joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180013e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rbx, qword [0x18007b9d8]
mov r15, r8
mov r12d, edx
mov rsi, rcx
test rbx, rbx
jne 0x180014036
lea rcx, [rbp - 0x21]
mov dword [rbp - 0x21], 0x6c64746e
mov dword [rbp - 0x1d], 0x6c642e6c
mov word [rbp - 0x19], 0x6c
mov dword [rbp - 1], 0x704f744e
mov dword [rbp + 3], 0x65536e65
mov dword [rbp + 7], 0x6f697463
mov word [rbp + 0xb], 0x6e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x21]
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x7f]
lea rcx, [rbp - 0x21]
mov dword [rbp + 0x7f], ebx
mov r14, rax
call fcn.1800127b0
mov rdi, rax
test rax, rax
je 0x180013f56
mov r8d, dword [rbp + 0x7f]
mov rdx, r14
mov rcx, rax
call fcn.180012d20
mov rcx, rdi
test eax, eax
jne 0x180013f6e
call fcn.1800031d0
mov rbx, qword [0x18007b9d8]
test rbx, rbx
jne 0x180014036
or eax, 0xffffffff
jmp 0x18001404a
mov edx, r13d
sub edx, r14d
call fcn.180012e80
mov rcx, rdi
mov r11d, eax
mov rax, qword [r11 + rdi]
mov qword [rbp + 0xf], rax
mov rax, qword [r11 + rdi + 8]
mov qword [rbp + 0x17], rax
call fcn.1800031d0
lea rcx, [rbp - 0x11]
mov dword [rbp - 0x11], 0x65696253
mov dword [rbp - 0xd], 0x2e6c6c44
mov dword [rbp - 9], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x10
lea r9, [rbp - 0x29]
test rax, rax
lea rdx, [rbp + 0x7f]
mov dword [rsp + 0x28], 0x40
cmovne r8d, ebx
or rcx, 0xffffffffffffffff
mov qword [rbp + 0x7f], rbx
lea eax, [r8 + 1]
mov byte [rbp + r8 + 0xf], 0xff
lea edi, [r8 + 0xe]
mov byte [rbp + rax + 0xf], 0x25
lea rax, [r8 + r13]
mov dword [rbp + r8 + 0x11], ebx
mov qword [rbp - 0x29], rdi
mov dword [rsp + 0x20], 0x3000
mov qword [rbp + r8 + 0x15], rax
call fcn.180012250
test eax, eax
cmovns rbx, qword [rbp + 0x7f]
mov qword [0x18007b9d8], rbx
test rbx, rbx
je 0x180013f66
lea rdx, [rbp + 0xf]
mov r8d, edi
mov rcx, rbx
call fcn.1800029a0
jmp 0x180013f5d
test rsi, rsi
je 0x180013f66
mov r8, r15
mov edx, r12d
mov rcx, rsi
call rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180014080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rbx, qword [0x18007ae60]
mov r15, rdx
mov rsi, rcx
test rbx, rbx
jne 0x180014228
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x6c64746e
mov dword [rbp - 0x25], 0x6c642e6c
mov word [rbp - 0x21], 0x6c
mov dword [rbp - 9], 0x6e55744e
mov dword [rbp - 5], 0x5670616d
mov dword [rbp - 1], 0x4f776569
mov dword [rbp + 3], 0x63655366
mov dword [rbp + 7], 0x6e6f6974
mov byte [rbp + 0xb], bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x29]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x29]
mov dword [rbp + 0x77], ebx
mov r14, rax
call fcn.1800127b0
mov rdi, rax
test rax, rax
je 0x180014148
mov r8d, dword [rbp + 0x77]
mov rdx, r14
mov rcx, rax
call fcn.180012d20
mov rcx, rdi
test eax, eax
jne 0x180014160
call fcn.1800031d0
mov rbx, qword [0x18007ae60]
test rbx, rbx
jne 0x180014228
or eax, 0xffffffff
jmp 0x180014239
mov edx, r12d
sub edx, r14d
call fcn.180012e80
mov rcx, rdi
mov r11d, eax
mov rax, qword [r11 + rdi]
mov qword [rbp + 0xf], rax
mov rax, qword [r11 + rdi + 8]
mov qword [rbp + 0x17], rax
call fcn.1800031d0
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x65696253
mov dword [rbp - 0x15], 0x2e6c6c44
mov dword [rbp - 0x11], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x10
lea r9, [rbp + 0x7f]
test rax, rax
lea rdx, [rbp + 0x77]
mov dword [rsp + 0x28], 0x40
cmovne r8d, ebx
or rcx, 0xffffffffffffffff
mov qword [rbp + 0x77], rbx
lea eax, [r8 + 1]
mov byte [rbp + r8 + 0xf], 0xff
lea edi, [r8 + 0xe]
mov byte [rbp + rax + 0xf], 0x25
lea rax, [r8 + r12]
mov dword [rbp + r8 + 0x11], ebx
mov qword [rbp + 0x7f], rdi
mov dword [rsp + 0x20], 0x3000
mov qword [rbp + r8 + 0x15], rax
call fcn.180012250
test eax, eax
cmovns rbx, qword [rbp + 0x77]
mov qword [0x18007ae60], rbx
test rbx, rbx
je 0x180014158
lea rdx, [rbp + 0xf]
mov r8d, edi
mov rcx, rbx
call fcn.1800029a0
jmp 0x18001414f
test rsi, rsi
je 0x180014158
mov rdx, r15
mov rcx, rsi
call rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180014260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xb0
mov rbx, qword [0x18007b938]
xor r13d, r13d
mov rdi, r8
mov r14, rdx
mov r15, rcx
test rbx, rbx
jne 0x18001441c
lea rcx, [rbp - 0x59]
mov dword [rbp - 0x59], 0x6c64746e
mov dword [rbp - 0x55], 0x6c642e6c
mov word [rbp - 0x51], 0x6c
mov dword [rbp - 0x39], 0x614d744e
mov dword [rbp - 0x35], 0x65695670
mov dword [rbp - 0x31], 0x53664f77
mov dword [rbp - 0x2d], 0x69746365
mov word [rbp - 0x29], 0x6e6f
mov byte [rbp - 0x27], r13b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x39]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x59]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x59]
mov dword [rbp + 0x6f], r13d
mov rsi, rax
call fcn.1800127b0
mov rbx, rax
test rax, rax
je 0x18001433a
mov r8d, dword [rbp + 0x6f]
mov rdx, rsi
mov rcx, rax
call fcn.180012d20
mov rcx, rbx
test eax, eax
jne 0x180014352
call fcn.1800031d0
mov rbx, qword [0x18007b938]
test rbx, rbx
jne 0x18001441c
or eax, 0xffffffff
jmp 0x18001445e
mov edx, r12d
sub edx, esi
call fcn.180012e80
mov rcx, rbx
mov r11d, eax
mov rax, qword [r11 + rbx]
mov qword [rbp - 0x21], rax
mov rax, qword [r11 + rbx + 8]
mov qword [rbp - 0x19], rax
call fcn.1800031d0
lea rcx, [rbp - 0x49]
mov dword [rbp - 0x49], 0x65696253
mov dword [rbp - 0x45], 0x2e6c6c44
mov dword [rbp - 0x41], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x10
lea r9, [rbp + 0x57]
test rax, rax
lea rdx, [rbp + 0x4f]
mov dword [rsp + 0x28], 0x40
cmovne r8d, r13d
or rcx, 0xffffffffffffffff
mov qword [rbp + 0x4f], r13
lea eax, [r8 + 1]
mov byte [rbp + r8 - 0x21], 0xff
lea esi, [r8 + 0xe]
mov byte [rbp + rax - 0x21], 0x25
lea rax, [r8 + r12]
mov dword [rbp + r8 - 0x1f], r13d
mov qword [rbp + 0x57], rsi
mov dword [rsp + 0x20], 0x3000
mov qword [rbp + r8 - 0x1b], rax
call fcn.180012250
mov rbx, r13
test eax, eax
cmovns rbx, qword [rbp + 0x4f]
mov qword [0x18007b938], rbx
test rbx, rbx
je 0x18001434a
lea rdx, [rbp - 0x21]
mov r8d, esi
mov rcx, rbx
call fcn.1800029a0
jmp 0x180014341
test rdi, rdi
je 0x18001434a
mov eax, dword [rbp + 0x7f]
xor r9d, r9d
mov r8, rdi
mov dword [rsp + 0x48], eax
mov rax, qword [rbp + 0x67]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x5f]
mov qword [rsp + 0x28], rax
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], r13
call rbx
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1800148e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x30
lea rcx, [rsp + 0x20]
mov rbx, rdx
mov dword [rsp + 0x20], 0x72657375
mov dword [rsp + 0x24], 0x642e3233
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x2a], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rax
test rax, rax
je 0x1800149a8
mov ecx, dword [rbx + 0x100045c]
mov dword [0x18007b0c8], ecx
cmp ecx, 0xffff
jne 0x180014954
mov eax, dword [rbx + 0x1000458]
add rax, 6
add rax, rdx
mov qword [0x18007b8f8], rax
call fcn.180018240
mov eax, 1
add rsp, 0x30
pop rbx
ret
cmp ecx, 0xfffe
jne 0x180014968
mov ecx, dword [rbx + 0x1000458]
add rcx, 0xb
jmp 0x18001498e
cmp ecx, 0xfffd
jne 0x18001497c
mov ecx, dword [rbx + 0x1000458]
add rcx, 6
jmp 0x18001498e
cmp ecx, 0xfffc
mov ecx, dword [rbx + 0x1000458]
je 0x180014976
add rcx, 7
add rcx, rax
mov qword [0x18007b8f8], rcx
call fcn.180018240
mov eax, 1
add rsp, 0x30
pop rbx
ret
add rsp, 0x30
pop rbx
ret
Function at 0x1800189f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x18007c140]
xor ebx, ebx
lea rcx, [0x18007adf0]
lea r8d, [rbx + 0x60]
xor edx, edx
mov dword [0x18007b9c0], ebx
mov dword [0x180076dd0], ebx
mov dword [0x18007b914], ebx
mov dword [0x18007b9f0], ebx
mov dword [0x18007b910], ebx
mov dword [0x18007b0e0], ebx
mov dword [0x18007ade0], ebx
mov dword [0x18007b9e8], ebx
mov dword [0x18007ae70], ebx
mov dword [0x18007adec], ebx
mov dword [0x18007b8f4], ebx
mov dword [0x180048620], 1
mov dword [0x18004861c], 1
mov dword [0x18007b9c8], ebx
mov dword [0x180076dd4], ebx
mov dword [0x180048624], 1
mov dword [0x18007b0bc], ebx
mov dword [0x18007b0e4], ebx
mov dword [0x18007b9b4], ebx
mov qword [0x180076dc8], rbx
mov qword [0x18007b908], rbx
mov qword [0x18007b0c0], rbx
mov qword [0x18007b9a8], rbx
mov dword [0x180048618], 1
mov dword [0x180048610], 1
mov dword [0x18007b0dc], ebx
mov dword [0x18007b934], ebx
mov dword [0x18007b92c], ebx
mov qword [0x180076db8], rbx
mov qword [0x18007c148], rax
call fcn.180008040
lea r8d, [rbx + 0x60]
lea rcx, [0x18007b940]
xor edx, edx
call fcn.180008040
mov dword [0x18007b0cc], ebx
mov dword [0x18007ade4], ebx
movsd xmm0, qword [0x180041638]
movsd qword [0x180048628], xmm0
mov dword [0x180076dc4], ebx
mov dword [0x18007b924], ebx
mov dword [0x18007b8f0], ebx
mov dword [0x18007ae78], ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x180076dd8]
mov dword [0x18007b9b0], eax
mov dword [0x18007b930], eax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x180076dd8]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x6d6e6977
mov dword [rbp - 0x1c], 0x6c642e6d
mov word [rbp - 0x18], 0x6c
mov qword [0x180076db0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180018bbb
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x10], 0x656d6974
mov dword [rbp - 0xc], 0x54746547
mov dword [rbp - 8], 0x656d69
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180018bbb
call rax
mov dword [0x18007ae7c], eax
mov dword [0x18007b0d8], eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x180018bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18007ae50]
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x180018c56
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x6c64746e
mov dword [rbp - 0x2c], 0x6c642e6c
mov word [rbp - 0x28], 0x6c
mov dword [rbp - 0x20], 0x466c7452
mov dword [rbp - 0x1c], 0x6873756c
mov dword [rbp - 0x18], 0x75636553
mov dword [rbp - 0x14], 0x654d6572
mov dword [rbp - 0x10], 0x79726f6d
mov dword [rbp - 0xc], 0x68636143
mov word [rbp - 8], 0x65
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007ae50], rax
mov rdx, rbx
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18001a530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp qword [0x18007ba50], 0
je 0x18001a54e
mov eax, 1
add rsp, 0x50
pop rbp
ret
mov rcx, qword [sym.imp.USER32.dll_GetCursorPos]
mov r8d, 0x14
call fcn.18001aae0
mov rcx, qword [sym.imp.USER32.dll_GetCursorPos]
mov r8d, 0xa
mov qword [0x18007ba50], rax
call fcn.18001a9e0
mov dword [0x18007ba20], eax
call fcn.18001a6f0
test eax, eax
jne 0x18001a60c
mov rcx, qword [sym.imp.USER32.dll_SetCursorPos]
lea r8d, [rax + 0xd]
call fcn.18001a9e0
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x72657375
mov dword [rbp - 0x2c], 0x642e3233
mov word [rbp - 0x28], 0x6c6c
mov byte [rbp - 0x26], 0
mov dword [0x18007ba34], eax
mov dword [rbp - 0x20], 0x50746553
mov dword [rbp - 0x1c], 0x69737968
mov dword [rbp - 0x18], 0x436c6163
mov dword [rbp - 0x14], 0x6f737275
mov dword [rbp - 0x10], 0x736f5072
mov byte [rbp - 0xc], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, 0xd
mov rcx, rax
call fcn.18001a9e0
mov dword [0x18007b9f8], eax
xor eax, eax
cmp qword [0x18007ba50], rax
setne al
add rsp, 0x50
pop rbp
ret

Function at 0x18001a630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp qword [0x18007ba10], 0
je 0x18001a64e
mov eax, 1
add rsp, 0x50
pop rbp
ret
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x336e6977
mov dword [rbp - 0x2c], 0x642e7532
mov word [rbp - 0x28], 0x6c6c
mov byte [rbp - 0x26], 0
mov dword [rbp - 0x20], 0x7355744e
mov dword [rbp - 0x1c], 0x65477265
mov dword [rbp - 0x18], 0x72754374
mov dword [rbp - 0x14], 0x50726f73
mov word [rbp - 0x10], 0x736f
mov byte [rbp - 0xe], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001a6ca
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov qword [0x18007ba10], rax
xor eax, eax
test rcx, rcx
setne al
add rsp, 0x50
pop rbp
ret
mov rcx, qword [0x18007ba10]
xor eax, eax
test rcx, rcx
setne al
add rsp, 0x50
pop rbp
ret
Function at 0x18001a6f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
cmp qword [0x18007ba28], 0
jne 0x18001a81b
cmp qword [0x18007ba00], 0
jne 0x18001a81b
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x336e6977
mov dword [rbp - 0x4c], 0x642e7532
mov word [rbp - 0x48], 0x6c6c
mov byte [rbp - 0x46], 0
mov dword [rbp - 0x20], 0x7355744e
mov dword [rbp - 0x1c], 0x65537265
mov dword [rbp - 0x18], 0x72754374
mov dword [rbp - 0x14], 0x50726f73
mov word [rbp - 0x10], 0x736f
mov byte [rbp - 0xe], 0
mov dword [rbp - 0x40], 0x72657375
mov dword [rbp - 0x3c], 0x642e3233
mov word [rbp - 0x38], 0x6c6c
mov byte [rbp - 0x36], 0
mov dword [rbp - 0x30], 0x43746553
mov dword [rbp - 0x2c], 0x6f737275
mov dword [rbp - 0x28], 0x736f5072
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001a7ff
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [rax], 0xff
jne 0x18001a7b5
cmp byte [rax + 1], 0x25
je 0x18001a7c1
cmp byte [rax + 1], 0xff
jne 0x18001a7e1
cmp byte [rax + 2], 0x25
jne 0x18001a7e1
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007ba00], rax
jmp 0x18001a7ff
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007ba28], rax
cmp qword [0x18007ba28], 0
jne 0x18001a81b
cmp qword [0x18007ba00], 0
jne 0x18001a81b
xor eax, eax
add rsp, 0x70
pop rbp
ret
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x18001b560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
xor r13d, r13d
mov r15, rcx
lea rcx, [rsp + 0x50]
mov edi, r13d
mov r12, rdx
mov dword [rsp + 0x50], 0x6c64746e
mov dword [rsp + 0x54], 0x6c642e6c
mov dword [rsp + 0x58], 0x6c
mov dword [rsp + 0x30], 0x7551775a
mov byte [rsp + 0x5c], dil
mov dword [rsp + 0x48], edi
mov byte [rsp + 0x4c], dil
mov dword [rsp + 0x34], 0x56797265
mov dword [rsp + 0x38], 0x75747269
mov dword [rsp + 0x3c], 0x654d6c61
mov qword [rsp + 0x40], 0x79726f6d
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x18001b6fe
mov qword [rsp + 0x360], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, rax
test rax, rax
je 0x18001b6f4
lea rcx, [rbp - 0x60]
xor edx, edx
mov r8d, 0x80
call fcn.180008040
lea rax, [rbp - 0x60]
or r9d, 0xffffffff
mov r8, r15
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x3c
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r15d, 0x80000000
nop dword [rax + rax]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x30
call r14
test eax, eax
js 0x18001b6e4
cmp dword [rbp - 0x68], 0x1000000
jne 0x18001b6e4
cmp qword [rsp + 0x78], rdi
je 0x18001b6e4
lea r9, [rbp + 0x20]
mov r8d, 2
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x20c
call r14
test eax, eax
js 0x18001b6e4
mov rcx, qword [rbp + 0x28]
mov edx, 0x5c
call fcn.1800038b4
lea rcx, [rbp - 0x60]
lea rdx, [rax + 2]
call fcn.180003740
test eax, eax
jne 0x18001b6e4
cmp rbx, r12
jne 0x18001b71b
test rdi, rdi
jne 0x18001b71b
mov rdi, qword [rsp + 0x78]
add rbx, 0x10000
cmp rbx, r15
jb 0x18001b660
xor eax, eax
mov rsi, qword [rsp + 0x360]
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, rbx
jmp 0x18001b6f6
Function at 0x18001d840
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6778645c
mov dword [rsp + 0x24], 0x6c642e69
mov word [rsp + 0x28], 0x6c
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d8b8
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d8ad
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d8d0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x2e747570
mov dword [rsp + 0x28], 0x6c6c64
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d949
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d93e
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d960
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x2e747570
mov dword [rsp + 0x28], 0x6c6c64
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d9d9
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d9ce
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d9f0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x38747570
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001da6e
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001da63
add rax, rbx
add rsp, 0x230
pop rbx
ret
Function at 0x18001da90
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x38747570
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001db0e
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001db03
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001db30
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x7264645c
mov dword [rsp + 0x24], 0x642e7761
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x2a], 0
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001dbad
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001dba2
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001dbd0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6433645c
mov dword [rsp + 0x24], 0x6c642e39
mov word [rsp + 0x28], 0x6c
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001dc48
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001dc3d
add rax, rbx
add rsp, 0x230
pop rbx
ret