joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x750a
lea r8, [0x1800ee150]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x75627569
mov dword [rsp + 0x24], 0x75657578
mov dword [rsp + 0x28], 0x756f7567
mov dword [rsp + 0x2c], 0x756f7524
mov dword [rsp + 0x30], 0x756f7572
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.1800580f0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800adc10
add rsp, 0x130
pop rbp
ret

Function at 0x180011280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800ee178]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xc]
mov r9d, 0x6217
mov dword [rsp + 0x20], 0x627e6271
mov dword [rsp + 0x24], 0x62726265
mov dword [rsp + 0x28], 0x62786271
mov dword [rsp + 0x2c], 0x6239626f
mov dword [rsp + 0x30], 0x626f6272
mov qword [rsp + 0x34], 0x62176272
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.1800580f0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800adc10
add rsp, 0x130
pop rbp
ret
Function at 0x180011380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x4f24
lea r8, [0x1800ee1b8]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xd]
mov dword [rsp + 0x20], 0x4f414f4d
mov dword [rsp + 0x24], 0x4f544f5c
mov dword [rsp + 0x28], 0x4f4b4f48
mov dword [rsp + 0x2c], 0x4f414f56
mov dword [rsp + 0x30], 0x4f414f0a
mov dword [rsp + 0x34], 0x4f414f5c
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.1800580f0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800adc10
add rsp, 0x130
pop rbp
ret

Function at 0x180011480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800ee1e0]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xa]
mov r9d, 0x3c31
mov dword [rsp + 0x20], 0x3c413c5e
mov dword [rsp + 0x24], 0x3c433c54
mov dword [rsp + 0x28], 0x3c1f3c50
mov dword [rsp + 0x2c], 0x3c493c54
mov qword [rsp + 0x30], 0x3c313c54
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.1800580f0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800adc10
add rsp, 0x130
pop rbp
ret
Function at 0x1800116a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800ee208]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0x14]
mov r9d, 0x293e
mov dword [rsp + 0x20], 0x29572953
mov dword [rsp + 0x24], 0x294c295d
mov dword [rsp + 0x28], 0x294d2951
mov dword [rsp + 0x2c], 0x29582951
mov dword [rsp + 0x30], 0x295b294a
mov dword [rsp + 0x34], 0x2959295a
mov dword [rsp + 0x38], 0x295d295b
mov dword [rsp + 0x3c], 0x2910294e
mov dword [rsp + 0x40], 0x2946295b
mov qword [rsp + 0x44], 0x293e295b
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.1800580f0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800adc10
add rsp, 0x130
pop rbp
ret

Function at 0x18001c610
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x18001c644
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18001c630
mov rcx, rax
shr rcx, 0x20
xor eax, ecx
ret
Function at 0x180028fb0
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x150], rax
call fcn.180028870
test al, al
je 0x18002922d
lea rcx, [0x1800ece90]
call fcn.1800586d0
test al, al
jne 0x180029078
lea rcx, [0x1800ece30]
call fcn.1800586d0
test al, al
je 0x180029015
call fcn.180058330
test al, al
sete al
jmp 0x18002905e
lea rcx, [0x1800ecf50]
call fcn.1800586d0
test al, al
je 0x180029031
call fcn.180058380
test al, al
sete al
jmp 0x18002905e
lea rcx, [0x1800ecef0]
call fcn.1800586d0
test al, al
je 0x180029064
lea rcx, [rsp + 0x90]
call fcn.180011960
mov qword [rsp + 0x70], rax
cmp dword [rax + 0xc], 7
je 0x180029078
call fcn.180058330
mov byte [rsp + 0x20], al
jmp 0x180029070
lea rcx, [0x1800ecfb0]
call fcn.1800586d0
test al, al
je 0x18002922d
lea rcx, [0x1800ece30]
call fcn.1800586d0
test al, al
je 0x180029093
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
call fcn.180029270
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
or rdi, 0xffffffffffffffff
cmp word [rax], bx
jne 0x1800290df
mov r8d, ebx
jmp 0x1800290ec
mov r8, rdi
inc r8
cmp word [rax + r8*2], bx
jne 0x1800290e2
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1800126e0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.180071ea0
nop
cmp qword [rsp + 0x48], 8
jb 0x18002911f
mov rcx, qword [rsp + 0x30]
call fcn.18008b960
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
lea rcx, [rsp + 0xb0]
call fcn.180011b60
nop
call fcn.1800481e0
mov dl, 1
mov ecx, 0x2718
call fcn.18002a7e0
lea rcx, [0x1800ece30]
call fcn.1800586d0
test al, al
je 0x18002917f
xor edx, edx
lea rcx, [0x180059640]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x180059640]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x180029196
mov rcx, rbx
mov qword [rsp + 0x50], rbx
jmp 0x18002919e
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.1800492e0
nop
cmp qword [rsp + 0xc8], 8
jb 0x1800291c5
mov rcx, qword [rsp + 0xb0]
call fcn.18008b960
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0xb0], bx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x18002922d
mov qword [rsp + 0x28], rcx
mov eax, edi
lock xadd dword [rcx + 8], eax
dec eax
jne 0x18002922d
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x18002922d
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 8]
nop
call fcn.180061fb0
mov rcx, qword [0x1800ecd98]
test rcx, rcx
je 0x180029247
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800adc10
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x180029bd0
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x60
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, rcx
cmp edx, 1
jne 0x180029df0
xor esi, esi
mov ebx, esi
lea rdi, [0x1800ece30]
mov dword [rsp + 0x30], ebx
cmp ebx, 5
jge 0x180029c37
movsxd rax, ebx
lea rcx, [rax + rax*2]
shl rcx, 5
add rcx, rdi
call fcn.1800586d0
test al, al
jne 0x180029c47
inc ebx
jmp 0x180029c13
call fcn.180058a90
test al, al
jne 0x180029c47
xor eax, eax
jmp 0x180029df5
call fcn.180058a90
test al, al
je 0x180029c5a
mov eax, 1
jmp 0x180029df5
mov qword [0x1800ecd98], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1800ecd90], eax
mov rcx, r14
call fcn.1800299f0
call fcn.180029e20
or rdi, 0xffffffffffffffff
cmp word [rax], 0
jne 0x180029c89
mov r8, rsi
jmp 0x180029c9b
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180029c90
mov rdx, rax
lea rcx, [0x180004338]
call fcn.1800126e0
mov rcx, r14
call fcn.180059800
nop
lea rcx, [0x1800ece90]
call fcn.1800586d0
test al, al
je 0x180029cc8
call fcn.1800481e0
lea rcx, [0x1800ecfb0]
call fcn.1800586d0
test al, al
je 0x180029cdd
call fcn.1800481e0
lea rcx, [0x1800ecf50]
call fcn.1800586d0
test al, al
je 0x180029d4b
call fcn.180058380
test al, al
je 0x180029cfd
xor eax, eax
jmp 0x180029df5
call fcn.1800481e0
mov dword [rsp + 0x44], esi
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x180029420]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x180029d41
call fcn.180059be0
jmp 0x180029d41
mov eax, 1
jmp 0x180029df5
mov dword [rsp + 0x40], esi
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x180029420]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180073b70
nop
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x180029d98
mov rsi, qword [rax]
mov edx, 0xf
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x180029daf
call fcn.180059be0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x180029df0
mov eax, edi
lock xadd dword [rbx + 8], eax
dec eax
jne 0x180029df0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x180029df0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
jmp 0x180029df0
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800adc10
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1800453a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x4f24
lea r8, [0x1800eea18]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x4f4c4f47
mov dword [rsp + 0x24], 0x4f4b4f56
mov dword [rsp + 0x28], 0x4f414f49
mov dword [rsp + 0x2c], 0x4f404f0a
mov dword [rsp + 0x30], 0x4f484f48
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.1800580f0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800adc10
add rsp, 0x130
pop rbp
ret

Function at 0x180047f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800eed70]
lea rcx, [rsp + 0x20]
lea edx, [rax + 8]
mov r9d, 0x7210
mov dword [rsp + 0x20], 0x72427240
mov dword [rsp + 0x24], 0x7242724f
mov dword [rsp + 0x28], 0x72717275
mov qword [rsp + 0x2c], 0x72107274
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.1800580f0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800adc10
add rsp, 0x130
pop rbp
ret
Function at 0x180048920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x5f1d
lea r8, [0x1800eedb8]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x5f6e5f4a
mov dword [rsp + 0x24], 0x5f425f2f
mov dword [rsp + 0x28], 0x5f2f5f2e
mov dword [rsp + 0x2c], 0x5f795f33
mov dword [rsp + 0x30], 0x5f715f71
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.1800580f0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800adc10
add rsp, 0x130
pop rbp
ret

Function at 0x180048c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800eedf8]
lea rcx, [rsp + 0x20]
lea edx, [rax + 8]
mov r9d, 0x4c2a
mov dword [rsp + 0x20], 0x4c794c7d
mov dword [rsp + 0x24], 0x4c794c6b
mov dword [rsp + 0x28], 0x4c444c4f
mov qword [rsp + 0x2c], 0x4c2a4c4e
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.1800580f0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800adc10
add rsp, 0x130
pop rbp
ret
Function at 0x1800491e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800eee80]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xc]
mov r9d, 0x2644
mov dword [rsp + 0x20], 0x26282627
mov dword [rsp + 0x24], 0x2637262b
mov dword [rsp + 0x28], 0x26372621
mov dword [rsp + 0x2c], 0x2627262b
mov dword [rsp + 0x30], 0x2621262f
mov qword [rsp + 0x34], 0x26442630
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.1800580f0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800adc10
add rsp, 0x130
pop rbp
ret
Function at 0x180058220
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov edi, ecx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
xor eax, eax
mov qword [r11 - 0x44], rax
mov qword [r11 - 0x3c], rax
mov qword [r11 - 0x34], rax
mov qword [r11 - 0x2c], rax
mov qword [r11 - 0x24], rax
mov dword [rsp + 0x6c], eax
lea rcx, [r11 - 0x48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x40], bx
jne 0x180058284
xor al, al
jmp 0x180058307
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov r8d, edi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180073b70
nop
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1800582bf
mov rbx, qword [rax]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x28], 0
sete sil
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x180058303
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
jne 0x180058303
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock dec dword [rbx + 0xc]
jne 0x180058303
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 8]
movzx eax, sil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800adc10
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret