joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800125c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x29], 0x6c6c64
mov dword [rsp + 0x25], 0x2e323369
mov word [rsp + 0x23], 0x7061
mov word [rsp + 0x20], 0x6441
mov byte [rsp + 0x22], 0x76
call fcn.180012dd0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x48
ret

Function at 0x180012620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x27], 0x6c642e32
mov word [rsp + 0x2b], 0x6c
mov dword [rsp + 0x21], 0x656e7265
mov word [rsp + 0x25], 0x336c
mov byte [rsp + 0x20], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x48
ret

Function at 0x180012680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x776c6853
mov dword [rsp + 0x24], 0x2e697061
mov word [rsp + 0x29], 0x6c6c
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x28], 0x64
call fcn.180012dd0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x48
ret

Function at 0x1800126d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x24], 0x3233
mov dword [rsp + 0x26], 0x6c6c642e
mov word [rsp + 0x21], 0x6573
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x20], 0x55
mov byte [rsp + 0x23], 0x72
call fcn.180012dd0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x48
ret

Function at 0x1800127e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov edi, edx
mov dword [rbp - 0x1c], 0x746f6873
mov ebx, ecx
mov dword [rbp - 0x2e], 0x65746165
mov word [rbp - 0x22], 0x3233
mov word [rbp - 0x28], 0x6c6f
mov word [rbp - 0x30], 0x7243
mov word [rbp - 0x25], 0x6c65
mov word [rbp - 0x1f], 0x616e
mov word [rbp - 0x2a], 0x6f54
mov byte [rbp - 0x26], 0x68
mov byte [rbp - 0x1d], 0x70
mov byte [rbp - 0x18], 0
mov byte [rbp - 0x23], 0x70
mov byte [rbp - 0x20], 0x53
call fcn.180012620
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180012869
mov edx, edi
mov ecx, ebx
call rax
jmp 0x18001286d
or rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800150b0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x180012890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov word [rsp + 0x2c], 0x536c
mov dword [rsp + 0x27], 0x63697469
mov dword [rsp + 0x2f], 0x6f697463
mov dword [rsp + 0x22], 0x43726574
mov word [rsp + 0x33], 0x6e
mov byte [rsp + 0x2e], 0x65
mov word [rsp + 0x20], 0x6e45
mov byte [rsp + 0x2b], 0x61
mov byte [rsp + 0x26], 0x72
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180012901
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x40
pop rbx
ret
sub rsp, 0x28
cmp dword [0x18005da90], 0
jne 0x180014644
lea rcx, [0x18005da98]
call fcn.180012cb0
mov edx, 0x200
lea rcx, [0x18005dac0]
call fcn.1800131b0
mov dword [0x18005da90], 1
lea rcx, [0x18005da98]
add rsp, 0x28
jmp 0x180012890

Function at 0x180012920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, r8
mov word [rsp + 0x2e], 0x6e6f
mov rdi, rdx
mov dword [rsp + 0x29], 0x74637572
mov rbx, rcx
mov word [rsp + 0x31], 0x6361
mov word [rsp + 0x26], 0x736e
mov word [rsp + 0x34], 0x65
mov byte [rsp + 0x30], 0x43
mov dword [rsp + 0x21], 0x6873756c
mov byte [rsp + 0x28], 0x74
mov byte [rsp + 0x20], 0x46
mov byte [rsp + 0x33], 0x68
mov byte [rsp + 0x25], 0x49
mov byte [rsp + 0x2d], 0x69
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800129ad
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800129d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov word [rsp + 0x2f], 0x64
mov dword [rsp + 0x26], 0x746e6572
mov word [rsp + 0x20], 0x6547
mov word [rsp + 0x23], 0x7543
mov dword [rsp + 0x2a], 0x65726854
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x25], 0x72
mov byte [rsp + 0x2e], 0x61
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180012a43
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x48
ret
Function at 0x180012a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov esi, r8d
mov word [rsp + 0x29], 0x6946
mov rdi, rdx
mov dword [rsp + 0x24], 0x6c75646f
mov rbx, rcx
mov dword [rsp + 0x20], 0x4d746547
mov word [rsp + 0x2e], 0x6d61
mov byte [rsp + 0x28], 0x65
mov word [rsp + 0x31], 0x41
mov word [rsp + 0x2c], 0x4e65
mov byte [rsp + 0x2b], 0x6c
mov byte [rsp + 0x30], 0x65
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180012ade
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180012b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov dword [rsp + 0x25], 0x6d657473
mov word [rsp + 0x23], 0x7953
mov word [rsp + 0x20], 0x6547
mov word [rsp + 0x2c], 0x6f
mov word [rsp + 0x29], 0x6e49
mov byte [rsp + 0x2b], 0x66
mov byte [rsp + 0x22], 0x74
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180012b63
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x40
pop rbx
ret

Function at 0x180012b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov dword [rsp + 0x23], 0x65726854
mov rbx, rcx
mov dword [rsp + 0x2d], 0x747865
mov word [rsp + 0x20], 0x6547
mov dword [rsp + 0x28], 0x6e6f4364
mov byte [rsp + 0x2c], 0x74
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x27], 0x61
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180012bed
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800150b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180012c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov word [rsp + 0x29], 0x7250
mov dword [rsp + 0x22], 0x72685474
mov dword [rsp + 0x2d], 0x79746972
mov word [rsp + 0x26], 0x6165
mov word [rsp + 0x2b], 0x6f69
mov byte [rsp + 0x31], 0
mov word [rsp + 0x20], 0x6547
mov byte [rsp + 0x28], 0x64
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180012c8e
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x40
pop rbx
ret
mov eax, 0x7fffffff
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x40
pop rbx
ret
Function at 0x180012cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov dword [rbp - 0x20], 0x65536c61
mov dword [rbp - 0x1a], 0x6e6f69
mov dword [rbp - 0x2a], 0x657a696c
mov dword [rbp - 0x2e], 0x61697469
mov word [rbp - 0x1c], 0x7463
mov word [rbp - 0x25], 0x6972
mov word [rbp - 0x30], 0x6e49
mov word [rbp - 0x22], 0x6369
mov byte [rbp - 0x26], 0x43
mov byte [rbp - 0x23], 0x74
call fcn.180012620
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180012d26
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800150b0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x180012d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov dword [rsp + 0x31], 0x6e6f69
mov word [rsp + 0x2b], 0x6c61
mov word [rsp + 0x26], 0x6972
mov word [rsp + 0x23], 0x6576
mov word [rsp + 0x20], 0x654c
mov word [rsp + 0x28], 0x6974
mov byte [rsp + 0x25], 0x43
mov dword [rsp + 0x2d], 0x74636553
mov byte [rsp + 0x22], 0x61
mov byte [rsp + 0x2a], 0x63
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180012db7
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x40
pop rbx
ret
lea rcx, [0x18005da98]
jmp 0x180012d40

Function at 0x180012dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov word [rsp + 0x2a], 0x4179
mov dword [rsp + 0x25], 0x61726269
mov dword [rsp + 0x20], 0x64616f4c
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x29], 0x72
mov byte [rsp + 0x24], 0x4c
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180012e3e
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x40
pop rbx
ret

Function at 0x180012e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov esi, r8d
mov word [rsp + 0x25], 0x7268
mov edi, edx
mov word [rsp + 0x28], 0x6461
mov ebx, ecx
mov dword [rsp + 0x20], 0x6e65704f
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x24], 0x54
mov byte [rsp + 0x27], 0x65
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180012ec4
mov r8d, esi
mov edx, edi
mov ecx, ebx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180012f80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r12, qword [rsp + 0xb0]
mov r15d, r9d
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
mov ebx, 1
call fcn.1800125c0
mov rdi, rax
test rax, rax
je 0x18001301d
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x3a], 0x417845
mov rcx, rax
mov word [rsp + 0x30], 0x6552
mov dword [rsp + 0x33], 0x6e65704f
mov word [rsp + 0x37], 0x654b
mov byte [rsp + 0x32], 0x67
mov byte [rsp + 0x39], 0x79
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180013014
mov r9d, r15d
mov qword [rsp + 0x20], r12
mov r8d, r14d
mov rdx, rbp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180013040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r12, qword [rsp + 0xc0]
mov r15, r9
mov r13, qword [rsp + 0xc8]
mov r14, r8
mov rbp, rdx
mov rsi, rcx
mov ebx, 1
call fcn.1800125c0
mov rdi, rax
test rax, rax
je 0x1800130f8
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x3c], 0x41784565
mov rcx, rax
mov dword [rsp + 0x38], 0x756c6156
mov word [rsp + 0x33], 0x7551
mov word [rsp + 0x30], 0x6552
mov word [rsp + 0x35], 0x7265
mov byte [rsp + 0x37], 0x79
mov byte [rsp + 0x32], 0x67
mov byte [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800130ef
mov qword [rsp + 0x28], r13
mov r9, r15
mov r8, r14
mov qword [rsp + 0x20], r12
mov rdx, rbp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180013120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov word [rsp + 0x2b], 0x64
mov dword [rsp + 0x22], 0x656d7573
mov dword [rsp + 0x26], 0x65726854
mov word [rsp + 0x20], 0x6552
mov byte [rsp + 0x2a], 0x61
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001318b
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x40
pop rbx
ret
or eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x40
pop rbx
ret
Function at 0x1800131b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov word [rsp + 0x2c], 0x79
mov rbx, rcx
mov word [rsp + 0x21], 0x6c74
mov word [rsp + 0x26], 0x4d6f
mov word [rsp + 0x29], 0x6f6d
mov byte [rsp + 0x20], 0x52
mov byte [rsp + 0x2b], 0x72
mov word [rsp + 0x24], 0x7265
mov byte [rsp + 0x23], 0x5a
mov byte [rsp + 0x28], 0x65
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180013226
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180013240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edi, edx
mov dword [rsp + 0x25], 0x64616572
mov rbx, rcx
mov word [rsp + 0x2d], 0x6972
mov word [rsp + 0x30], 0x79
mov word [rsp + 0x2a], 0x6972
mov byte [rsp + 0x2f], 0x74
mov byte [rsp + 0x29], 0x50
mov dword [rsp + 0x20], 0x54746553
mov byte [rsp + 0x2c], 0x6f
mov byte [rsp + 0x24], 0x68
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800132b6
mov edx, edi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800150b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1800133c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov dword [rsp + 0x25], 0x6854646e
mov dword [rsp + 0x2a], 0x646165
mov dword [rsp + 0x20], 0x70737553
mov byte [rsp + 0x24], 0x65
mov byte [rsp + 0x29], 0x72
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001342a
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x40
pop rbx
ret
or eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x40
pop rbx
ret

Function at 0x180013440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov dword [rsp + 0x23], 0x33646165
mov rbx, rcx
mov word [rsp + 0x29], 0x7269
mov word [rsp + 0x2c], 0x74
mov word [rsp + 0x27], 0x4632
mov word [rsp + 0x21], 0x7268
mov byte [rsp + 0x20], 0x54
mov byte [rsp + 0x2b], 0x73
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800134ad
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1800134d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov word [rsp + 0x27], 0x4e32
mov rbx, rcx
mov word [rsp + 0x24], 0x6461
mov dword [rsp + 0x29], 0x747865
mov byte [rsp + 0x26], 0x33
mov word [rsp + 0x21], 0x7268
mov byte [rsp + 0x23], 0x65
mov byte [rsp + 0x20], 0x54
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001353b
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180013560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebp, r9d
mov word [rsp + 0x20], 0x6956
mov esi, r8d
mov dword [rsp + 0x29], 0x636f6c
mov rdi, rdx
mov dword [rsp + 0x23], 0x6c617574
mov rbx, rcx
mov word [rsp + 0x27], 0x6c41
mov byte [rsp + 0x22], 0x72
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800135cd
mov r9d, ebp
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180013670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
mov ebp, r9d
mov rsi, r8
mov dword [rsp + 0x32], 0x61757472
mov rdi, rdx
mov dword [rsp + 0x3d], 0x784574
mov rbx, rcx
mov dword [rsp + 0x37], 0x746f7250
mov word [rsp + 0x30], 0x6956
mov word [rsp + 0x3b], 0x6365
mov byte [rsp + 0x36], 0x6c
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800136f4
mov r9d, ebp
mov qword [rsp + 0x20], r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180013710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, r8
mov word [rsp + 0x2b], 0x79
mov rdi, rdx
mov word [rsp + 0x28], 0x6575
mov rbx, rcx
mov word [rsp + 0x25], 0x6c61
mov dword [rsp + 0x20], 0x74726956
mov byte [rsp + 0x2a], 0x72
mov byte [rsp + 0x27], 0x51
mov byte [rsp + 0x24], 0x75
call fcn.180012620
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001377f
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x180013820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.1800126d0
test rax, rax
je 0x180013888
lea rdx, [rsp + 0x20]
mov word [rsp + 0x25], 0x6957
mov rcx, rax
mov dword [rsp + 0x20], 0x6e697242
mov dword [rsp + 0x27], 0x776f646e
mov dword [rsp + 0x2d], 0x706f54
mov byte [rsp + 0x24], 0x67
mov word [rsp + 0x2b], 0x6f54
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x48
ret

Function at 0x1800138a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.1800126d0
test rax, rax
je 0x180013906
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2b], 0x776f646e
mov rcx, rax
mov dword [rsp + 0x25], 0x65766974
mov dword [rsp + 0x20], 0x41746553
mov word [rsp + 0x29], 0x6957
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x24], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x48
ret

Function at 0x180013920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.1800126d0
test rax, rax
je 0x180013997
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x23], 0x65726f46
mov rcx, rax
mov dword [rsp + 0x2f], 0x776f646e
mov dword [rsp + 0x2a], 0x57646e75
mov word [rsp + 0x20], 0x6553
mov word [rsp + 0x27], 0x7267
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x33], 0
mov byte [rsp + 0x2e], 0x69
mov byte [rsp + 0x29], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x48
ret

Function at 0x1800139b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.1800126d0
test rax, rax
je 0x180013a13
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x21], 0x69577465
mov rcx, rax
mov dword [rsp + 0x28], 0x736f5077
mov word [rsp + 0x25], 0x646e
mov byte [rsp + 0x20], 0x53
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x27], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x48
ret
Function at 0x180013a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x158
mov rax, qword [0x18005cf60]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp edx, 1
jne 0x180013b29
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.180012a60
lea rcx, [rsp + 0x30]
call fcn.1800137a0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x26], 0x75732074
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x2c], 0x74726f
mov dword [rsp + 0x21], 0x6174736e
mov word [rsp + 0x2a], 0x7070
mov byte [rsp + 0x20], 0x69
mov byte [rsp + 0x25], 0x6e
call fcn.180013330
test rax, rax
jne 0x180013b5d
lea rdx, [sym.gphelper.dll_sr3bp9]
lea rcx, [0x18005da70]
call fcn.1800146c0
test eax, eax
je 0x180013b5d
lea rdx, [sym.gphelper.dll_ograil]
lea rcx, [0x18005d9c8]
call fcn.1800146c0
test eax, eax
je 0x180013b5d
lea rdx, [sym.gphelper.dll_kdcvc8]
lea rcx, [0x18005da30]
call fcn.1800146c0
test eax, eax
je 0x180013b5d
lea rdx, [sym.gphelper.dll_pkp1sj]
lea rcx, [0x18005da10]
call fcn.1800146c0
jmp 0x180013b5d
test edx, edx
jne 0x180013b5d
lea rcx, [0x18005da70]
call fcn.180014930
lea rcx, [0x18005d9c8]
call fcn.180014930
lea rcx, [0x18005da30]
call fcn.180014930
lea rcx, [0x18005da10]
call fcn.180014930
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800150b0
add rsp, 0x158
ret