joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001a1a0
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x180141b10]
xor rax, rsp
mov qword [rsp + 0x150], rax
call fcn.180019a60
test al, al
je 0x18001a41b
lea rcx, [0x180151510]
call fcn.18004a990
test al, al
jne 0x18001a25e
lea rcx, [0x1801514b0]
call fcn.18004a990
test al, al
je 0x18001a205
call fcn.18004a600
test al, al
sete al
jmp 0x18001a252
lea rcx, [0x1801515d0]
call fcn.18004a990
test al, al
je 0x18001a221
call fcn.18004a650
test al, al
sete al
jmp 0x18001a252
lea rcx, [0x180151570]
call fcn.18004a990
test al, al
je 0x18001a41b
lea rcx, [rsp + 0x90]
call fcn.180002db0
mov qword [rsp + 0x70], rax
cmp dword [rax + 0xc], 7
je 0x18001a25e
call fcn.18004a600
mov byte [rsp + 0x20], al
test al, al
je 0x18001a41b
lea rcx, [0x1801514b0]
call fcn.18004a990
test al, al
je 0x18001a279
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
call fcn.18001a460
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
or rdi, 0xffffffffffffffff
cmp word [rax], bx
jne 0x18001a2c5
mov r8d, ebx
jmp 0x18001a2da
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x18001a2d0
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180003b30
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.180065470
nop
cmp qword [rsp + 0x48], 8
jb 0x18001a30d
mov rcx, qword [rsp + 0x30]
call fcn.18007ed90
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
lea rcx, [rsp + 0xb0]
call fcn.180002fb0
nop
call fcn.180039cc0
mov dl, 1
mov ecx, 0x2718
call fcn.18001b9b0
lea rcx, [0x1801514b0]
call fcn.18004a990
test al, al
je 0x18001a36d
xor edx, edx
lea rcx, [0x18004c140]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x18004c140]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x18001a384
mov rcx, rbx
mov qword [rsp + 0x50], rbx
jmp 0x18001a38c
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.18003adb0
nop
cmp qword [rsp + 0xc8], 8
jb 0x18001a3b3
mov rcx, qword [rsp + 0xb0]
call fcn.18007ed90
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0xb0], bx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x18001a41b
mov qword [rsp + 0x28], rcx
mov eax, edi
lock xadd dword [rcx + 8], eax
dec eax
jne 0x18001a41b
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x18001a41b
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
call fcn.1800553c0
mov rcx, qword [0x180151418]
test rcx, rcx
je 0x18001a435
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800a0c30
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x18001adc0
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x60
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180141b10]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, rcx
cmp edx, 1
jne 0x18001afc2
xor esi, esi
mov ebx, esi
lea rdi, [0x1801514b0]
mov dword [rsp + 0x30], ebx
cmp ebx, 4
jge 0x18001ae27
movsxd rax, ebx
lea rcx, [rax + rax*2]
shl rcx, 5
add rcx, rdi
call fcn.18004a990
test al, al
jne 0x18001ae37
inc ebx
jmp 0x18001ae03
call fcn.18004ad50
test al, al
jne 0x18001ae37
xor eax, eax
jmp 0x18001afc7
call fcn.18004ad50
test al, al
je 0x18001ae4a
mov eax, 1
jmp 0x18001afc7
mov qword [0x180151418], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x180151410], eax
mov rcx, r14
call fcn.18001abe0
call fcn.18001aff0
or rdi, 0xffffffffffffffff
cmp word [rax], 0
jne 0x18001ae79
mov r8, rsi
jmp 0x18001ae8b
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001ae80
mov rdx, rax
lea rcx, [0x180144318]
call fcn.180003b30
mov rcx, r14
call fcn.18004c2f0
nop
lea rcx, [0x180151510]
call fcn.18004a990
test al, al
je 0x18001aeb8
call fcn.180039cc0
lea rcx, [0x1801515d0]
call fcn.18004a990
test al, al
je 0x18001aecf
call fcn.180039cc0
jmp 0x18001af2c
lea rcx, [0x1801515d0]
call fcn.18004a990
test al, al
je 0x18001af2c
call fcn.18004a650
test al, al
je 0x18001aeef
xor eax, eax
jmp 0x18001afc7
call fcn.180039cc0
mov dword [rsp + 0x44], esi
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x18001a610]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call fcn.18004c6d0
mov eax, 1
jmp 0x18001afc7
mov dword [rsp + 0x40], esi
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x18001a610]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180067140
nop
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x18001af79
mov rsi, qword [rax]
mov rcx, rsi
call fcn.18004c6d0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x18001afc2
mov eax, edi
lock xadd dword [rbx + 8], eax
dec eax
jne 0x18001afc2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x18001afc2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x18001afc2
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800a0c30
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x180037090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180141b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x6c4e
lea r8, [0x180153088]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x6c266c2d
mov dword [rsp + 0x24], 0x6c216c3c
mov dword [rsp + 0x28], 0x6c2b6c23
mov dword [rsp + 0x2c], 0x6c2a6c60
mov dword [rsp + 0x30], 0x6c226c22
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180049bb0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800a0c30
add rsp, 0x130
pop rbp
ret

Function at 0x180037fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180141b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x180153188]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xa]
mov r9d, 0x742e
mov dword [rsp + 0x20], 0x745e7441
mov dword [rsp + 0x24], 0x745c744b
mov dword [rsp + 0x28], 0x7400744f
mov dword [rsp + 0x2c], 0x7456744b
mov qword [rsp + 0x30], 0x742e744b
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.180049bb0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800a0c30
add rsp, 0x130
pop rbp
ret
Function at 0x1800385d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180141b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1801531c8]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xc]
mov r9d, 0x7626
mov dword [rsp + 0x20], 0x76437655
mov dword [rsp + 0x24], 0x76537645
mov dword [rsp + 0x28], 0x76157654
mov dword [rsp + 0x2c], 0x76087614
mov dword [rsp + 0x30], 0x764a7642
mov qword [rsp + 0x34], 0x7626764a
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180049bb0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800a0c30
add rsp, 0x130
pop rbp
ret

Function at 0x1800388e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180141b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x781e
lea r8, [0x180153228]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xf]
mov dword [rsp + 0x20], 0x787b785a
mov dword [rsp + 0x24], 0x786c787d
mov dword [rsp + 0x28], 0x786e7867
mov dword [rsp + 0x2c], 0x7853786a
mov dword [rsp + 0x30], 0x786d787b
mov dword [rsp + 0x34], 0x787f786d
mov dword [rsp + 0x38], 0x787b7879
mov qword [rsp + 0x3c], r9
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180049bb0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800a0c30
add rsp, 0x130
pop rbp
ret
Function at 0x1800396f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180141b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x180153328]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xa]
mov r9d, 0x7e06
mov dword [rsp + 0x20], 0x7e757e68
mov dword [rsp + 0x24], 0x7e747e76
mov dword [rsp + 0x28], 0x7e287e32
mov dword [rsp + 0x2c], 0x7e6a7e62
mov qword [rsp + 0x30], 0x7e067e6a
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.180049bb0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800a0c30
add rsp, 0x130
pop rbp
ret

Function at 0x1800397f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180141b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x2959
lea r8, [0x180153340]
lea rcx, [rsp + 0x20]
lea edx, [rax + 9]
mov dword [rsp + 0x20], 0x290b2909
mov dword [rsp + 0x24], 0x290e2906
mov dword [rsp + 0x28], 0x2930292b
mov dword [rsp + 0x2c], 0x293c292d
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.180049bb0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800a0c30
add rsp, 0x130
pop rbp
ret
Function at 0x180039ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180141b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x180153388]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xa]
mov r9d, 0x2b51
mov dword [rsp + 0x20], 0x2b222b3f
mov dword [rsp + 0x24], 0x2b232b21
mov dword [rsp + 0x28], 0x2b7f2b65
mov dword [rsp + 0x2c], 0x2b3d2b35
mov qword [rsp + 0x30], 0x2b512b3d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.180049bb0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800a0c30
add rsp, 0x130
pop rbp
ret

Function at 0x18003a7d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180141b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x2f41
lea r8, [0x180153410]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x2f322f16
mov dword [rsp + 0x24], 0x2f1e2f73
mov dword [rsp + 0x28], 0x2f732f72
mov dword [rsp + 0x2c], 0x2f252f6f
mov dword [rsp + 0x30], 0x2f2d2f2d
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180049bb0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800a0c30
add rsp, 0x130
pop rbp
ret
Function at 0x18003aac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180141b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x180153450]
lea rcx, [rsp + 0x20]
lea edx, [rax + 8]
mov r9d, 0x3139
mov dword [rsp + 0x20], 0x316a316e
mov dword [rsp + 0x24], 0x316b3178
mov dword [rsp + 0x28], 0x315a315c
mov qword [rsp + 0x2c], 0x3139314f
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180049bb0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800a0c30
add rsp, 0x130
pop rbp
ret
Function at 0x18004a310
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x180141b10]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov edi, ecx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
xor eax, eax
mov qword [r11 - 0x44], rax
mov qword [r11 - 0x3c], rax
mov qword [r11 - 0x34], rax
mov qword [r11 - 0x2c], rax
mov qword [r11 - 0x24], rax
mov dword [rsp + 0x6c], eax
lea rcx, [r11 - 0x48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x40], bx
jne 0x18004a371
xor al, al
jmp 0x18004a3ec
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov r8d, edi
call fcn.180049c20
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180067140
nop
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x18004a3a4
mov rbx, qword [rax]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x28], 0
sete sil
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x18004a3e8
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
jne 0x18004a3e8
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock dec dword [rbx + 0xc]
jne 0x18004a3e8
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.WS2_32.dll_htonl]
movzx eax, sil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800a0c30
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18004a500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180141b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x685e
lea r8, [0x180153670]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xd]
mov dword [rsp + 0x20], 0x683b6815
mov dword [rsp + 0x24], 0x6830682c
mov dword [rsp + 0x28], 0x6832683b
mov dword [rsp + 0x2c], 0x686c686d
mov dword [rsp + 0x30], 0x683a6870
mov dword [rsp + 0x34], 0x68326832
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.180049bb0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800a0c30
add rsp, 0x130
pop rbp
ret
Function at 0x18004d6a0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180141b10]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
call fcn.1800a9d10
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jne 0x18004d706
cmp dword [rsp + 0x28], 2
jb 0x18004d706
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800a0c30
add rsp, 0x158
ret
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800a0c30
add rsp, 0x158
ret