joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801d9e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c1558]
mov rbx, rdx
test rax, rax
jne 0x1801d9ed3
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801d9e88
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c1558], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c1558]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801d9efc
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801d9f28
cmp dword [rbp - 0x10], 0x10000
je 0x1801d9f28
cmp qword [rbp - 0x18], 0x1000
jb 0x1801d9f28
cmp dword [rbp - 8], 0x1000000
je 0x1801d9f24
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801d9f2a
mov al, 1
jmp 0x1801d9f2a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801dbdf4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0fa0]
mov rbx, rdx
test rax, rax
jne 0x1801dbe97
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801dbe4c
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0fa0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0fa0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801dbec0
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801dbeec
cmp dword [rbp - 0x10], 0x10000
je 0x1801dbeec
cmp qword [rbp - 0x18], 0x1000
jb 0x1801dbeec
cmp dword [rbp - 8], 0x1000000
je 0x1801dbee8
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801dbeee
mov al, 1
jmp 0x1801dbeee
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801dddb8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c1510]
mov rbx, rdx
test rax, rax
jne 0x1801dde5b
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801dde10
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c1510], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c1510]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801dde84
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801ddeb0
cmp dword [rbp - 0x10], 0x10000
je 0x1801ddeb0
cmp qword [rbp - 0x18], 0x1000
jb 0x1801ddeb0
cmp dword [rbp - 8], 0x1000000
je 0x1801ddeac
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801ddeb2
mov al, 1
jmp 0x1801ddeb2
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801dfd7c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c13c0]
mov rbx, rdx
test rax, rax
jne 0x1801dfe1f
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801dfdd4
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c13c0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c13c0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801dfe48
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801dfe74
cmp dword [rbp - 0x10], 0x10000
je 0x1801dfe74
cmp qword [rbp - 0x18], 0x1000
jb 0x1801dfe74
cmp dword [rbp - 8], 0x1000000
je 0x1801dfe70
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801dfe76
mov al, 1
jmp 0x1801dfe76
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801e1d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c1038]
mov rbx, rdx
test rax, rax
jne 0x1801e1de3
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801e1d98
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c1038], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c1038]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801e1e0c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801e1e38
cmp dword [rbp - 0x10], 0x10000
je 0x1801e1e38
cmp qword [rbp - 0x18], 0x1000
jb 0x1801e1e38
cmp dword [rbp - 8], 0x1000000
je 0x1801e1e34
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801e1e3a
mov al, 1
jmp 0x1801e1e3a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801e241c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c1310]
mov rbx, rdx
test rax, rax
jne 0x1801e24bf
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801e2474
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c1310], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c1310]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801e24e8
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801e2514
cmp dword [rbp - 0x10], 0x10000
je 0x1801e2514
cmp qword [rbp - 0x18], 0x1000
jb 0x1801e2514
cmp dword [rbp - 8], 0x1000000
je 0x1801e2510
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801e2516
mov al, 1
jmp 0x1801e2516
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801e2af8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c15e8]
mov rbx, rdx
test rax, rax
jne 0x1801e2b9b
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801e2b50
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c15e8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c15e8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801e2bc4
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801e2bf0
cmp dword [rbp - 0x10], 0x10000
je 0x1801e2bf0
cmp qword [rbp - 0x18], 0x1000
jb 0x1801e2bf0
cmp dword [rbp - 8], 0x1000000
je 0x1801e2bec
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801e2bf2
mov al, 1
jmp 0x1801e2bf2
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801e31d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c1420]
mov rbx, rdx
test rax, rax
jne 0x1801e3277
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801e322c
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c1420], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c1420]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801e32a0
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801e32cc
cmp dword [rbp - 0x10], 0x10000
je 0x1801e32cc
cmp qword [rbp - 0x18], 0x1000
jb 0x1801e32cc
cmp dword [rbp - 8], 0x1000000
je 0x1801e32c8
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801e32ce
mov al, 1
jmp 0x1801e32ce
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801e5198
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c15a0]
mov rbx, rdx
test rax, rax
jne 0x1801e523b
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801e51f0
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c15a0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c15a0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801e5264
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801e5290
cmp dword [rbp - 0x10], 0x10000
je 0x1801e5290
cmp qword [rbp - 0x18], 0x1000
jb 0x1801e5290
cmp dword [rbp - 8], 0x1000000
je 0x1801e528c
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801e5292
mov al, 1
jmp 0x1801e5292
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801e715c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c11c0]
mov rbx, rdx
test rax, rax
jne 0x1801e71ff
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801e71b4
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c11c0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c11c0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801e7228
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801e7254
cmp dword [rbp - 0x10], 0x10000
je 0x1801e7254
cmp qword [rbp - 0x18], 0x1000
jb 0x1801e7254
cmp dword [rbp - 8], 0x1000000
je 0x1801e7250
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801e7256
mov al, 1
jmp 0x1801e7256
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801e9120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c10c0]
mov rbx, rdx
test rax, rax
jne 0x1801e91c3
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801e9178
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c10c0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c10c0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801e91ec
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801e9218
cmp dword [rbp - 0x10], 0x10000
je 0x1801e9218
cmp qword [rbp - 0x18], 0x1000
jb 0x1801e9218
cmp dword [rbp - 8], 0x1000000
je 0x1801e9214
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801e921a
mov al, 1
jmp 0x1801e921a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801eb0e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c1058]
mov rbx, rdx
test rax, rax
jne 0x1801eb187
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801eb13c
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c1058], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c1058]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801eb1b0
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801eb1dc
cmp dword [rbp - 0x10], 0x10000
je 0x1801eb1dc
cmp qword [rbp - 0x18], 0x1000
jb 0x1801eb1dc
cmp dword [rbp - 8], 0x1000000
je 0x1801eb1d8
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801eb1de
mov al, 1
jmp 0x1801eb1de
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801ed0a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c1688]
mov rbx, rdx
test rax, rax
jne 0x1801ed14b
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801ed100
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c1688], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c1688]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801ed174
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801ed1a0
cmp dword [rbp - 0x10], 0x10000
je 0x1801ed1a0
cmp qword [rbp - 0x18], 0x1000
jb 0x1801ed1a0
cmp dword [rbp - 8], 0x1000000
je 0x1801ed19c
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801ed1a2
mov al, 1
jmp 0x1801ed1a2
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801ed784
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c1740]
mov rbx, rdx
test rax, rax
jne 0x1801ed827
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801ed7dc
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c1740], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c1740]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801ed850
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801ed87c
cmp dword [rbp - 0x10], 0x10000
je 0x1801ed87c
cmp qword [rbp - 0x18], 0x1000
jb 0x1801ed87c
cmp dword [rbp - 8], 0x1000000
je 0x1801ed878
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801ed87e
mov al, 1
jmp 0x1801ed87e
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801ef748
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c14d0]
mov rbx, rdx
test rax, rax
jne 0x1801ef7eb
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801ef7a0
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c14d0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c14d0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801ef814
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801ef840
cmp dword [rbp - 0x10], 0x10000
je 0x1801ef840
cmp qword [rbp - 0x18], 0x1000
jb 0x1801ef840
cmp dword [rbp - 8], 0x1000000
je 0x1801ef83c
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801ef842
mov al, 1
jmp 0x1801ef842
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret