joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002b28
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov r9, rdx
mov word [rbp - 0x33], 0x7274
xor edx, edx
mov dword [rbp - 0x38], 0x20657479
mov byte [rbp - 0x31], dl
mov byte [rbp - 0x39], 0x62
mov byte [rbp - 0x34], 0x70
mov word [rbp - 0x46], 0x2064
mov word [rbp - 0x43], 0x7274
mov byte [rbp - 0x44], 0x70
mov byte [rbp - 0x41], dl
mov word [rbp - 0x48], 0x726f
mov byte [rbp - 0x49], 0x77
mov dword [rbp - 7], 0x2064726f
mov word [rbp - 2], 0x7274
mov byte [rbp], dl
mov word [rbp - 9], 0x7764
mov byte [rbp - 3], 0x70
mov dword [rbp + 0xe], 0x727470
mov word [rbp + 0xb], 0x6574
mov word [rbp + 8], 0x625f
mov byte [rbp + 0xd], 0x20
mov byte [rbp + 7], 0x36
mov byte [rbp + 0xa], 0x79
mov word [rbp - 0x13], 0x7470
mov word [rbp - 0x16], 0x6472
mov word [rbp - 0x19], 0x7771
mov word [rbp - 0x11], 0x72
mov byte [rbp - 0x14], 0x20
mov byte [rbp - 0x17], 0x6f
mov dword [rbp + 0x3a], 0x65747962
mov dword [rbp + 0x3e], 0x72747020
mov word [rbp + 0x38], 0x5f30
mov byte [rbp + 0x42], dl
mov byte [rbp + 0x37], 0x31
mov word [rbp + 0x2d], 0x2044
mov dword [rbp + 0x27], 0x41564e49
mov word [rbp + 0x30], 0x5254
mov byte [rbp + 0x32], dl
mov word [rbp + 0x2b], 0x494c
mov byte [rbp + 0x2f], 0x50
mov dword [rbp + 0x1d], 0x54502044
mov dword [rbp + 0x17], 0x41564e49
mov word [rbp + 0x1b], 0x494c
mov word [rbp + 0x21], 0x52
mov dword [rbp - 0x23], 0x727470
mov word [rbp - 0x28], 0x6f77
mov word [rbp - 0x25], 0x2064
mov byte [rbp - 0x29], 0x6f
mov byte [rbp - 0x26], 0x72
test ecx, ecx
je 0x180002ca3
sub ecx, 1
je 0x180002c9d
sub ecx, 1
je 0x180002c97
sub ecx, 1
je 0x180002c91
sub ecx, 1
je 0x180002c8b
sub ecx, 1
je 0x180002c85
sub ecx, 1
je 0x180002c7f
sub ecx, 1
je 0x180002c79
cmp ecx, 1
jne 0x180002cb4
lea r8, [rbp - 0x29]
jmp 0x180002ca7
lea r8, [rbp + 0x17]
jmp 0x180002ca7
lea r8, [rbp + 0x27]
jmp 0x180002ca7
lea r8, [rbp + 0x37]
jmp 0x180002ca7
lea r8, [rbp - 0x19]
jmp 0x180002ca7
lea r8, [rbp + 7]
jmp 0x180002ca7
lea r8, [rbp - 9]
jmp 0x180002ca7
lea r8, [rbp - 0x49]
jmp 0x180002ca7
lea r8, [rbp - 0x39]
mov edx, 0x104
mov rcx, r9
call fcn.18000fe30
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0xc0
pop rbp
ret
Function at 0x180002cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 8], rax
mov r9, rdx
mov word [rbp - 0x1b], 0x73
xor edx, edx
mov byte [rbp - 0x1c], 0x65
mov word [rbp - 0x20], 0x7363
mov byte [rbp - 0x1e], dl
mov word [rbp - 0x24], 0x7373
mov byte [rbp - 0x22], dl
mov word [rbp - 0x28], 0x7364
mov byte [rbp - 0x26], dl
mov word [rbp - 0x2b], 0x73
mov byte [rbp - 0x2c], 0x66
mov word [rbp - 0x2f], 0x73
mov byte [rbp - 0x30], 0x67
mov word [rbp - 0xd], 0x524f
mov word [rbp - 0x10], 0x5245
mov byte [rbp - 0xe], 0x52
mov byte [rbp - 0xb], dl
mov dword [rbp - 0x16], 0x524f52
mov word [rbp - 0x18], 0x5245
test ecx, ecx
je 0x180002d96
sub ecx, 1
je 0x180002d90
sub ecx, 1
je 0x180002d8a
sub ecx, 1
je 0x180002d84
sub ecx, 1
je 0x180002d7e
sub ecx, 1
je 0x180002d78
sub ecx, 1
je 0x180002d72
cmp ecx, 1
jne 0x180002da7
lea r8, [rbp - 0x18]
jmp 0x180002d9a
lea r8, [rbp - 0x10]
jmp 0x180002d9a
lea r8, [rbp - 0x30]
jmp 0x180002d9a
lea r8, [rbp - 0x2c]
jmp 0x180002d9a
lea r8, [rbp - 0x28]
jmp 0x180002d9a
lea r8, [rbp - 0x24]
jmp 0x180002d9a
lea r8, [rbp - 0x20]
jmp 0x180002d9a
lea r8, [rbp - 0x1c]
mov edx, 0x104
mov rcx, r9
call fcn.18000fe30
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x50
pop rbp
ret

Function at 0x180008b18
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x656e7265
mov dword [rbp - 0x17], 0x6c6c64
mov dword [rbp - 0x1b], 0x2e32336c
mov byte [rbp - 0x20], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x40
pop rbp
ret

Function at 0x180008b6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x70617664
mov word [rbp - 0x16], 0x6c6c
mov byte [rbp - 0x20], 0x41
mov dword [rbp - 0x1b], 0x2e323369
mov byte [rbp - 0x14], 0
mov byte [rbp - 0x17], 0x64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x40
pop rbp
ret

Function at 0x180008bc8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x72657355
mov word [rbp - 0x19], 0x6c64
mov word [rbp - 0x1c], 0x3233
mov byte [rbp - 0x1a], 0x2e
mov word [rbp - 0x17], 0x6c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x40
pop rbp
ret
Function at 0x180008c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
mov word [rbp - 0x1a], 0x2e69
mov dword [rbp - 0x20], 0x776c6853
mov word [rbp - 0x17], 0x6c6c
mov word [rbp - 0x1c], 0x7061
mov byte [rbp - 0x15], 0
mov byte [rbp - 0x18], 0x64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x40
pop rbp
ret

Function at 0x180008c7c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov esi, edx
mov dword [rbp - 0x23], 0x53323370
mov edi, ecx
mov dword [rbp - 0x27], 0x6c65686c
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x30], 0x61657243
mov dword [rbp - 0x1e], 0x68737061
mov dword [rbp - 0x2b], 0x6f6f5465
mov word [rbp - 0x19], 0x74
mov byte [rbp - 0x1a], 0x6f
mov byte [rbp - 0x2c], 0x74
mov byte [rbp - 0x1f], 0x6e
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008cf6
mov edx, esi
mov ecx, edi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x180008d1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov dword [rbp - 0x20], 0x65726854
mov rdi, rcx
mov word [rbp - 0x14], 0x74
xor ebx, ebx
mov dword [rbp - 0x1c], 0x32336461
mov word [rbp - 0x17], 0x7269
mov byte [rbp - 0x15], 0x73
mov byte [rbp - 0x18], 0x46
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008d84
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x180008da8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov dword [rbp - 0x18], 0x7478654e
mov byte [rbp - 0x14], bl
mov rsi, rdx
mov rdi, rcx
mov word [rbp - 0x1e], 0x6572
mov word [rbp - 0x1b], 0x3364
mov word [rbp - 0x20], 0x6854
mov byte [rbp - 0x1c], 0x61
mov byte [rbp - 0x19], 0x32
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008e12
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x180008e34
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, qword [rbp + 0x68]
mov r15, r9
mov r13, qword [rbp + 0x70]
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov ebx, 1
call fcn.180008b6c
test rax, rax
je 0x180008eca
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x21], 0x6c615679
mov rcx, rax
mov dword [rbp - 0x28], 0x51676552
mov dword [rbp - 0x1d], 0x78456575
mov word [rbp - 0x24], 0x6575
mov word [rbp - 0x19], 0x41
mov byte [rbp - 0x22], 0x72
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008eca
mov qword [rsp + 0x28], r13
mov r9, r15
mov r8, r14
mov qword [rsp + 0x20], r12
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x180008ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, r8
mov dword [rbp - 0x1b], 0x74736e49
mov rsi, rdx
mov word [rbp - 0x16], 0x6375
mov rdi, rcx
mov word [rbp - 0xf], 0x6361
xor ebx, ebx
mov word [rbp - 0xc], 0x65
mov dword [rbp - 0x13], 0x436e6f69
mov byte [rbp - 0x14], 0x74
mov word [rbp - 0x20], 0x6c46
mov byte [rbp - 0xd], 0x68
mov word [rbp - 0x1d], 0x6873
mov byte [rbp - 0x17], 0x72
mov byte [rbp - 0x1e], 0x75
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008f77
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x18000903c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov dword [rbp - 0x12], 0x41656d61
mov byte [rbp - 0xe], bl
mov r14d, r8d
mov rsi, rdx
mov dword [rbp - 0x20], 0x4d746547
mov rdi, rcx
mov dword [rbp - 0x1a], 0x46656c75
mov dword [rbp - 0x16], 0x4e656c69
mov word [rbp - 0x1c], 0x646f
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800090ac
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800090cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, qword [rbp + 0x60]
mov r15d, r9d
mov r14d, r8d
mov rsi, rdx
mov rdi, rcx
mov ebx, 1
call fcn.180008b6c
test rax, rax
je 0x180009154
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1b], 0x6e65
mov rcx, rax
mov dword [rbp - 0x18], 0x78457965
mov dword [rbp - 0x1f], 0x704f6765
mov word [rbp - 0x14], 0x41
mov byte [rbp - 0x19], 0x4b
mov byte [rbp - 0x20], 0x52
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009154
mov r9d, r15d
mov qword [rsp + 0x20], r12
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x180009178
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov ebx, 1
call fcn.180008b6c
test rax, rax
je 0x1800091df
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x6c436765
mov rcx, rax
mov dword [rbp - 0x19], 0x79654b65
mov byte [rbp - 0x15], 0
mov byte [rbp - 0x20], 0x52
mov word [rbp - 0x1b], 0x736f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800091df
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x180009204
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov dword [rbp - 0x30], 0x74696e49
mov dword [rbp - 0x1c], 0x6f697463
mov dword [rbp - 0x26], 0x74697243
mov word [rbp - 0x29], 0x7a69
mov word [rbp - 0x2c], 0x6169
mov word [rbp - 0x18], 0x6e
mov dword [rbp - 0x20], 0x65536c61
mov byte [rbp - 0x27], 0x65
mov word [rbp - 0x22], 0x6369
mov byte [rbp - 0x2a], 0x6c
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000927a
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180009298
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov dword [rbp - 0x20], 0x75736552
or ebx, 0xffffffff
mov dword [rbp - 0x1c], 0x6854656d
mov dword [rbp - 0x18], 0x64616572
mov byte [rbp - 0x14], 0
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800092f5
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x18000931c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, r8
mov dword [rbp - 0x1e], 0x72685474
mov esi, edx
mov word [rbp - 0xe], 0x746e
mov rdi, rcx
mov dword [rbp - 0x17], 0x656c6553
xor ebx, ebx
mov word [rbp - 0xb], 0x79
mov word [rbp - 0x1a], 0x6165
mov dword [rbp - 0x12], 0x45726f74
mov word [rbp - 0x20], 0x6547
mov byte [rbp - 0x18], 0x64
mov byte [rbp - 0xc], 0x72
mov byte [rbp - 0x13], 0x63
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000939e
mov r8, r14
mov edx, esi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1800093c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, qword [rbp + 0x60]
mov r15d, r9d
mov r14, r8
mov dword [rbp - 0x1c], 0x506c6175
mov rsi, rdx
mov dword [rbp - 0x20], 0x74726956
mov rdi, rcx
mov dword [rbp - 0x17], 0x6365746f
xor ebx, ebx
mov byte [rbp - 0x18], 0x72
mov dword [rbp - 0x13], 0x784574
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000943e
mov r9d, r15d
mov qword [rsp + 0x20], r12
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180009464
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov dword [rbp - 0x20], 0x54746547
mov byte [rbp - 0x10], bl
mov rsi, rdx
mov rdi, rcx
mov word [rbp - 0x14], 0x6574
mov word [rbp - 0x1a], 0x6165
mov word [rbp - 0x17], 0x6f43
mov word [rbp - 0x12], 0x7478
mov byte [rbp - 0x15], 0x6e
mov word [rbp - 0x1c], 0x7268
mov byte [rbp - 0x18], 0x64
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800094da
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800094fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14d, r8d
mov word [rbp - 0x17], 0x64
mov esi, edx
mov word [rbp - 0x1a], 0x6572
mov edi, ecx
mov word [rbp - 0x1d], 0x546e
xor ebx, ebx
mov word [rbp - 0x20], 0x704f
mov byte [rbp - 0x1b], 0x68
mov byte [rbp - 0x18], 0x61
mov byte [rbp - 0x1e], 0x65
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009568
mov r8d, r14d
mov edx, esi
mov ecx, edi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x180009588
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov dword [rbp - 0x18], 0x666e496d
mov dword [rbp - 0x1c], 0x65747379
mov word [rbp - 0x14], 0x6f
mov dword [rbp - 0x20], 0x53746547
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800095dd
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x1800095fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov word [rbp - 0x15], 0x6f69
mov byte [rbp - 0xf], bl
mov esi, edx
mov rdi, rcx
mov dword [rbp - 0x13], 0x79746972
mov dword [rbp - 0x1a], 0x50646165
mov dword [rbp - 0x1e], 0x72685474
mov word [rbp - 0x20], 0x6553
mov byte [rbp - 0x16], 0x72
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009668
mov edx, esi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000968c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14d, r8d
mov dword [rbp - 0x1a], 0x6572466c
mov rsi, rdx
mov dword [rbp - 0x20], 0x74726956
mov rdi, rcx
mov word [rbp - 0x1c], 0x6175
xor ebx, ebx
mov word [rbp - 0x16], 0x65
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800096f1
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x180009710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov dword [rbp - 0x1a], 0x746e6572
mov dword [rbp - 0x1f], 0x75437465
mov word [rbp - 0x11], 0x64
mov dword [rbp - 0x16], 0x65726854
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x1b], 0x72
mov byte [rbp - 0x12], 0x61
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009770
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000bcc0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x180009790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, r8
mov word [rbp - 0x20], 0x6956
mov rsi, rdx
mov dword [rbp - 0x1d], 0x6c617574
mov rdi, rcx
mov dword [rbp - 0x17], 0x797265
xor ebx, ebx
mov word [rbp - 0x19], 0x7551
mov byte [rbp - 0x1e], 0x72
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800097fa
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1800098ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov rax, qword [0x180054ec0]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r15d, r9d
mov word [rbp - 0x20], 0x6c6c
mov r14d, r8d
mov dword [rbp - 0x25], 0x6c617574
mov rsi, rdx
mov word [rbp - 0x27], 0x7269
mov rdi, rcx
mov word [rbp - 0x1d], 0x63
xor ebx, ebx
mov byte [rbp - 0x1e], 0x6f
mov byte [rbp - 0x28], 0x56
mov byte [rbp - 0x21], 0x41
call fcn.180008b18
mov rcx, rax
lea rdx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009925
mov r9d, r15d
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.18000bcc0
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret