joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180147168
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a638]
mov rbx, rdx
test rax, rax
jne 0x180147219
mov dword [rbp - 0x50], 0x3f
xor edx, edx
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x56
mov byte [rbp - 0x4a], 0x4d
mov byte [rbp - 0x49], 0x4b
mov byte [rbp - 0x48], 0x4a
mov byte [rbp - 0x47], 0x5e
mov byte [rbp - 0x46], 0x53
mov byte [rbp - 0x45], 0x6e
mov byte [rbp - 0x44], 0x4a
mov byte [rbp - 0x43], 0x5a
mov byte [rbp - 0x42], 0x4d
mov byte [rbp - 0x41], 0x46
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1801471c7
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a638], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a638]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180147242
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18014726e
cmp dword [rbp - 0x18], 0x10000
je 0x18014726e
cmp qword [rbp - 0x20], 0x1000
jb 0x18014726e
cmp dword [rbp - 0x10], 0x1000000
je 0x18014726a
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180147270
mov al, 1
jmp 0x180147270
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1801489b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a548]
mov rbx, rdx
test rax, rax
jne 0x180148a61
mov dword [rbp - 0x50], 0x3f
xor edx, edx
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x56
mov byte [rbp - 0x4a], 0x4d
mov byte [rbp - 0x49], 0x4b
mov byte [rbp - 0x48], 0x4a
mov byte [rbp - 0x47], 0x5e
mov byte [rbp - 0x46], 0x53
mov byte [rbp - 0x45], 0x6e
mov byte [rbp - 0x44], 0x4a
mov byte [rbp - 0x43], 0x5a
mov byte [rbp - 0x42], 0x4d
mov byte [rbp - 0x41], 0x46
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180148a0f
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a548], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a548]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180148a8a
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180148ab6
cmp dword [rbp - 0x18], 0x10000
je 0x180148ab6
cmp qword [rbp - 0x20], 0x1000
jb 0x180148ab6
cmp dword [rbp - 0x10], 0x1000000
je 0x180148ab2
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180148ab8
mov al, 1
jmp 0x180148ab8
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18014a1f8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a678]
mov rbx, rdx
test rax, rax
jne 0x18014a2a9
mov dword [rbp - 0x50], 0x3f
xor edx, edx
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x56
mov byte [rbp - 0x4a], 0x4d
mov byte [rbp - 0x49], 0x4b
mov byte [rbp - 0x48], 0x4a
mov byte [rbp - 0x47], 0x5e
mov byte [rbp - 0x46], 0x53
mov byte [rbp - 0x45], 0x6e
mov byte [rbp - 0x44], 0x4a
mov byte [rbp - 0x43], 0x5a
mov byte [rbp - 0x42], 0x4d
mov byte [rbp - 0x41], 0x46
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18014a257
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a678], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a678]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18014a2d2
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18014a2fe
cmp dword [rbp - 0x18], 0x10000
je 0x18014a2fe
cmp qword [rbp - 0x20], 0x1000
jb 0x18014a2fe
cmp dword [rbp - 0x10], 0x1000000
je 0x18014a2fa
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18014a300
mov al, 1
jmp 0x18014a300
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18014ba40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a658]
mov rbx, rdx
test rax, rax
jne 0x18014baf1
mov dword [rbp - 0x50], 0x3f
xor edx, edx
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x56
mov byte [rbp - 0x4a], 0x4d
mov byte [rbp - 0x49], 0x4b
mov byte [rbp - 0x48], 0x4a
mov byte [rbp - 0x47], 0x5e
mov byte [rbp - 0x46], 0x53
mov byte [rbp - 0x45], 0x6e
mov byte [rbp - 0x44], 0x4a
mov byte [rbp - 0x43], 0x5a
mov byte [rbp - 0x42], 0x4d
mov byte [rbp - 0x41], 0x46
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18014ba9f
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a658], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a658]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18014bb1a
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18014bb46
cmp dword [rbp - 0x18], 0x10000
je 0x18014bb46
cmp qword [rbp - 0x20], 0x1000
jb 0x18014bb46
cmp dword [rbp - 0x10], 0x1000000
je 0x18014bb42
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18014bb48
mov al, 1
jmp 0x18014bb48
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18014cc40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a6a0]
mov rbx, rdx
test rax, rax
jne 0x18014ccf1
mov dword [rbp - 0x50], 0x3f
xor edx, edx
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x56
mov byte [rbp - 0x4a], 0x4d
mov byte [rbp - 0x49], 0x4b
mov byte [rbp - 0x48], 0x4a
mov byte [rbp - 0x47], 0x5e
mov byte [rbp - 0x46], 0x53
mov byte [rbp - 0x45], 0x6e
mov byte [rbp - 0x44], 0x4a
mov byte [rbp - 0x43], 0x5a
mov byte [rbp - 0x42], 0x4d
mov byte [rbp - 0x41], 0x46
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18014cc9f
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a6a0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a6a0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18014cd1a
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18014cd46
cmp dword [rbp - 0x18], 0x10000
je 0x18014cd46
cmp qword [rbp - 0x20], 0x1000
jb 0x18014cd46
cmp dword [rbp - 0x10], 0x1000000
je 0x18014cd42
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18014cd48
mov al, 1
jmp 0x18014cd48
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18014e568
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a540]
mov rbx, rdx
test rax, rax
jne 0x18014e619
mov dword [rbp - 0x50], 0x3f
xor edx, edx
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x56
mov byte [rbp - 0x4a], 0x4d
mov byte [rbp - 0x49], 0x4b
mov byte [rbp - 0x48], 0x4a
mov byte [rbp - 0x47], 0x5e
mov byte [rbp - 0x46], 0x53
mov byte [rbp - 0x45], 0x6e
mov byte [rbp - 0x44], 0x4a
mov byte [rbp - 0x43], 0x5a
mov byte [rbp - 0x42], 0x4d
mov byte [rbp - 0x41], 0x46
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18014e5c7
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a540], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a540]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18014e642
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18014e66e
cmp dword [rbp - 0x18], 0x10000
je 0x18014e66e
cmp qword [rbp - 0x20], 0x1000
jb 0x18014e66e
cmp dword [rbp - 0x10], 0x1000000
je 0x18014e66a
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18014e670
mov al, 1
jmp 0x18014e670
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18014fdb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a6b8]
mov rbx, rdx
test rax, rax
jne 0x18014fe61
mov dword [rbp - 0x50], 0x3f
xor edx, edx
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x56
mov byte [rbp - 0x4a], 0x4d
mov byte [rbp - 0x49], 0x4b
mov byte [rbp - 0x48], 0x4a
mov byte [rbp - 0x47], 0x5e
mov byte [rbp - 0x46], 0x53
mov byte [rbp - 0x45], 0x6e
mov byte [rbp - 0x44], 0x4a
mov byte [rbp - 0x43], 0x5a
mov byte [rbp - 0x42], 0x4d
mov byte [rbp - 0x41], 0x46
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18014fe0f
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a6b8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a6b8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18014fe8a
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18014feb6
cmp dword [rbp - 0x18], 0x10000
je 0x18014feb6
cmp qword [rbp - 0x20], 0x1000
jb 0x18014feb6
cmp dword [rbp - 0x10], 0x1000000
je 0x18014feb2
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18014feb8
mov al, 1
jmp 0x18014feb8
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1801515f8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a618]
mov rbx, rdx
test rax, rax
jne 0x1801516a9
mov dword [rbp - 0x50], 0x3f
xor edx, edx
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x56
mov byte [rbp - 0x4a], 0x4d
mov byte [rbp - 0x49], 0x4b
mov byte [rbp - 0x48], 0x4a
mov byte [rbp - 0x47], 0x5e
mov byte [rbp - 0x46], 0x53
mov byte [rbp - 0x45], 0x6e
mov byte [rbp - 0x44], 0x4a
mov byte [rbp - 0x43], 0x5a
mov byte [rbp - 0x42], 0x4d
mov byte [rbp - 0x41], 0x46
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180151657
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a618], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a618]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1801516d2
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801516fe
cmp dword [rbp - 0x18], 0x10000
je 0x1801516fe
cmp qword [rbp - 0x20], 0x1000
jb 0x1801516fe
cmp dword [rbp - 0x10], 0x1000000
je 0x1801516fa
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180151700
mov al, 1
jmp 0x180151700
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180152e40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a600]
mov rbx, rdx
test rax, rax
jne 0x180152ef1
mov dword [rbp - 0x50], 0x3f
xor edx, edx
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x56
mov byte [rbp - 0x4a], 0x4d
mov byte [rbp - 0x49], 0x4b
mov byte [rbp - 0x48], 0x4a
mov byte [rbp - 0x47], 0x5e
mov byte [rbp - 0x46], 0x53
mov byte [rbp - 0x45], 0x6e
mov byte [rbp - 0x44], 0x4a
mov byte [rbp - 0x43], 0x5a
mov byte [rbp - 0x42], 0x4d
mov byte [rbp - 0x41], 0x46
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180152e9f
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a600], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a600]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180152f1a
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180152f46
cmp dword [rbp - 0x18], 0x10000
je 0x180152f46
cmp qword [rbp - 0x20], 0x1000
jb 0x180152f46
cmp dword [rbp - 0x10], 0x1000000
je 0x180152f42
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180152f48
mov al, 1
jmp 0x180152f48
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1801534a4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a570]
mov rbx, rdx
test rax, rax
jne 0x180153555
mov dword [rbp - 0x50], 0x3f
xor edx, edx
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x56
mov byte [rbp - 0x4a], 0x4d
mov byte [rbp - 0x49], 0x4b
mov byte [rbp - 0x48], 0x4a
mov byte [rbp - 0x47], 0x5e
mov byte [rbp - 0x46], 0x53
mov byte [rbp - 0x45], 0x6e
mov byte [rbp - 0x44], 0x4a
mov byte [rbp - 0x43], 0x5a
mov byte [rbp - 0x42], 0x4d
mov byte [rbp - 0x41], 0x46
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180153503
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a570], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a570]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18015357e
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801535aa
cmp dword [rbp - 0x18], 0x10000
je 0x1801535aa
cmp qword [rbp - 0x20], 0x1000
jb 0x1801535aa
cmp dword [rbp - 0x10], 0x1000000
je 0x1801535a6
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x1801535ac
mov al, 1
jmp 0x1801535ac
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180153b08
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a660]
mov rbx, rdx
test rax, rax
jne 0x180153bb9
mov dword [rbp - 0x50], 0x3f
xor edx, edx
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x56
mov byte [rbp - 0x4a], 0x4d
mov byte [rbp - 0x49], 0x4b
mov byte [rbp - 0x48], 0x4a
mov byte [rbp - 0x47], 0x5e
mov byte [rbp - 0x46], 0x53
mov byte [rbp - 0x45], 0x6e
mov byte [rbp - 0x44], 0x4a
mov byte [rbp - 0x43], 0x5a
mov byte [rbp - 0x42], 0x4d
mov byte [rbp - 0x41], 0x46
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180153b67
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a660], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a660]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180153be2
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180153c0e
cmp dword [rbp - 0x18], 0x10000
je 0x180153c0e
cmp qword [rbp - 0x20], 0x1000
jb 0x180153c0e
cmp dword [rbp - 0x10], 0x1000000
je 0x180153c0a
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180153c10
mov al, 1
jmp 0x180153c10
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180155350
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a698]
mov rbx, rdx
test rax, rax
jne 0x180155401
mov dword [rbp - 0x50], 0x3f
xor edx, edx
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x56
mov byte [rbp - 0x4a], 0x4d
mov byte [rbp - 0x49], 0x4b
mov byte [rbp - 0x48], 0x4a
mov byte [rbp - 0x47], 0x5e
mov byte [rbp - 0x46], 0x53
mov byte [rbp - 0x45], 0x6e
mov byte [rbp - 0x44], 0x4a
mov byte [rbp - 0x43], 0x5a
mov byte [rbp - 0x42], 0x4d
mov byte [rbp - 0x41], 0x46
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1801553af
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a698], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a698]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18015542a
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180155456
cmp dword [rbp - 0x18], 0x10000
je 0x180155456
cmp qword [rbp - 0x20], 0x1000
jb 0x180155456
cmp dword [rbp - 0x10], 0x1000000
je 0x180155452
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180155458
mov al, 1
jmp 0x180155458
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180156b98
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a598]
mov rbx, rdx
test rax, rax
jne 0x180156c49
mov dword [rbp - 0x50], 0x3f
xor edx, edx
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x56
mov byte [rbp - 0x4a], 0x4d
mov byte [rbp - 0x49], 0x4b
mov byte [rbp - 0x48], 0x4a
mov byte [rbp - 0x47], 0x5e
mov byte [rbp - 0x46], 0x53
mov byte [rbp - 0x45], 0x6e
mov byte [rbp - 0x44], 0x4a
mov byte [rbp - 0x43], 0x5a
mov byte [rbp - 0x42], 0x4d
mov byte [rbp - 0x41], 0x46
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180156bf7
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a598], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a598]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180156c72
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180156c9e
cmp dword [rbp - 0x18], 0x10000
je 0x180156c9e
cmp qword [rbp - 0x20], 0x1000
jb 0x180156c9e
cmp dword [rbp - 0x10], 0x1000000
je 0x180156c9a
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180156ca0
mov al, 1
jmp 0x180156ca0
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1401316d1
Capabilities:
Execute syscall
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
retf 0x820f
add bh, al
call 0x1532724dd
lea r9d, [rbx - 0x725b]
xor r8d, 0x3eb88a95
call rcx
mul r15
jmp 0x1401319da
jo 0x1401308b5
cmp rbp, rcx
lea r10d, [rdx - 0xf9d7]
jne 0x140131493
je 0x140131493
jmp 0x1401313a4
cmp rsi, rbx
jne 0x14013170d
je 0x14013170d
ror ecx, 0xeb
add esi, 0xd0322bef
lea r14d, [rbp - 0x6783]
neg r13
sub edx, 0x72a5fa7d
jns 0x140131d7b
cmp r14, rcx
cpuid
jmp rcx
jmp 0x14013144f
rcr r9d, 0xd7
ror r11d, 0xc6
nop
jb 0x14013105d
jmp 0x1401317da
sbb bh, bh
inc dword [rcx - 0x3f]
rcl byte [rcx], 0x48
mov esi, 0x1abe9
add ah, ah
sub al, 0x9d
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004c3d70]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x004c3d80]
mov dword [rax], 1
mov rax, qword [0x004c3d90]
mov dword [rax], 1
mov rax, qword [0x004c3d60]
mov dword [rax], 1
mov rax, qword [0x004c3c30]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010c0
mov rax, qword [0x004c3d50]
mov dword [0x004eb00c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x4010b0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x004c3d10]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004c3070]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067

Function at 0x4015b9
Capabilities:
Manipulate console buffer

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov dword [rbp + 0x18], edx
mov ecx, 0xfffffff5
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
call rax
mov qword [rbp - 8], rax
mov eax, dword [rbp + 0x10]
mov word [rbp - 0xc], ax
mov eax, dword [rbp + 0x18]
mov word [rbp - 0xa], ax
mov edx, dword [rbp - 0xc]
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
call rax
nop
add rsp, 0x30
pop rbp
ret