joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800e15b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e15e9
xor al, al
jmp 0x1800e1797
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e15fe
xor al, al
jmp 0x1800e1797
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf790
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e178b
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800e1787
int3
xor al, al
jmp 0x1800e1797
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e17b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e17e9
xor al, al
jmp 0x1800e1997
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e17fe
xor al, al
jmp 0x1800e1997
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf790
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e198b
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800e1987
int3
xor al, al
jmp 0x1800e1997
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e19b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e19e9
xor al, al
jmp 0x1800e1b97
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e19fe
xor al, al
jmp 0x1800e1b97
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf790
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e1b8b
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800e1b87
int3
xor al, al
jmp 0x1800e1b97
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e1bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e1be9
xor al, al
jmp 0x1800e1d97
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e1bfe
xor al, al
jmp 0x1800e1d97
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf790
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e1d8b
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800e1d87
int3
xor al, al
jmp 0x1800e1d97
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e1db0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e1de9
xor al, al
jmp 0x1800e1f97
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e1dfe
xor al, al
jmp 0x1800e1f97
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf790
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e1f8b
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800e1f87
int3
xor al, al
jmp 0x1800e1f97
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e1fb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e1fe9
xor al, al
jmp 0x1800e2197
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e1ffe
xor al, al
jmp 0x1800e2197
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf790
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e218b
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800e2187
int3
xor al, al
jmp 0x1800e2197
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e21b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e21e9
xor al, al
jmp 0x1800e2397
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e21fe
xor al, al
jmp 0x1800e2397
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf790
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e238b
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800e2387
int3
xor al, al
jmp 0x1800e2397
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e23b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e23e9
xor al, al
jmp 0x1800e2597
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e23fe
xor al, al
jmp 0x1800e2597
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf790
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e258b
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800e2587
int3
xor al, al
jmp 0x1800e2597
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e25b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e25e9
xor al, al
jmp 0x1800e2797
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e25fe
xor al, al
jmp 0x1800e2797
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf790
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e278b
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800e2787
int3
xor al, al
jmp 0x1800e2797
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e27b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e27e9
xor al, al
jmp 0x1800e2997
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e27fe
xor al, al
jmp 0x1800e2997
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf790
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e298b
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800e2987
int3
xor al, al
jmp 0x1800e2997
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret