joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180108d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x180271460]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [str.qrstuvwxyz:.___0123456789__]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [0x180271420]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x1802713f0]
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmm0, xmmword [0x1802713d0]
movdqa xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], 0x7e235f2d
mov dword [rbp + 0x64], 0x5b29285c
mov dword [rbp + 0x68], 0x247d7b5d
mov word [rbp + 0x6c], 0x2260
mov byte [rbp + 0x6e], 0x3b
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
xor r8d, r8d
lea rdx, [0x1802074d5]
call fcn.18003bfd0
mov dword [rsp + 0x20], 1
movdqa xmm0, xmmword [0x180270ff0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180271210]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x180271170]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x180270f00]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x180270d40]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x180270db0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x180270ec0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x180271200]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x180270d00]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x180270cc0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x180270cd0]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x180270fd0]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x1802710b0]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x180270fe0]
movdqa xmmword [rbp], xmm1
lea rsi, [rsp + 0x30]
movsxd rcx, dword [rsi]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
test ecx, ecx
jne 0x180108f4f
cmp rax, rdx
jae 0x180108f11
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x180108f09
mov rcx, qword [rbx]
mov word [rcx + rax], 0x20
jmp 0x180108f1c
mov r9b, 0x20
mov rcx, rbx
call fcn.18003bca0
inc edi
add rsi, 4
cmp edi, 0x38
jb 0x180108ee1
mov rax, rbx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movzx r9d, byte [rbp + rcx + 0xf]
cmp rax, rdx
jae 0x180108f14
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x180108f6e
mov rcx, qword [rbx]
mov byte [rcx + rax], r9b
mov byte [rcx + rax + 1], 0
jmp 0x180108f1c
Function at 0x18010a250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x180271460]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [str.qrstuvwxyz:.___0123456789__]
movdqa xmmword [rbp], xmm1
movdqa xmm0, xmmword [0x180271420]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1802713f0]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [0x1802713d0]
movdqa xmmword [rbp + 0x30], xmm0
mov dword [rbp + 0x40], 0x7e235f2d
mov dword [rbp + 0x44], 0x5b29285c
mov dword [rbp + 0x48], 0x247d7b5d
mov word [rbp + 0x4c], 0x2260
mov byte [rbp + 0x4e], 0x3b
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
xor r8d, r8d
lea rdx, [0x1802074d5]
call fcn.18003bfd0
mov dword [rsp + 0x20], 1
movdqa xmm0, xmmword [0x180270ff0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180271210]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x180271170]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x180270f00]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x180270d40]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x180270db0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x180270ec0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x180271200]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x1802710f0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x180271180]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x180271030]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 8
mov dword [rbp - 0x1c], 0x10
lea rsi, [rsp + 0x30]
nop dword [rax + rax]
movsxd rcx, dword [rsi]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
test ecx, ecx
jne 0x18010a42e
cmp rax, rdx
jae 0x18010a3f0
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18010a3e8
mov rcx, qword [rbx]
mov word [rcx + rax], 0x20
jmp 0x18010a3fb
mov r9b, 0x20
mov rcx, rbx
call fcn.18003bca0
inc edi
add rsi, 4
cmp edi, 0x2e
jb 0x18010a3c0
mov rax, rbx
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movzx r9d, byte [rbp + rcx - 0x11]
cmp rax, rdx
jae 0x18010a3f3
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18010a44d
mov rcx, qword [rbx]
mov byte [rcx + rax], r9b
mov byte [rcx + rax + 1], 0
jmp 0x18010a3fb
Function at 0x18010a460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x180271460]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [str.qrstuvwxyz:.___0123456789__]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [0x180271420]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x1802713f0]
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmm0, xmmword [0x1802713d0]
movdqa xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], 0x7e235f2d
mov dword [rbp + 0x64], 0x5b29285c
mov dword [rbp + 0x68], 0x247d7b5d
mov word [rbp + 0x6c], 0x2260
mov byte [rbp + 0x6e], 0x3b
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
xor r8d, r8d
lea rdx, [0x1802074d5]
call fcn.18003bfd0
mov dword [rsp + 0x20], 1
movdqa xmm0, xmmword [0x180270ff0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180271210]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x180271170]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x180270f00]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x180270d40]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x180270db0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x180270ec0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x180271200]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x1802710f0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x180271180]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x180271080]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x180271140]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x180270e50]
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rbp], 0x10
lea rsi, [rsp + 0x30]
nop dword [rax + rax]
movsxd rcx, dword [rsi]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
test ecx, ecx
jne 0x18010a64e
cmp rax, rdx
jae 0x18010a610
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18010a608
mov rcx, qword [rbx]
mov word [rcx + rax], 0x20
jmp 0x18010a61b
mov r9b, 0x20
mov rcx, rbx
call fcn.18003bca0
inc edi
add rsi, 4
cmp edi, 0x35
jb 0x18010a5e0
mov rax, rbx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movzx r9d, byte [rbp + rcx + 0xf]
cmp rax, rdx
jae 0x18010a613
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18010a66d
mov rcx, qword [rbx]
mov byte [rcx + rax], r9b
mov byte [rcx + rax + 1], 0
jmp 0x18010a61b
Function at 0x18010a680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x180271460]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [str.qrstuvwxyz:.___0123456789__]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [0x180271420]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x1802713f0]
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [0x1802713d0]
movdqa xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x50], 0x7e235f2d
mov dword [rbp + 0x54], 0x5b29285c
mov dword [rbp + 0x58], 0x247d7b5d
mov word [rbp + 0x5c], 0x2260
mov byte [rbp + 0x5e], 0x3b
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
xor r8d, r8d
lea rdx, [0x1802074d5]
call fcn.18003bfd0
mov dword [rsp + 0x20], 1
movdqa xmm0, xmmword [0x180270ff0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180271210]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x180271170]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x180270f00]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x180270d40]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x180270db0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x180270ec0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x180271200]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x180270d00]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x180270eb0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x180270fc0]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1802711c0]
movdqa xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0x10
mov dword [rbp - 0xc], 8
mov dword [rbp - 8], 0x10
lea rsi, [rsp + 0x30]
nop dword [rax]
movsxd rcx, dword [rsi]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
test ecx, ecx
jne 0x18010a86e
cmp rax, rdx
jae 0x18010a830
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18010a828
mov rcx, qword [rbx]
mov word [rcx + rax], 0x20
jmp 0x18010a83b
mov r9b, 0x20
mov rcx, rbx
call fcn.18003bca0
inc edi
add rsi, 4
cmp edi, 0x33
jb 0x18010a800
mov rax, rbx
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movzx r9d, byte [rbp + rcx - 1]
cmp rax, rdx
jae 0x18010a833
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18010a88d
mov rcx, qword [rbx]
mov byte [rcx + rax], r9b
mov byte [rcx + rax + 1], 0
jmp 0x18010a83b
Function at 0x18010a8a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x180271460]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [str.qrstuvwxyz:.___0123456789__]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [0x180271420]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x1802713f0]
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmm0, xmmword [0x1802713d0]
movdqa xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], 0x7e235f2d
mov dword [rbp + 0x64], 0x5b29285c
mov dword [rbp + 0x68], 0x247d7b5d
mov word [rbp + 0x6c], 0x2260
mov byte [rbp + 0x6e], 0x3b
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
xor r8d, r8d
lea rdx, [0x1802074d5]
call fcn.18003bfd0
mov dword [rsp + 0x20], 1
movdqa xmm0, xmmword [0x180270ff0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180271210]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x180271170]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x180270f00]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x180270d40]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x180270db0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x180270ec0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x180271200]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x180270d00]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x180271160]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x180270d90]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x180271090]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x180271040]
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rbp], 8
mov dword [rbp + 4], 0x10
lea rsi, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movsxd rcx, dword [rsi]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
test ecx, ecx
jne 0x18010aa9e
cmp rax, rdx
jae 0x18010aa60
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18010aa58
mov rcx, qword [rbx]
mov word [rcx + rax], 0x20
jmp 0x18010aa6b
mov r9b, 0x20
mov rcx, rbx
call fcn.18003bca0
inc edi
add rsi, 4
cmp edi, 0x36
jb 0x18010aa30
mov rax, rbx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movzx r9d, byte [rbp + rcx + 0xf]
cmp rax, rdx
jae 0x18010aa63
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18010aabd
mov rcx, qword [rbx]
mov byte [rcx + rax], r9b
mov byte [rcx + rax + 1], 0
jmp 0x18010aa6b
Function at 0x18010b0d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x180271460]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [str.qrstuvwxyz:.___0123456789__]
movdqa xmmword [rbp], xmm1
movdqa xmm0, xmmword [0x180271420]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1802713f0]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [0x1802713d0]
movdqa xmmword [rbp + 0x30], xmm0
mov dword [rbp + 0x40], 0x7e235f2d
mov dword [rbp + 0x44], 0x5b29285c
mov dword [rbp + 0x48], 0x247d7b5d
mov word [rbp + 0x4c], 0x2260
mov byte [rbp + 0x4e], 0x3b
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
xor r8d, r8d
lea rdx, [0x1802074d5]
call fcn.18003bfd0
mov dword [rsp + 0x20], 1
movdqa xmm0, xmmword [0x180270ff0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180271210]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x180271170]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x180270f00]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x180270d40]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x180270db0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x180270ec0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x180271200]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x1802710f0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x180270f70]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x1802711d0]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x10
mov dword [rbp - 0x1c], 8
mov dword [rbp - 0x18], 0x10
lea rsi, [rsp + 0x30]
nop
movsxd rcx, dword [rsi]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
test ecx, ecx
jne 0x18010b2ae
cmp rax, rdx
jae 0x18010b270
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18010b268
mov rcx, qword [rbx]
mov word [rcx + rax], 0x20
jmp 0x18010b27b
mov r9b, 0x20
mov rcx, rbx
call fcn.18003bca0
inc edi
add rsi, 4
cmp edi, 0x2f
jb 0x18010b240
mov rax, rbx
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movzx r9d, byte [rbp + rcx - 0x11]
cmp rax, rdx
jae 0x18010b273
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18010b2cd
mov rcx, qword [rbx]
mov byte [rcx + rax], r9b
mov byte [rcx + rax + 1], 0
jmp 0x18010b27b
Function at 0x18010b420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x180271460]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [str.qrstuvwxyz:.___0123456789__]
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmm0, xmmword [0x180271420]
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [0x1802713f0]
movdqa xmmword [rbp + 0x60], xmm1
movdqa xmm0, xmmword [0x1802713d0]
movdqa xmmword [rbp + 0x70], xmm0
mov dword [rbp + 0x80], 0x7e235f2d
mov dword [rbp + 0x84], 0x5b29285c
mov dword [rbp + 0x88], 0x247d7b5d
mov word [rbp + 0x8c], 0x2260
mov byte [rbp + 0x8e], 0x3b
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
xor r8d, r8d
lea rdx, [0x1802074d5]
call fcn.18003bfd0
mov dword [rsp + 0x20], 1
movdqa xmm0, xmmword [0x180270ff0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180271210]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x180271170]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x180270f00]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x180270d40]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x180270db0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x180270ec0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x180271200]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x180270d10]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x180271300]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x180270f80]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x180270f30]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x180270f50]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x180270d70]
movdqa xmmword [rbp], xmm1
movdqa xmm0, xmmword [0x180270e30]
movdqa xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x20], 0x10
lea rsi, [rsp + 0x30]
nop word [rax + rax]
movsxd rcx, dword [rsi]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
test ecx, ecx
jne 0x18010b641
cmp rax, rdx
jae 0x18010b600
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18010b5f8
mov rcx, qword [rbx]
mov word [rcx + rax], 0x20
jmp 0x18010b60b
mov r9b, 0x20
mov rcx, rbx
call fcn.18003bca0
inc edi
add rsi, 4
cmp edi, 0x3d
jb 0x18010b5d0
mov rax, rbx
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movzx r9d, byte [rbp + rcx + 0x2f]
cmp rax, rdx
jae 0x18010b603
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18010b660
mov rcx, qword [rbx]
mov byte [rcx + rax], r9b
mov byte [rcx + rax + 1], 0
jmp 0x18010b60b
Function at 0x18010b7b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x180271460]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [str.qrstuvwxyz:.___0123456789__]
movdqa xmmword [rbp], xmm1
movdqa xmm0, xmmword [0x180271420]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1802713f0]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [0x1802713d0]
movdqa xmmword [rbp + 0x30], xmm0
mov dword [rbp + 0x40], 0x7e235f2d
mov dword [rbp + 0x44], 0x5b29285c
mov dword [rbp + 0x48], 0x247d7b5d
mov word [rbp + 0x4c], 0x2260
mov byte [rbp + 0x4e], 0x3b
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
xor r8d, r8d
lea rdx, [0x1802074d5]
call fcn.18003bfd0
mov dword [rsp + 0x20], 1
movdqa xmm0, xmmword [0x180270ff0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180271210]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x180271170]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x180270f00]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x180270d40]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x180270db0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x180270ec0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x180271200]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x180270ce0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x180270cb0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x180271020]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 8
mov dword [rbp - 0x1c], 0x10
lea rsi, [rsp + 0x30]
nop dword [rax + rax]
movsxd rcx, dword [rsi]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
test ecx, ecx
jne 0x18010b98e
cmp rax, rdx
jae 0x18010b950
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18010b948
mov rcx, qword [rbx]
mov word [rcx + rax], 0x20
jmp 0x18010b95b
mov r9b, 0x20
mov rcx, rbx
call fcn.18003bca0
inc edi
add rsi, 4
cmp edi, 0x2e
jb 0x18010b920
mov rax, rbx
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movzx r9d, byte [rbp + rcx - 0x11]
cmp rax, rdx
jae 0x18010b953
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18010b9ad
mov rcx, qword [rbx]
mov byte [rcx + rax], r9b
mov byte [rcx + rax + 1], 0
jmp 0x18010b95b