joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012050
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r12
push r14
sub rsp, 0x58
or ebx, 0xffffffff
xor r12d, r12d
mov r14, r8
mov edi, 0x80000
test rcx, rcx
je 0x1400122bb
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x20], 3
call qword [0x14001bb1c]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400122b6
mov rcx, qword [0x14001c9f4]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x48], r13
call qword [0x14001bab4]
mov r13, rax
test rax, rax
je 0x1400122a8
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x50], rsi
test rax, rax
jle 0x140012103
lea r8, [rsp + 0x8c]
xor r9d, r9d
mov edx, eax
mov rcx, r15
call qword [0x14001bb34]
lea ebp, [r14 + 0x80000]
lea rsi, [0x140019cd0]
add r12d, 0x80000
sub ebp, 0x80000
cmp r14, 0xffffffffffffffff
je 0x14001212d
movsxd rax, r12d
cmp rax, r14
cmovg edi, ebp
lea r9, [rsp + 0x80]
mov r8d, edi
mov rdx, r13
mov rcx, r15
mov qword [rsp + 0x20], 0
call qword [0x14001bb24]
mov r10d, dword [rsp + 0x80]
mov r11, r13
mov r9d, r10d
cmp r10d, 8
jb 0x14001225b
mov esi, r10d
lea r10, [0x140019cd0]
shr rsi, 3
nop word [rax + rax]
movzx ecx, byte [r11]
mov eax, ebx
shr ebx, 8
xor rcx, rax
add r11, 8
add r9d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r11 - 7]
mov edx, dword [r10 + rax*4]
xor edx, ebx
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 6]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 5]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 4]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 3]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 2]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 1]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ebx, dword [r10 + rax*4]
xor ebx, edx
dec rsi
jne 0x140012180
mov r10d, dword [rsp + 0x80]
lea rsi, [0x140019cd0]
test r9d, r9d
je 0x14001227c
movzx ecx, byte [r11]
mov eax, ebx
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov ebx, dword [rsi + rdx*4]
xor ebx, eax
dec r9d
jne 0x140012260
cmp r10d, 0x80000
je 0x140012111
mov rcx, qword [0x14001c9f4]
mov r8, r13
xor edx, edx
call qword [0x14001babc]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x90]
mov rcx, r15
call qword [0x14001baf4]
mov r13, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
not ebx
movsxd rax, ebx
add rsp, 0x58
pop r14
pop r12
pop rdi
pop rbx
ret
or r8, 0xffffffffffffffff
xor edx, edx
jmp 0x140012050
Function at 0x1400122d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r12
push r14
sub rsp, 0x58
or ebx, 0xffffffff
xor r12d, r12d
mov r14, r8
mov edi, 0x80000
test rcx, rcx
je 0x1400122bb
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x20], 3
call qword [0x14001bb1c]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400122b6
mov rcx, qword [0x14001c9f4]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x48], r13
call qword [0x14001bab4]
mov r13, rax
test rax, rax
je 0x1400122a8
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x50], rsi
test rax, rax
jle 0x140012103
lea r8, [rsp + 0x8c]
xor r9d, r9d
mov edx, eax
mov rcx, r15
call qword [0x14001bb34]
lea ebp, [r14 + 0x80000]
lea rsi, [0x140019cd0]
add r12d, 0x80000
sub ebp, 0x80000
cmp r14, 0xffffffffffffffff
je 0x14001212d
movsxd rax, r12d
cmp rax, r14
cmovg edi, ebp
lea r9, [rsp + 0x80]
mov r8d, edi
mov rdx, r13
mov rcx, r15
mov qword [rsp + 0x20], 0
call qword [0x14001bb24]
mov r10d, dword [rsp + 0x80]
mov r11, r13
mov r9d, r10d
cmp r10d, 8
jb 0x14001225b
mov esi, r10d
lea r10, [0x140019cd0]
shr rsi, 3
nop word [rax + rax]
movzx ecx, byte [r11]
mov eax, ebx
shr ebx, 8
xor rcx, rax
add r11, 8
add r9d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r11 - 7]
mov edx, dword [r10 + rax*4]
xor edx, ebx
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 6]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 5]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 4]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 3]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 2]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 1]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ebx, dword [r10 + rax*4]
xor ebx, edx
dec rsi
jne 0x140012180
mov r10d, dword [rsp + 0x80]
lea rsi, [0x140019cd0]
test r9d, r9d
je 0x14001227c
movzx ecx, byte [r11]
mov eax, ebx
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov ebx, dword [rsi + rdx*4]
xor ebx, eax
dec r9d
jne 0x140012260
cmp r10d, 0x80000
je 0x140012111
mov rcx, qword [0x14001c9f4]
mov r8, r13
xor edx, edx
call qword [0x14001babc]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x90]
mov rcx, r15
call qword [0x14001baf4]
mov r13, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
not ebx
movsxd rax, ebx
add rsp, 0x58
pop r14
pop r12
pop rdi
pop rbx
ret
or r8, 0xffffffffffffffff
xor edx, edx
jmp 0x140012050
Function at 0x1400022bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002306
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002306
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002306
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002306
cmp dword [rcx + 0x84], 0xe
jbe 0x140002306
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002308
xor al, al
add rsp, 0x28
ret
Function at 0x1400701b0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400701bd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400701cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400701b5
lea eax, [rcx + 1]
jmp 0x1400701db
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400701ee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400701d4
sub eax, 3
jb 0x14007020e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14007025d
sar eax, 1
movsxd rbp, eax
jb 0x140070244
jmp 0x14007021c
add ebx, ebx
jne 0x14007021a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140070244
inc ecx
add ebx, ebx
jne 0x14007022a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140070244
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14007023d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14007022c
add ecx, 2
jmp 0x140070249
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140070172
jmp 0x1400701bd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x28400
mov dl, 0x12
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400702a9
cmp rsi, rcx
jae 0x1400702b1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140070290
cmp al, 0x8f
ja 0x140070290
cmp byte [rsi - 2], 0xf
je 0x140070296
sub al, 0xe8
cmp al, 1
ja 0x14007027a
cmp rsi, rcx
jae 0x1400702b1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140070280
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400702b1
lodsb al, byte [rsi]
jmp 0x140070290
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x6e000]
mov eax, dword [rdi]
or eax, eax
je 0x14007031a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x8d010]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400702be
jns 0x1400702f3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1400702fd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140070314
mov qword [rbx], rax
add rbx, 8
jmp 0x1400702de
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140070354
cmp al, 0xef
ja 0x140070346
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140070326
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140070335
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400703a8
sub rsp, 0xffffffffffffff80
jmp 0x14000add0
Function at 0x1405b4058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1405b41df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405b4089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405b406f
add dl, dl
jne 0x1405b4096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405b40f6
xor eax, eax
add dl, dl
jne 0x1405b40a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405b41ad
add dl, dl
jne 0x1405b40b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b40c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b40d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b40dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405b40ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405b407e
mov eax, 1
add dl, dl
jne 0x1405b4106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b4113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405b40fb
sub eax, ebx
mov ebx, 1
jne 0x1405b414c
mov ecx, 1
add dl, dl
jne 0x1405b412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405b413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405b4123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405b407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405b4168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405b4175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405b415d
cmp eax, 0x7d00
jae 0x1405b419b
cmp eax, 0x500
jb 0x1405b4196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405b407e
cmp eax, 0x7f
ja 0x1405b419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405b407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405b41d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405b407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x1800262e0
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x18
xor eax, eax
test eax, eax
je 0x1800262ff
movsx eax, byte [rsp + 0x28]
or eax, 0x20
mov dword [rsp], eax
jmp 0x180026307
movsx eax, byte [rsp + 0x28]
mov dword [rsp], eax
mov eax, dword [rsp]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
imul eax, eax, 0x1000193
add rsp, 0x18
ret
Function at 0x18001eda0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x18001edd4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18001edc0
mov rcx, rax
shr rcx, 0x20
xor eax, ecx
ret
Function at 0x180030710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x6c33
lea r8, [0x1800f4728]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xd]
mov dword [rsp + 0x20], 0x6c566c78
mov dword [rsp + 0x24], 0x6c5d6c41
mov dword [rsp + 0x28], 0x6c5f6c56
mov dword [rsp + 0x2c], 0x6c016c00
mov dword [rsp + 0x30], 0x6c576c1d
mov dword [rsp + 0x34], 0x6c5f6c5f
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.18005bcc0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800b33d0
add rsp, 0x130
pop rbp
ret
Function at 0x180030810
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x150], rax
call fcn.18002fef0
test al, al
je 0x180030a64
call fcn.1800114e0
test al, al
jne 0x1800308b5
call fcn.180011550
test al, al
je 0x180030867
call fcn.18005be80
test al, al
sete al
jmp 0x1800308a2
call fcn.1800115c0
test al, al
je 0x18003087c
call fcn.18005bed0
test al, al
sete al
jmp 0x1800308a2
call fcn.180011470
test al, al
je 0x1800308a8
lea rcx, [rsp + 0x90]
call fcn.1800116a0
mov qword [rsp + 0x70], rax
cmp dword [rax + 0xc], 7
je 0x1800308b5
call fcn.18005be80
mov byte [rsp + 0x20], al
jmp 0x1800308ad
call fcn.180011630
test al, al
je 0x180030a64
call fcn.180011550
test al, al
je 0x1800308c9
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
call fcn.180030aa0
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
or rdi, 0xffffffffffffffff
cmp word [rax], bx
jne 0x180030915
mov r8d, ebx
jmp 0x18003092a
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x180030920
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180012660
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.1800710a0
nop
cmp qword [rsp + 0x48], 8
jb 0x18003095d
mov rcx, qword [rsp + 0x30]
call fcn.18008fef0
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
lea rcx, [rsp + 0xb0]
call fcn.180011a00
nop
call fcn.18004df30
mov dl, 1
mov ecx, 0x2718
call fcn.180031df0
call fcn.180011550
test al, al
je 0x1800309b6
xor edx, edx
lea rcx, [0x18005d590]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x18005d590]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x1800309cd
mov rcx, rbx
mov qword [rsp + 0x50], rbx
jmp 0x1800309d5
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.18004f010
nop
cmp qword [rsp + 0xc8], 8
jb 0x1800309fc
mov rcx, qword [rsp + 0xb0]
call fcn.18008fef0
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0xb0], bx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x180030a64
mov qword [rsp + 0x28], rcx
mov eax, edi
lock xadd dword [rcx + 8], eax
dec eax
jne 0x180030a64
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x180030a64
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
call fcn.18005bf40
cmp qword [0x1800f30c8], 0
je 0x180030a78
call fcn.180030630
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800b33d0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x180031770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800f47a0]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xa]
mov r9d, 0x2e03
mov dword [rsp + 0x20], 0x2e622e54
mov dword [rsp + 0x24], 0x2e622e69
mov dword [rsp + 0x28], 0x2e6d2e4a
mov dword [rsp + 0x2c], 0x2e462e77
mov qword [rsp + 0x30], 0x2e032e6d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.18005bcc0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800b33d0
add rsp, 0x130
pop rbp
ret
Function at 0x18004b410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x2658
lea r8, [0x1800f4f00]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x2630263b
mov dword [rsp + 0x24], 0x2637262a
mov dword [rsp + 0x28], 0x263d2635
mov dword [rsp + 0x2c], 0x263c2676
mov dword [rsp + 0x30], 0x26342634
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.18005bcc0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800b33d0
add rsp, 0x130
pop rbp
ret

Function at 0x18004b5a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x4d1b
lea r8, [0x1800f4f28]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x4d734d78
mov dword [rsp + 0x24], 0x4d744d69
mov dword [rsp + 0x28], 0x4d7e4d76
mov dword [rsp + 0x2c], 0x4d7f4d35
mov dword [rsp + 0x30], 0x4d774d77
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.18005bcc0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800b33d0
add rsp, 0x130
pop rbp
ret
Function at 0x18004c180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800f4f98]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xa]
mov r9d, 0x2e03
mov dword [rsp + 0x20], 0x2e732e6c
mov dword [rsp + 0x24], 0x2e712e66
mov dword [rsp + 0x28], 0x2e2d2e62
mov dword [rsp + 0x2c], 0x2e7b2e66
mov qword [rsp + 0x30], 0x2e032e66
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.18005bcc0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800b33d0
add rsp, 0x130
pop rbp
ret
Function at 0x18004dc50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800f51b8]
lea rcx, [rsp + 0x20]
lea edx, [rax + 8]
mov r9d, 0x4504
mov dword [rsp + 0x20], 0x45564554
mov dword [rsp + 0x24], 0x4556455b
mov dword [rsp + 0x28], 0x45654561
mov qword [rsp + 0x2c], 0x45044560
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.18005bcc0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800b33d0
add rsp, 0x130
pop rbp
ret