joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x18001c008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x72657375
mov word [rsp + 0x24], 0x3233
mov byte [rsp + 0x26], 0
call fcn.180004030
mov r10, rax
test rax, rax
je 0x1800011f7
mov ecx, dword [rax + 0x3c]
xor r9d, r9d
mov ebx, dword [rcx + rax + 0x88]
add rbx, rax
mov r8d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x18]
add r8, rax
test r11d, r11d
je 0x1800011f7
nop word [rax + rax]
mov edx, dword [r8]
xor ecx, ecx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x1800011eb
nop
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x1800011d0
cmp ecx, 0x71d2c76
je 0x18000120c
add r8, 4
inc r9d
cmp r9d, r11d
jb 0x1800011c0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800040a0
add rsp, 0x30
pop rbx
ret
mov eax, dword [rbx + 0x24]
add rax, r10
movsxd rcx, r9d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
je 0x1800011f7
lea rcx, [rsp + 0x20]
call rax
mov r10, rax
test rax, rax
je 0x1800011f7
mov ecx, dword [rax + 0x3c]
xor r9d, r9d
mov ebx, dword [rcx + rax + 0x88]
add rbx, rax
mov r8d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x18]
add r8, rax
test r11d, r11d
je 0x1800011f7
nop word [rax + rax]
mov edx, dword [r8]
xor ecx, ecx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x18000128b
nop
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x180001270
cmp ecx, 0x67c2e1e
je 0x18000129c
add r8, 4
inc r9d
cmp r9d, r11d
jb 0x180001260
jmp 0x1800011f7
mov eax, dword [rbx + 0x24]
add rax, r10
movsxd rcx, r9d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800040a0
add rsp, 0x30
pop rbx
ret
Function at 0x1800012d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x18001c008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov edi, ecx
mov dword [rsp + 0x20], 0x6376736d
mov word [rsp + 0x24], 0x7472
mov byte [rsp + 0x26], 0
call fcn.180004030
mov r10, rax
test rax, rax
je 0x180001367
mov ecx, dword [rax + 0x3c]
xor r9d, r9d
mov ebx, dword [rcx + rax + 0x88]
add rbx, rax
mov r8d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x18]
add r8, rax
test r11d, r11d
je 0x180001367
nop dword [rax]
mov edx, dword [r8]
xor ecx, ecx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x18000135b
nop
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x180001340
cmp ecx, 0x71d2c76
je 0x180001381
add r8, 4
inc r9d
cmp r9d, r11d
jb 0x180001330
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800040a0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rbx + 0x24]
add rax, r10
movsxd rcx, r9d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
je 0x180001367
lea rcx, [rsp + 0x20]
call rax
mov r10, rax
test rax, rax
je 0x180001367
mov ecx, dword [rax + 0x3c]
xor r9d, r9d
mov ebx, dword [rcx + rax + 0x88]
add rbx, rax
mov r8d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x18]
add r8, rax
test r11d, r11d
je 0x180001367
nop dword [rax + rax]
mov edx, dword [r8]
xor eax, eax
add rdx, r10
movzx ecx, byte [rdx]
test cl, cl
je 0x1800013f3
nop
imul eax, eax, 0x21
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x1800013e0
cmp eax, edi
je 0x180001408
add r8, 4
inc r9d
cmp r9d, r11d
jb 0x1800013d0
jmp 0x180001367
mov eax, dword [rbx + 0x24]
add rax, r10
movsxd rcx, r9d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
jmp 0x180001369
Function at 0x180001430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18001c008]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, ecx
mov dword [rsp + 0x20], 0x61766461
mov dword [rsp + 0x24], 0x32336970
mov byte [rsp + 0x28], 0
call fcn.180004030
mov r10, rax
test rax, rax
je 0x1800014c7
mov ecx, dword [rax + 0x3c]
xor r9d, r9d
mov ebx, dword [rcx + rax + 0x88]
add rbx, rax
mov r8d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x18]
add r8, rax
test r11d, r11d
je 0x1800014c7
nop dword [rax]
mov edx, dword [r8]
xor ecx, ecx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x1800014bb
nop
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x1800014a0
cmp ecx, 0x71d2c76
je 0x1800014e1
add r8, 4
inc r9d
cmp r9d, r11d
jb 0x180001490
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800040a0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov eax, dword [rbx + 0x24]
add rax, r10
movsxd rcx, r9d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
je 0x1800014c7
lea rcx, [rsp + 0x20]
call rax
mov r10, rax
test rax, rax
je 0x1800014c7
mov ecx, dword [rax + 0x3c]
xor r9d, r9d
mov ebx, dword [rcx + rax + 0x88]
add rbx, rax
mov r8d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x18]
add r8, rax
test r11d, r11d
je 0x1800014c7
nop dword [rax + rax]
mov edx, dword [r8]
xor eax, eax
add rdx, r10
movzx ecx, byte [rdx]
test cl, cl
je 0x180001553
nop
imul eax, eax, 0x21
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x180001540
cmp eax, edi
je 0x180001568
add r8, 4
inc r9d
cmp r9d, r11d
jb 0x180001530
jmp 0x1800014c7
mov eax, dword [rbx + 0x24]
add rax, r10
movsxd rcx, r9d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
jmp 0x1800014c9
Function at 0x180001590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18001c008]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, ecx
mov dword [rsp + 0x20], 0x61737457
mov dword [rsp + 0x24], 0x32336970
mov byte [rsp + 0x28], 0
call fcn.180004030
mov r10, rax
test rax, rax
je 0x180001627
mov ecx, dword [rax + 0x3c]
xor r9d, r9d
mov ebx, dword [rcx + rax + 0x88]
add rbx, rax
mov r8d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x18]
add r8, rax
test r11d, r11d
je 0x180001627
nop dword [rax]
mov edx, dword [r8]
xor ecx, ecx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x18000161b
nop
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x180001600
cmp ecx, 0x71d2c76
je 0x180001641
add r8, 4
inc r9d
cmp r9d, r11d
jb 0x1800015f0
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800040a0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov eax, dword [rbx + 0x24]
add rax, r10
movsxd rcx, r9d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
je 0x180001627
lea rcx, [rsp + 0x20]
call rax
mov r10, rax
test rax, rax
je 0x180001627
mov ecx, dword [rax + 0x3c]
xor r9d, r9d
mov ebx, dword [rcx + rax + 0x88]
add rbx, rax
mov r8d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x18]
add r8, rax
test r11d, r11d
je 0x180001627
nop dword [rax + rax]
mov edx, dword [r8]
xor eax, eax
add rdx, r10
movzx ecx, byte [rdx]
test cl, cl
je 0x1800016b3
nop
imul eax, eax, 0x21
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x1800016a0
cmp eax, edi
je 0x1800016c8
add r8, 4
inc r9d
cmp r9d, r11d
jb 0x180001690
jmp 0x180001627
mov eax, dword [rbx + 0x24]
add rax, r10
movsxd rcx, r9d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
jmp 0x180001629
Function at 0x1800016f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x18001c008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x6c656853
