joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800d4f90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
mov rcx, qword [rbp + 0x120]
call fcn.1800cbc90
mov qword [rbp + 8], rax
mov qword [rbp + 0x28], 0
jmp 0x1800d4fcd
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
cmp qword [rbp + 0x28], rax
jae 0x1800d5021
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
add rcx, rax
mov rax, rcx
movsx rax, byte [rax]
mov rcx, qword [rbp + 0x128]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x128]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
jmp 0x1800d4fc2
mov rax, qword [rbp + 0x128]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1800d58a0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
mov eax, dword [rbp + 0xe8]
and eax, 8
test eax, eax
je 0x1800d58f5
lea rcx, str._client.dll_
call fcn.1800cbc90
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
lea rdx, str._client.dll_
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1800d5931
mov eax, dword [rbp + 0xe8]
and eax, 4
test eax, eax
je 0x1800d5931
lea rcx, str._gamess_dll_
call fcn.1800cbc90
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
lea rdx, str._gamess_dll_
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbp + 0xe8]
and eax, 0x20
test eax, eax
je 0x1800d596d
lea rcx, str._protected_
call fcn.1800cbc90
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
lea rdx, str._protected_
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbp + 0xe8]
and eax, 0x4000
test eax, eax
je 0x1800d59ab
lea rcx, str._cheat_
call fcn.1800cbc90
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
lea rdx, str._cheat_
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbp + 0xe8]
and eax, 0x10
test eax, eax
je 0x1800d59e7
lea rcx, str._hidden_
call fcn.1800cbc90
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
lea rdx, str._hidden_
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbp + 0xe8]
and eax, 2
test eax, eax
je 0x1800d5a23
lea rcx, str._devonly_
call fcn.1800cbc90
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
lea rdx, str._devonly_
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x18023c920]
call fcn.1800cbc90
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
lea rdx, [0x18023c920]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1800dcc10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800dcc52
cmp qword [rbp + 0x1c0], 0
jne 0x1800dcc59
xor al, al
jmp 0x1800dce3c
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0680
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800dce23
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800dce1f
int3
xor al, al
jmp 0x1800dce3c
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e0920
movzx eax, al
test eax, eax
jne 0x1800dce3a
xor al, al
jmp 0x1800dce3c
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800dce60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800dcea2
cmp qword [rbp + 0x1c0], 0
jne 0x1800dcea9
xor al, al
jmp 0x1800dd08c
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0680
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800dd073
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800dd06f
int3
xor al, al
jmp 0x1800dd08c
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e0b20
movzx eax, al
test eax, eax
jne 0x1800dd08a
xor al, al
jmp 0x1800dd08c
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800dd0b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800dd0f2
cmp qword [rbp + 0x1c0], 0
jne 0x1800dd0f9
xor al, al
jmp 0x1800dd2dc
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0680
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800dd2c3
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800dd2bf
int3
xor al, al
jmp 0x1800dd2dc
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e0d20
movzx eax, al
test eax, eax
jne 0x1800dd2da
xor al, al
jmp 0x1800dd2dc
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800dd300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800dd342
cmp qword [rbp + 0x1c0], 0
jne 0x1800dd349
xor al, al
jmp 0x1800dd52c
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0680
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800dd513
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800dd50f
int3
xor al, al
jmp 0x1800dd52c
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e0f20
movzx eax, al
test eax, eax
jne 0x1800dd52a
xor al, al
jmp 0x1800dd52c
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800dd550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800dd592
cmp qword [rbp + 0x1c0], 0
jne 0x1800dd599
xor al, al
jmp 0x1800dd77c
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0680
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800dd763
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800dd75f
int3
xor al, al
jmp 0x1800dd77c
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e1120
movzx eax, al
test eax, eax
jne 0x1800dd77a
xor al, al
jmp 0x1800dd77c
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800dd7a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800dd7e2
cmp qword [rbp + 0x1c0], 0
jne 0x1800dd7e9
xor al, al
jmp 0x1800dd9cc
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0680
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800dd9b3
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800dd9af
int3
xor al, al
jmp 0x1800dd9cc
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e1320
movzx eax, al
test eax, eax
jne 0x1800dd9ca
xor al, al
jmp 0x1800dd9cc
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800dd9f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800dda32
cmp qword [rbp + 0x1c0], 0
jne 0x1800dda39
xor al, al
jmp 0x1800ddc1c
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0680
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800ddc03
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800ddbff
int3
xor al, al
jmp 0x1800ddc1c
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e1520
movzx eax, al
test eax, eax
jne 0x1800ddc1a
xor al, al
jmp 0x1800ddc1c
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800ddc40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800ddc82
cmp qword [rbp + 0x1c0], 0
jne 0x1800ddc89
xor al, al
jmp 0x1800dde6c
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0680
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800dde53
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800dde4f
int3
xor al, al
jmp 0x1800dde6c
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e1720
movzx eax, al
test eax, eax
jne 0x1800dde6a
xor al, al
jmp 0x1800dde6c
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret