r8d, 0x40
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800bffeb
mov eax, 0xa
jmp 0x1800c011a
cmp dword [rbp + 0x1a8], 0
je 0x1800c005f
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov byte [rax], 0xe9
mov rax, qword [rbp + 0x68]
add rax, 5
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x88]
mov dword [rcx + 1], eax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800c005d
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov byte [rax], 0xeb
mov rax, qword [rbp + 0xa8]
mov byte [rax + 1], 0xf9
jmp 0x1800c00a6
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800c008c
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call sub.VCRUNTIME140D.dll_memcpy
jmp 0x1800c00a6
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call sub.VCRUNTIME140D.dll_memcpy
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 1
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 2
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x180255f10]
call fcn.180225a10
mov rax, rdi
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x1800c01b0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x138], rax
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x1800c0373
mov dword [rbp + 0x28], 0x1c
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1800c0369
mov eax, dword [rbp + 0x28]
cmp rax, 0x10
jb 0x1800c034d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp + 0x34], eax
jne 0x1800c034d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbp + 0x30], eax
je 0x1800c034d
mov rax, qword [rbp + 0x160]
cmp qword [rax], 0
jne 0x1800c02a8
mov rax, qword [rbp + 0x160]
mov dword [rax + 8], 0x80
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x180377af8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbp + 0x160]
mov qword [rcx], rax
mov rax, qword [rbp + 0x160]
cmp qword [rax], 0
jne 0x1800c02a6
jmp 0x1800c0369
jmp 0x1800c031d
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x160]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x1800c031d
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 8]
shl eax, 1
mov eax, eax
shl rax, 2
mov r9, rax
mov rax, qword [rbp + 0x160]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x180377af8]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x1800c02f9
jmp 0x1800c0369
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rbp + 0x160]
mov dword [rcx + 8], eax
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x68]
mov qword [rax], rcx
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0xc]
mov rcx, qword [rbp + 0x160]
mov rcx, qword [rcx]
mov edx, dword [rbp + 0x30]
mov dword [rcx + rax*4], edx
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rbp + 0x160]
mov dword [rcx + 0xc], eax
mov dword [rbp + 0x28], 0x1c
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1800c0224
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x20]
lea rdx, [0x180255eb0]
call fcn.180225a10
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1800c0570
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
mov rax, qword [rbp + 0x120]
mov qword [rax], 0
mov rax, qword [rbp + 0x120]
mov dword [rax + 8], 0
mov rax, qword [rbp + 0x120]
mov dword [rax + 0xc], 0
mov rcx, qword [rbp + 0x120]
call fcn.1800c01b0
mov rax, qword [rbp + 0x120]
cmp qword [rax], 0
je 0x1800c0644
mov dword [rbp + 4], 0
jmp 0x1800c05e0
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0xc]
cmp dword [rbp + 4], eax
jae 0x1800c0644
mov eax, dword [rbp + 4]
mov rcx, qword [rbp + 0x120]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x1800c0642
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rbp + 0x130]
mov edx, dword [rbp + 0x128]
mov rcx, qword [rbp + 0x28]
call fcn.1800c0d00
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800c05d8
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1800c0f00
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
mov rax, qword [rbp + 0x120]
cmp qword [rax], 0
je 0x1800c0f98
mov dword [rbp + 4], 0
jmp 0x1800c0f31
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0xc]
cmp dword [rbp + 4], eax
jae 0x1800c0f7f
mov eax, dword [rbp + 4]
mov rcx, qword [rbp + 0x120]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x1800c0f7d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800c0f29
mov rax, qword [rbp + 0x120]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x180377af8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1800c1790
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
mov rbp, rsp
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x1800c17f7
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x1800c17f7
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x1800c17f7
xor eax, eax
jmp 0x1800c1844
mov dword [rbp + 4], 1
jmp 0x1800c1808
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0x108]
cmp dword [rbp + 4], eax
jae 0x1800c183f
mov eax, dword [rbp + 4]
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x100]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x1800c183d
xor eax, eax
jmp 0x1800c1844
jmp 0x1800c1800
mov eax, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x1800c8210
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
cmp dword [rbp + 0x108], 0
jne 0x1800c823a
call fcn.1800c8320
cmp dword [rbp + 0x108], 1
jne 0x1800c8307
mov r8, qword [rbp + 0x110]
mov edx, dword [rbp + 0x108]
mov rcx, qword [rbp + 0x100]
call fcn.180226fb0
test eax, eax
jne 0x1800c826b
xor eax, eax
jmp 0x1800c830c
xor ecx, ecx
call fcn.180162150
mov qword [0x180377b08], rax
cmp qword [0x180377b08], 0
jne 0x1800c828a
xor eax, eax
jmp 0x1800c830c
lea rcx, str.navsystem.dll
call fcn.180162150
test rax, rax
jne 0x1800c829f
xor eax, eax
jmp 0x1800c830c
mov rax, qword [rbp + 0x100]
mov qword [0x180377b00], rax
mov rcx, qword [rbp + 0x100]
call fcn.1800c8700
movzx eax, al
test eax, eax
jne 0x1800c82c9
call fcn.1800c8320
xor eax, eax
jmp 0x1800c830c
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0x100]
lea r8, [0x1800c86a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x1800c8307
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1800c83c0
Capabilities:
Contain obfuscated stackstrings
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x130], rax
mov byte [rbp + 4], 0
mov qword [rbp + 0x28], 0
lea r9, [rbp + 0x28]
xor r8d, r8d
mov edx, 0x8000
lea rcx, [0x18029b950]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jl 0x1800c8518
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x160]
call fcn.1800c2950
lea rdx, str..cs2_
mov rcx, rax
call fcn.1800c28a0
mov byte [rbp + 4], 1
xor edx, edx
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800c8518
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1800c8518
mov byte [rbp + 0x108], 0x5b
mov byte [rbp + 0x109], 0x63
mov byte [rbp + 0x10a], 0x6f
mov byte [rbp + 0x10b], 0x72
mov byte [rbp + 0x10c], 0x65
mov byte [rbp + 0x10d], 0x2e
mov byte [rbp + 0x10e], 0x63
mov byte [rbp + 0x10f], 0x70
mov byte [rbp + 0x110], 0x70
mov byte [rbp + 0x111], 0x3a
mov byte [rbp + 0x112], 0x34
mov byte [rbp + 0x113], 0x39
mov byte [rbp + 0x114], 0x5d
mov byte [rbp + 0x115], 0x20
mov byte [rbp + 0x116], 0
lea rcx, [rbp + 0x108]
call fcn.1800c8360
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x128], rax
lea rdx, str.failed_to_create_default_working_directory__because_one_or_more_intermediate_directories_dont_exist
mov rcx, qword [rbp + 0x128]
call fcn.18015e890
mov byte [rbp + 4], 0
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
movzx eax, byte [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x180256640]
call fcn.180225a10
mov eax, edi
mov rcx, qword [rbp + 0x130]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1800ced30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x5a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x278]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x218], rax
mov rax, qword [rbp + 0x250]
mov rax, qword [rax]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x250]
mov rax, qword [rax + 8]
mov qword [rbp + 0x10], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x10
lea r9, [rbp + 8]
mov r8, qword [rbp + 0x248]
mov rdx, qword [rbp + 0x240]
lea rcx, [rbp + 0x38]
call fcn.180161760
nop
lea rcx, [rbp + 0x38]
call fcn.1800d2b30
movzx eax, al
test eax, eax
jne 0x1800cef7a
lea rcx, [rbp + 0x38]
call fcn.1800d3030
cmp rax, 1
jbe 0x1800cef53
mov byte [rbp + 0x138], 0x5b
mov byte [rbp + 0x139], 0x62
mov byte [rbp + 0x13a], 0x69
mov byte [rbp + 0x13b], 0x6e
mov byte [rbp + 0x13c], 0x61
mov byte [rbp + 0x13d], 0x72
mov byte [rbp + 0x13e], 0x79
mov byte [rbp + 0x13f], 0x2e
mov byte [rbp + 0x140], 0x68
mov byte [rbp + 0x141], 0x3a
mov byte [rbp + 0x142], 0x32
mov byte [rbp + 0x143], 0x30
mov byte [rbp + 0x144], 0x35
mov byte [rbp + 0x145], 0x5d
mov byte [rbp + 0x146], 0x20
mov byte [rbp + 0x147], 0
lea rcx, [rbp + 0x138]
call fcn.1800c8390
mov r8, rax
mov dl, 2
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x1d8], rax
lea rdx, str.found_more_than_one_variable_that_matches__NAME:
mov rcx, qword [rbp + 0x1d8]
call fcn.18015e890
mov qword [rbp + 0x1e0], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x164], ax
movzx eax, word [rbp + 0x164]
mov word [rbp + 0x184], ax
movzx edx, word [rbp + 0x184]
mov rcx, qword [rbp + 0x1e0]
call fcn.18015e9e0
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x250]
mov rax, qword [rax]
mov qword [rbp + 0x1f0], rax
mov rdx, qword [rbp + 0x1f0]
mov rcx, qword [rbp + 0x1e8]
call fcn.1800cb2f0
mov qword [rbp + 0x1f8], rax
lea rdx, str.__TYPE:
mov rcx, qword [rbp + 0x1f8]
call fcn.18015e890
mov qword [rbp + 0x200], rax
mov rax, qword [rbp + 0x250]
mov rax, qword [rax + 8]
mov qword [rbp + 0x208], rax
mov rdx, qword [rbp + 0x208]
mov rcx, qword [rbp + 0x200]
call fcn.1800cb2f0
mov qword [rbp + 0x210], rax
lea rdx, str.__hashes
mov rcx, qword [rbp + 0x210]
call fcn.18015e890
xor edx, edx
lea rcx, [rbp + 0x38]
call fcn.1800ce610
mov rax, qword [rax]
mov qword [rbp + 0x1a8], rax
lea rcx, [rbp + 0x38]
call fcn.1800ce570
mov rax, qword [rbp + 0x1a8]
jmp 0x1800cef95
mov qword [rbp + 0x1c8], 0
lea rcx, [rbp + 0x38]
call fcn.1800ce570
mov rax, qword [rbp + 0x1c8]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1802579d0]
call fcn.180225a10
mov rax, rdi
mov rcx, qword [rbp + 0x218]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x228]
pop rdi
pop rbp
ret
Function at 0x1800cf530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x478
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xb6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x498]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov rdx, qword [rbp + 0x470]
lea rcx, [0x180377b10]
call fcn.1800ce6f0
mov rax, qword [rax]
mov qword [rbp + 8], rax
lea rdx, [0x180378530]
lea rcx, [rbp + 0x30]
call fcn.1800c2950
mov rdx, qword [rbp + 8]
mov rcx, rax
call fcn.1800c28a0
lea rcx, [rbp + 0x30]
call fcn.1800cf1c0
movzx eax, al
test eax, eax
je 0x1800cf6a4
mov byte [rbp + 0x3d8], 0x5b
mov byte [rbp + 0x3d9], 0x63
mov byte [rbp + 0x3da], 0x6f
mov byte [rbp + 0x3db], 0x6e
mov byte [rbp + 0x3dc], 0x66
mov byte [rbp + 0x3dd], 0x69
mov byte [rbp + 0x3de], 0x67
mov byte [rbp + 0x3df], 0x2e
mov byte [rbp + 0x3e0], 0x63
mov byte [rbp + 0x3e1], 0x70
mov byte [rbp + 0x3e2], 0x70
mov byte [rbp + 0x3e3], 0x3a
mov byte [rbp + 0x3e4], 0x33
mov byte [rbp + 0x3e5], 0x33
mov byte [rbp + 0x3e6], 0x39
mov byte [rbp + 0x3e7], 0x5d
mov byte [rbp + 0x3e8], 0x20
mov byte [rbp + 0x3e9], 0
lea rcx, [rbp + 0x3d8]
call fcn.1800cefd0
mov r8, rax
mov dl, 1
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x428], rax
lea rdx, str.loaded_configuration_file:__
mov rcx, qword [rbp + 0x428]
call fcn.18015e890
mov qword [rbp + 0x430], rax
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x430]
call fcn.18015e8e0
mov qword [rbp + 0x438], rax
lea rdx, [0x180257fb4]
mov rcx, qword [rbp + 0x438]
call fcn.18015e890
mov al, 1
jmp 0x1800cf78c
mov byte [rbp + 0x408], 0x5b
mov byte [rbp + 0x409], 0x63
mov byte [rbp + 0x40a], 0x6f
mov byte [rbp + 0x40b], 0x6e
mov byte [rbp + 0x40c], 0x66
mov byte [rbp + 0x40d], 0x69
mov byte [rbp + 0x40e], 0x67
mov byte [rbp + 0x40f], 0x2e
mov byte [rbp + 0x410], 0x63
mov byte [rbp + 0x411], 0x70
mov byte [rbp + 0x412], 0x70
mov byte [rbp + 0x413], 0x3a
mov byte [rbp + 0x414], 0x33
mov byte [rbp + 0x415], 0x34
mov byte [rbp + 0x416], 0x33
mov byte [rbp + 0x417], 0x5d
mov byte [rbp + 0x418], 0x20
mov byte [rbp + 0x419], 0
lea rcx, [rbp + 0x408]
call fcn.1800cefd0
mov r8, rax
mov dl, 2
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x428], rax
lea rdx, str.failed_to_load_configuration_file:__
mov rcx, qword [rbp + 0x428]
call fcn.18015e890
mov qword [rbp + 0x430], rax
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x430]
call fcn.18015e8e0
mov qword [rbp + 0x438], rax
lea rdx, [0x180257fb4]
mov rcx, qword [rbp + 0x438]
call fcn.18015e890
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1802577f0]
call fcn.180225a10
mov rax, rdi
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x458]
pop rdi
pop rbp
ret
Function at 0x1800cfd30
Capabilities:
Contain obfuscated stackstrings
Enumerate files on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x7b8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x156
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x780], rax
lea rcx, [0x180377b10]
call fcn.1800d29a0
lea rdx, [0x180378530]
lea rcx, [rbp + 0x10]
call fcn.1800c2950
lea rdx, str..bin
mov rcx, rax
call fcn.1800c28a0
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x4a8], rax
cmp qword [rbp + 0x4a8], 0xffffffffffffffff
je 0x1800cff3f
lea rcx, [rbp + 0x26c]
call fcn.1800cbce0
inc rax
mov qword [rbp + 0x768], rax
mov eax, 2
mov rcx, qword [rbp + 0x768]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180160d50
mov qword [rbp + 0x728], rax
mov rax, qword [rbp + 0x728]
mov qword [rbp + 0x708], rax
lea rdx, [rbp + 0x708]
lea rcx, [0x180377b10]
call fcn.1800d2f30
lea rcx, [0x180377b10]
call fcn.1800d2720
lea rdx, [rbp + 0x26c]
mov rcx, qword [rax]
call fcn.1800c2950
mov byte [rbp + 0x748], 0x5b
mov byte [rbp + 0x749], 0x63
mov byte [rbp + 0x74a], 0x6f
mov byte [rbp + 0x74b], 0x6e
mov byte [rbp + 0x74c], 0x66
mov byte [rbp + 0x74d], 0x69
mov byte [rbp + 0x74e], 0x67
mov byte [rbp + 0x74f], 0x2e
mov byte [rbp + 0x750], 0x63
mov byte [rbp + 0x751], 0x70
mov byte [rbp + 0x752], 0x70
mov byte [rbp + 0x753], 0x3a
mov byte [rbp + 0x754], 0x31
mov byte [rbp + 0x755], 0x38
mov byte [rbp + 0x756], 0x39
mov byte [rbp + 0x757], 0x5d
mov byte [rbp + 0x758], 0x20
mov byte [rbp + 0x759], 0
lea rcx, [rbp + 0x748]
call fcn.1800cefd0
mov r8, rax
mov dl, 1
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x768], rax
lea rdx, str.found_configuration_file:__
mov rcx, qword [rbp + 0x768]
call fcn.18015e890
mov qword [rbp + 0x770], rax
lea rdx, [rbp + 0x26c]
mov rcx, qword [rbp + 0x770]
call fcn.18015e8e0
mov qword [rbp + 0x778], rax
lea rdx, [0x180257fb4]
mov rcx, qword [rbp + 0x778]
call fcn.18015e890
lea rdx, [rbp + 0x240]
mov rcx, qword [rbp + 0x4a8]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800cfdb2
mov rcx, qword [rbp + 0x4a8]
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rbp - 0x20]
lea rdx, [0x180257670]
call fcn.180225a10
mov rcx, qword [rbp + 0x780]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x798]
pop rdi
pop rbp
ret
Function at 0x1800d05d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x478
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xb6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x498]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov rdx, qword [rbp + 0x470]
lea rcx, [0x180377b10]
call fcn.1800ce6f0
mov rax, qword [rax]
mov qword [rbp + 8], rax
lea rdx, [0x180378530]
lea rcx, [rbp + 0x30]
call fcn.1800c2950
mov rdx, qword [rbp + 8]
mov rcx, rax
call fcn.1800c28a0
lea rcx, [rbp + 0x30]
call fcn.1800d0290
movzx eax, al
test eax, eax
je 0x1800d0744
mov byte [rbp + 0x3d8], 0x5b
mov byte [rbp + 0x3d9], 0x63
mov byte [rbp + 0x3da], 0x6f
mov byte [rbp + 0x3db], 0x6e
mov byte [rbp + 0x3dc], 0x66
mov byte [rbp + 0x3dd], 0x69
mov byte [rbp + 0x3de], 0x67
mov byte [rbp + 0x3df], 0x2e
mov byte [rbp + 0x3e0], 0x63
mov byte [rbp + 0x3e1], 0x70
mov byte [rbp + 0x3e2], 0x70
mov byte [rbp + 0x3e3], 0x3a
mov byte [rbp + 0x3e4], 0x33
mov byte [rbp + 0x3e5], 0x31
mov byte [rbp + 0x3e6], 0x36
mov byte [rbp + 0x3e7], 0x5d
mov byte [rbp + 0x3e8], 0x20
mov byte [rbp + 0x3e9], 0
lea rcx, [rbp + 0x3d8]
call fcn.1800cefd0
mov r8, rax
mov dl, 1
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x428], rax
lea rdx, str.saved_configuration_file:__
mov rcx, qword [rbp + 0x428]
call fcn.18015e890
mov qword [rbp + 0x430], rax
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x430]
call fcn.18015e8e0
mov qword [rbp + 0x438], rax
lea rdx, [0x180257fb4]
mov rcx, qword [rbp + 0x438]
call fcn.18015e890
mov al, 1
jmp 0x1800d082c
mov byte [rbp + 0x408], 0x5b
mov byte [rbp + 0x409], 0x63
mov byte [rbp + 0x40a], 0x6f
mov byte [rbp + 0x40b], 0x6e
mov byte [rbp + 0x40c], 0x66
mov byte [rbp + 0x40d], 0x69
mov byte [rbp + 0x40e], 0x67
mov byte [rbp + 0x40f], 0x2e
mov byte [rbp + 0x410], 0x63
mov byte [rbp + 0x411], 0x70
mov byte [rbp + 0x412], 0x70
mov byte [rbp + 0x413], 0x3a
mov byte [rbp + 0x414], 0x33
mov byte [rbp + 0x415], 0x32
mov byte [rbp + 0x416], 0x30
mov byte [rbp + 0x417], 0x5d
mov byte [rbp + 0x418], 0x20
mov byte [rbp + 0x419], 0
lea rcx, [rbp + 0x408]
call fcn.1800cefd0
mov r8, rax
mov dl, 2
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x428], rax
lea rdx, str.failed_to_save_configuration_file:__
mov rcx, qword [rbp + 0x428]
call fcn.18015e890
mov qword [rbp + 0x430], rax
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x430]
call fcn.18015e8e0
mov qword [rbp + 0x438], rax
lea rdx, [0x180257fb4]
mov rcx, qword [rbp + 0x438]
call fcn.18015e890
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x180257790]
call fcn.180225a10
mov rax, rdi
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x458]
pop rdi
pop rbp
ret