mov dword [rsp + 0x24], 0x32336c
call fcn.180004030
mov r10, rax
test rax, rax
je 0x180001778
mov ecx, dword [rax + 0x3c]
xor r9d, r9d
mov ebx, dword [rcx + rax + 0x88]
add rbx, rax
mov r8d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x18]
add r8, rax
test r11d, r11d
je 0x180001778
mov edx, dword [r8]
xor ecx, ecx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x18000176c
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x180001751
cmp ecx, 0x71d2c76
je 0x18000178d
add r8, 4
inc r9d
cmp r9d, r11d
jb 0x180001742
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800040a0
add rsp, 0x30
pop rbx
ret
mov eax, dword [rbx + 0x24]
add rax, r10
movsxd rcx, r9d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
je 0x180001778
lea rcx, [rsp + 0x20]
call rax
mov r10, rax
test rax, rax
je 0x180001778
mov ecx, dword [rax + 0x3c]
xor r9d, r9d
mov ebx, dword [rcx + rax + 0x88]
add rbx, rax
mov r8d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x18]
add r8, rax
test r11d, r11d
je 0x180001778
nop word [rax + rax]
mov edx, dword [r8]
xor ecx, ecx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x18000180b
nop
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x1800017f0
cmp ecx, 0x734f38d3
je 0x18000181c
add r8, 4
inc r9d
cmp r9d, r11d
jb 0x1800017e0
jmp 0x180001778
mov eax, dword [rbx + 0x24]
add rax, r10
movsxd rcx, r9d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800040a0
add rsp, 0x30
pop rbx
ret
Function at 0x180001850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x18001c008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov edi, ecx
mov dword [rsp + 0x20], 0x5f327377
mov word [rsp + 0x24], 0x3233
mov byte [rsp + 0x26], 0
call fcn.180004030
mov r10, rax
test rax, rax
je 0x1800018e7
mov ecx, dword [rax + 0x3c]
xor r9d, r9d
mov ebx, dword [rcx + rax + 0x88]
add rbx, rax
mov r8d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x18]
add r8, rax
test r11d, r11d
je 0x1800018e7
nop dword [rax]
mov edx, dword [r8]
xor ecx, ecx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x1800018db
nop
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x1800018c0
cmp ecx, 0x71d2c76
je 0x180001901
add r8, 4
inc r9d
cmp r9d, r11d
jb 0x1800018b0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800040a0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rbx + 0x24]
add rax, r10
movsxd rcx, r9d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
je 0x1800018e7
lea rcx, [rsp + 0x20]
call rax
mov r10, rax
test rax, rax
je 0x1800018e7
mov ecx, dword [rax + 0x3c]
xor r9d, r9d
mov ebx, dword [rcx + rax + 0x88]
add rbx, rax
mov r8d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x18]
add r8, rax
test r11d, r11d
je 0x1800018e7
nop dword [rax + rax]
mov edx, dword [r8]
xor eax, eax
add rdx, r10
movzx ecx, byte [rdx]
test cl, cl
je 0x180001973
nop
imul eax, eax, 0x21
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x180001960
cmp eax, edi
je 0x180001988
add r8, 4
inc r9d
cmp r9d, r11d
jb 0x180001950
jmp 0x1800018e7
mov eax, dword [rbx + 0x24]
add rax, r10
movsxd rcx, r9d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
jmp 0x1800018e9
Function at 0x1800019b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x18001c008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x72657355
mov dword [rsp + 0x24], 0x766e65
call fcn.180004030
mov r10, rax
test rax, rax
je 0x180001a38
mov ecx, dword [rax + 0x3c]
xor r9d, r9d
mov ebx, dword [rcx + rax + 0x88]
add rbx, rax
mov r8d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x18]
add r8, rax
test r11d, r11d
je 0x180001a38
mov edx, dword [r8]
xor ecx, ecx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x180001a2c
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x180001a11
cmp ecx, 0x71d2c76
je 0x180001a4d
add r8, 4
inc r9d
cmp r9d, r11d
jb 0x180001a02
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800040a0
add rsp, 0x30
pop rbx
ret
mov eax, dword [rbx + 0x24]
add rax, r10
movsxd rcx, r9d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
je 0x180001a38
lea rcx, [rsp + 0x20]
call rax
mov r10, rax
test rax, rax
je 0x180001a38
mov ecx, dword [rax + 0x3c]
xor r9d, r9d
mov ebx, dword [rcx + rax + 0x88]
add rbx, rax
mov r8d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x18]
add r8, rax
test r11d, r11d
je 0x180001a38
nop word [rax + rax]
mov edx, dword [r8]
xor ecx, ecx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x180001acb
nop
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x180001ab0
cmp ecx, 0xabb71f26
je 0x180001adc
add r8, 4
inc r9d
cmp r9d, r11d
jb 0x180001aa0
jmp 0x180001a38
mov eax, dword [rbx + 0x24]
add rax, r10
movsxd rcx, r9d
movzx edx, word [rax + rcx*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800040a0
add rsp, 0x30
pop rbx
ret
Function at 0x180003490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x18001c008]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rsi, rcx
mov qword [rsp + 0x28], 0
mov eax, 2
mov ecx, 0x79b772c
mov word [rsp + 0x20], ax
mov edi, r8d
mov rbx, rdx
call fcn.180001850
movzx ecx, di
call rax
mov ecx, 0xbf92328a
mov word [rsp + 0x22], ax
call fcn.180001850
mov rcx, rbx
call rax
mov ecx, 0x5a3b36b
mov dword [rsp + 0x24], eax
call fcn.1800012d0
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x104
call rax
mov dword [rsp + 0x30], 0x253a7325
mov word [rsp + 0x34], 0x64
call fcn.180001160
mov r9d, edi
lea rdx, [rsp + 0x30]
mov r8, rbx
lea rcx, [rsp + 0x60]
call rax
mov ecx, 0x1acb4b50
call fcn.180001000
lea rcx, [rsp + 0x60]
call rax
mov rbx, qword [rsi + 0x58]
mov ecx, 0xcfb6b06a
mov dword [rsp + 0x38], 0x20706354
mov dword [rsp + 0x3c], 0x6c696166
mov word [rsp + 0x40], 0x6465
mov byte [rsp + 0x42], 0
mov dword [rsp + 0x48], 0x20706354
mov dword [rsp + 0x4c], 0x63637573
mov dword [rsp + 0x50], 0x646565
call fcn.180001850
mov r8d, 0x10
lea rdx, [rsp + 0x20]
mov rcx, rbx
call rax
mov ecx, 0x1acb4b50
cmp eax, 0xffffffff
jne 0x1800035b1
call fcn.180001000
lea rcx, [rsp + 0x38]
call rax
xor eax, eax
jmp 0x1800035c2
call fcn.180001000
lea rcx, [rsp + 0x48]
call rax
mov eax, 1
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1800040a0
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800035f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x18001c008]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0xc3de085a
mov rsi, rdx
call fcn.180001850
mov rcx, rsi
call rax
test rax, rax
jne 0x180003661
mov ecx, 0x1acb4b50
mov dword [rsp + 0x28], 0x68746547
mov dword [rsp + 0x2c], 0x6620736f
mov dword [rsp + 0x30], 0x656c6961
mov word [rsp + 0x34], 0x64
call fcn.180001000
lea rcx, [rsp + 0x28]
call rax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800040a0
add rsp, 0x40
pop rsi
ret
mov rax, qword [rax + 0x18]
mov ecx, 0x5a370cb
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rdi
mov rbx, qword [rax]
call fcn.1800012d0
mov r8d, 4
lea rcx, [rsp + 0x20]
mov rdx, rbx
call rax
mov ecx, 0x5a3b36b
call fcn.1800012d0
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 0x28]
call rax
mov ebx, dword [rsp + 0x20]
mov ecx, 0xbf9998e1
call fcn.180001850
mov ecx, ebx
call rax
mov ecx, 0x57116105
mov rbx, rax
call fcn.180001000
mov rcx, rbx
call rax
mov ebx, dword [rsp + 0x20]
mov ecx, 0xbf9998e1
movsxd rdi, eax
call fcn.180001850
mov ecx, ebx
call rax
mov ecx, 0x5a370cb
mov rbx, rax
call fcn.1800012d0
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call rax
mov rdi, qword [rsp + 0x60]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800040a0
add rsp, 0x40
pop rsi
ret
Function at 0x180003720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x18001c008]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rdi, rcx
mov ecx, 0x1451fe69
call fcn.180001850
mov edx, 1
lea ecx, [rdx + 1]
lea r8d, [rdx + 5]
call rax
mov qword [rdi + 0x58], rax
cmp rax, 0xffffffffffffffff
je 0x18000386c
mov rdx, qword [rdi + 0x28]
add rdx, 0x30
call fcn.1800035f0
cmp eax, 1
jne 0x18000379e
mov rdx, qword [rdi + 0x28]
mov rcx, rdi
movzx r8d, word [rdx + 0x24]
add rdx, 0x30
call fcn.180003490
cmp eax, 1
je 0x18000391a
mov rbx, qword [rdi + 0x58]
mov ecx, 0x5de2e91f
call fcn.180001850
mov rcx, rbx
call rax
mov ecx, 0x1451fe69
call fcn.180001850
mov edx, 1
lea ecx, [rdx + 1]
lea r8d, [rdx + 5]
call rax
mov qword [rdi + 0x58], rax
cmp rax, 0xffffffffffffffff
je 0x18000386c
mov rdx, qword [rdi + 0x28]
add rdx, 0x58
call fcn.1800035f0
cmp eax, 1
jne 0x180003807
mov rdx, qword [rdi + 0x28]
mov rcx, rdi
movzx r8d, word [rdx + 0x26]
add rdx, 0x58
call fcn.180003490
cmp eax, 1
je 0x18000391a
mov rbx, qword [rdi + 0x58]
mov ecx, 0x5de2e91f
call fcn.180001850
mov rcx, rbx
call rax
mov ecx, 0x1451fe69
call fcn.180001850
mov edx, 1
lea ecx, [rdx + 1]
lea r8d, [rdx + 5]
call rax
mov qword [rdi + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x18000388f
mov ecx, 0x1acb4b50
mov dword [rsp + 0x28], 0x6b636f53
mov dword [rsp + 0x2c], 0x66207465
mov dword [rsp + 0x30], 0x656c6961
mov word [rsp + 0x34], 0x64
call fcn.180001000
lea rcx, [rsp + 0x28]
call rax
xor eax, eax
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1800040a0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov ecx, 0x5a3b36b
call fcn.1800012d0
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x104
call rax
mov dword [rsp + 0x20], 0x253a7325
mov word [rsp + 0x24], 0x64
call fcn.180001160
mov r8, qword [rdi + 0x28]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
movzx r9d, word [r8 + 6]
sub r8, 0xffffffffffffff80
call rax
mov ecx, 0x1acb4b50
call fcn.180001000
lea rcx, [rsp + 0x40]
call rax
mov rdx, qword [rdi + 0x28]
sub rdx, 0xffffffffffffff80
call fcn.1800035f0
cmp eax, 1
jne 0x18000386c
mov rdx, qword [rdi + 0x28]
mov rcx, rdi
movzx r8d, word [rdx + 6]
sub rdx, 0xffffffffffffff80
call fcn.180003490
cmp eax, 1
jne 0x18000386c
mov eax, 1
jmp 0x18000386e
Function at 0x180003930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18001c008]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0x54535953
mov word [rsp + 0x24], 0x4d45
mov byte [rsp + 0x26], 0
mov dword [rsp + 0x28], 0x6376735c
mov dword [rsp + 0x2c], 0x74736f68
mov dword [rsp + 0x30], 0x6578652e
mov byte [rsp + 0x34], 0
mov ecx, 0xb9f2133d
call fcn.180001000
call rax
mov rbx, rax
call fcn.1800010b0
mov edx, 8
mov r8d, 0x104
mov rcx, rbx
call rax
mov rsi, rax
mov ecx, 0xb9f2133d
call fcn.180001000
call rax
mov rbx, rax
call fcn.1800010b0
mov edx, 8
mov r8d, 0x104
mov rcx, rbx
call rax
mov rbp, rax
mov ecx, 0xb2b1e77b
call fcn.180001000
mov edx, 0x104
mov rcx, rsi
call rax
mov ecx, 0x570c615e
call fcn.180001000
lea rdx, [rsp + 0x28]
mov rcx, rsi
call rax
mov ecx, 0x9c49c053
call fcn.180001000
xor ecx, ecx
call rax
mov rbx, rax
mov ecx, 0xb5114d08
call fcn.180001000
mov r8d, 0x104
mov rdx, rbp
mov rcx, rbx
call rax
mov ecx, 0x389f160f
call fcn.180001000
mov rdx, rbp
mov rcx, rsi
call rax
test eax, eax
jne 0x180003a5c
mov rbx, qword [rdi + 8]
mov ecx, 0x389f160f
call fcn.180001000
lea rdx, [rsp + 0x20]
mov rcx, rbx
call rax
test eax, eax
je 0x180003a5c
xor edi, edi
jmp 0x180003a61
mov edi, 1
test rsi, rsi
je 0x180003a8a
mov ecx, 0xb9f2133d
call fcn.180001000
call rax
mov rbx, rax
mov ecx, 0xbb9549c0
call fcn.180001000
mov r8, rsi
xor edx, edx
mov rcx, rbx
call rax
nop
test rbp, rbp
je 0x180003ab3
mov ecx, 0xb9f2133d
call fcn.180001000
call rax
mov rbx, rax
mov ecx, 0xbb9549c0
call fcn.180001000
mov r8, rbp
xor edx, edx
mov rcx, rbx
call rax
nop
mov eax, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800040a0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x180003d70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x70
mov rax, qword [0x18001c008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ecx, 0xb9f2133d
mov r14, rdx
call fcn.180001000
call rax
mov rbx, rax
call fcn.1800010b0
mov edx, 8
mov r8d, 0x104
mov rcx, rbx
call rax
mov ecx, 0xb2b1e77b
mov dword [rsp + 0x50], 0x6376735c
mov rbx, rax
mov dword [rsp + 0x54], 0x74736f68
mov dword [rsp + 0x58], 0x6578652e
mov byte [rsp + 0x5c], 0
call fcn.180001000
mov edx, 0x104
mov rcx, rbx
call rax
mov ecx, 0x570c615e
call fcn.180001000
lea rdx, [rsp + 0x50]
mov rcx, rbx
call rax
mov ecx, 0xb376ce13
call fcn.180001000
lea rcx, [rsp + 0x48]
call rax
mov ecx, 0x2cfe15
call fcn.180001000
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180003e67
mov rbx, qword [rsp + 0x48]
mov ecx, 0xde717ef7
call fcn.180001000
mov rcx, rbx
call rax
xor eax, eax
jmp 0x180003f33
mov ecx, 0x8d27fd3b
mov dword [rsp + 0x40], 0
call fcn.180001000
xor edx, edx
mov rcx, rsi
call rax
mov dword [r14], eax
test eax, eax
jne 0x180003eb1
mov rbx, qword [rsp + 0x48]
mov ecx, 0xde717ef7
call fcn.180001000
mov rcx, rbx
call rax
mov ecx, 0x4d070222
call fcn.180001000
mov rcx, rsi
call rax
xor eax, eax
jmp 0x180003f33
mov qword [rsp + 0x80], rdi
mov ecx, 0xb9f2133d
mov edi, eax
call fcn.180001000
call rax
mov rbx, rax
call fcn.1800010b0
mov r8d, edi
mov edx, 8
mov rcx, rbx
call rax
mov ebx, dword [r14]
mov ecx, 0xf54e4f1c
mov rdi, rax
call fcn.180001000
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call rax
mov ecx, 0x4d070222
call fcn.180001000
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x48]
mov ecx, 0xde717ef7
call fcn.180001000
mov rcx, rbx
call rax
mov rax, rdi
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800040a0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x180004030
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, 0x30
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
ret

Function at 0x180004052
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, 0x30
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
ret