joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180092ccc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0448]
mov rbx, rdx
test rax, rax
jne 0x180092d6f
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180092d24
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0448], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0448]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180092d98
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180092dc4
cmp dword [rbp - 0x10], 0x10000
je 0x180092dc4
cmp qword [rbp - 0x18], 0x1000
jb 0x180092dc4
cmp dword [rbp - 8], 0x1000000
je 0x180092dc0
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180092dc6
mov al, 1
jmp 0x180092dc6
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800933a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0490]
mov rbx, rdx
test rax, rax
jne 0x18009344b
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180093400
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0490], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0490]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180093474
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800934a0
cmp dword [rbp - 0x10], 0x10000
je 0x1800934a0
cmp qword [rbp - 0x18], 0x1000
jb 0x1800934a0
cmp dword [rbp - 8], 0x1000000
je 0x18009349c
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1800934a2
mov al, 1
jmp 0x1800934a2
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800983a8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rdi
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x180098407
lea r8, [r9 + 8]
mov r11d, 0x7fffffff
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, r11d
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1800983c7
mov ecx, dword [r9]
jmp 0x1800984e5
cmp ecx, 0x4e0
jb 0x1800984e5
lea r10, [r9 + 0x9c4]
mov edi, 0xe3
mov eax, dword [r10]
mov r11d, 0x7fffffff
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub rdi, 1
jne 0x180098428
lea r10, [r9 + 0xd50]
mov edi, 0x18c
mov eax, dword [r10]
mov edx, eax
lea r8, [r10 + 4]
xor edx, dword [r8]
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub rdi, 1
jne 0x180098471
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
and edx, r11d
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rdi, qword [rsp + 8]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret
Function at 0x18009b604
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
xor eax, eax
shr r9, 2
test r9, r9
je 0x18009b61e
xor dword [rcx + rax*4], r8d
inc rax
cmp rax, r9
jb 0x18009b612
lea rax, [r9*4]
jmp 0x18009b62f
xor byte [rax + rcx], r8b
inc rax
cmp rax, rdx
jb 0x18009b628
ret

Function at 0x18009b638
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x130
mov r14, qword [r9 + 8]
xor edi, edi
sub r14, qword [r9]
mov r15, r9
mov qword [rdx], rdi
mov rbp, r8
mov qword [rdx + 8], rdi
mov rsi, rdx
mov qword [rdx + 0x10], rdi
add r14, 1
je 0x18009b69a
mov rdx, r14
mov rcx, rsi
call fcn.1800aea1c
mov rbx, qword [rsi]
mov r8, r14
mov rcx, rbx
xor edx, edx
call qword [sym.imp.VCRUNTIME140.dll_memset]
lea rax, [r14 + rbx]
mov qword [rsi + 8], rax
mov r11, qword [rbp]
mov rbx, rdi
mov r10, qword [rbp + 8]
mov rax, rdi
sub r10, r11
mov ebp, pe_nt_image_headers64
mov byte [rsp + rax + 0x30], al
inc rax
cmp rax, rbp
jb 0x18009b6b0
mov r9, rdi
movzx r8d, byte [rsp + r9 + 0x30]
xor edx, edx
mov rax, r9
div r10
movzx ecx, byte [rdx + r11]
add rcx, rbx
add rcx, r8
movzx ebx, cl
mov al, byte [rsp + rbx + 0x30]
mov byte [rsp + r9 + 0x30], al
inc r9
mov byte [rsp + rbx + 0x30], r8b
cmp r9, rbp
jb 0x18009b6bf
mov r8, qword [r15 + 8]
mov r10, rdi
mov r9, rdi
sub r8, qword [r15]
je 0x18009b747
lea rax, [rdi + 1]
movzx edi, al
movzx ecx, byte [rsp + rdi + 0x30]
lea rax, [rcx + r10]
movzx r10d, al
mov al, byte [rsp + r10 + 0x30]
mov byte [rsp + rdi + 0x30], al
mov byte [rsp + r10 + 0x30], cl
movzx eax, byte [rsp + rdi + 0x30]
add rax, rcx
movzx ecx, al
mov rax, qword [r15]
mov dl, byte [rsp + rcx + 0x30]
xor dl, byte [rax + r9]
mov rax, qword [rsi]
mov byte [r9 + rax], dl
inc r9
cmp r9, r8
jb 0x18009b700
lea r11, [rsp + 0x130]
mov rax, rsi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1800a0980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0580]
mov rbx, rdx
test rax, rax
jne 0x1800a0a23
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1800a09d8
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0580], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0580]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1800a0a4c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800a0a78
cmp dword [rbp - 0x10], 0x10000
je 0x1800a0a78
cmp qword [rbp - 0x18], 0x1000
jb 0x1800a0a78
cmp dword [rbp - 8], 0x1000000
je 0x1800a0a74
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1800a0a7a
mov al, 1
jmp 0x1800a0a7a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800a2944
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0588]
mov rbx, rdx
test rax, rax
jne 0x1800a29e7
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1800a299c
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0588], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0588]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1800a2a10
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800a2a3c
cmp dword [rbp - 0x10], 0x10000
je 0x1800a2a3c
cmp qword [rbp - 0x18], 0x1000
jb 0x1800a2a3c
cmp dword [rbp - 8], 0x1000000
je 0x1800a2a38
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1800a2a3e
mov al, 1
jmp 0x1800a2a3e
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800a4908
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0608]
mov rbx, rdx
test rax, rax
jne 0x1800a49ab
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1800a4960
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0608], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0608]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1800a49d4
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800a4a00
cmp dword [rbp - 0x10], 0x10000
je 0x1800a4a00
cmp qword [rbp - 0x18], 0x1000
jb 0x1800a4a00
cmp dword [rbp - 8], 0x1000000
je 0x1800a49fc
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1800a4a02
mov al, 1
jmp 0x1800a4a02
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800a68cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c05d8]
mov rbx, rdx
test rax, rax
jne 0x1800a696f
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1800a6924
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c05d8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c05d8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1800a6998
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800a69c4
cmp dword [rbp - 0x10], 0x10000
je 0x1800a69c4
cmp qword [rbp - 0x18], 0x1000
jb 0x1800a69c4
cmp dword [rbp - 8], 0x1000000
je 0x1800a69c0
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1800a69c6
mov al, 1
jmp 0x1800a69c6
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800a8890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0648]
mov rbx, rdx
test rax, rax
jne 0x1800a8933
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1800a88e8
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0648], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0648]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1800a895c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800a8988
cmp dword [rbp - 0x10], 0x10000
je 0x1800a8988
cmp qword [rbp - 0x18], 0x1000
jb 0x1800a8988
cmp dword [rbp - 8], 0x1000000
je 0x1800a8984
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1800a898a
mov al, 1
jmp 0x1800a898a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800aa854
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0590]
mov rbx, rdx
test rax, rax
jne 0x1800aa8f7
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1800aa8ac
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0590], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0590]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1800aa920
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800aa94c
cmp dword [rbp - 0x10], 0x10000
je 0x1800aa94c
cmp qword [rbp - 0x18], 0x1000
jb 0x1800aa94c
cmp dword [rbp - 8], 0x1000000
je 0x1800aa948
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1800aa94e
mov al, 1
jmp 0x1800aa94e
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800ac818
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c05f8]
mov rbx, rdx
test rax, rax
jne 0x1800ac8bb
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1800ac870
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c05f8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c05f8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1800ac8e4
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800ac910
cmp dword [rbp - 0x10], 0x10000
je 0x1800ac910
cmp qword [rbp - 0x18], 0x1000
jb 0x1800ac910
cmp dword [rbp - 8], 0x1000000
je 0x1800ac90c
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1800ac912
mov al, 1
jmp 0x1800ac912
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800ae7dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0690]
mov rbx, rdx
test rax, rax
jne 0x1800ae87f
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1800ae834
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0690], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0690]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1800ae8a8
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800ae8d4
cmp dword [rbp - 0x10], 0x10000
je 0x1800ae8d4
cmp qword [rbp - 0x18], 0x1000
jb 0x1800ae8d4
cmp dword [rbp - 8], 0x1000000
je 0x1800ae8d0
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1800ae8d6
mov al, 1
jmp 0x1800ae8d6
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800f1c50
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x34
jb 0x1800f1c5d
mov word [rcx + 0x6c], r11w
ret

Function at 0x1800f1ca0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xf
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f1cad
xor edx, edx
mov word [rcx + 0x22], dx
ret

Function at 0x1800f1d20
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x32
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f1d2d
xor edx, edx
mov word [rcx + 0x68], dx
ret

Function at 0x1800f1d80
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x15
jb 0x1800f1d8d
mov word [rcx + 0x2e], r11w
ret

Function at 0x1800f1de4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x37
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f1df1
xor edx, edx
mov word [rcx + 0x72], dx
ret

Function at 0x1800f1e28
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x29
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f1e35
xor edx, edx
mov word [rcx + 0x56], dx
ret

Function at 0x1800f1e74
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x29
jb 0x1800f1e81
mov word [rcx + 0x56], r11w
ret

Function at 0x1800f1ebc
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x2c
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f1ec9
xor edx, edx
mov word [rcx + 0x5c], dx
ret

Function at 0x1800f1f1c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x28
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f1f29
xor edx, edx
mov word [rcx + 0x54], dx
ret

Function at 0x1800f1f8c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x2b
jb 0x1800f1f99
mov word [rcx + 0x5a], r11w
ret