joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180008e74
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov word [rbp - 0x20], 0x6547
mov dword [rbp - 0x1d], 0x74737953
mov dword [rbp - 0x16], 0x6f666e
mov word [rbp - 0x19], 0x6d65
mov byte [rbp - 0x17], 0x49
mov byte [rbp - 0x1e], 0x74
call fcn.180008900
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008ed0
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x180008ee8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov dword [rbp - 0x14], 0x74786574
mov byte [rbp - 0x10], bl
mov rsi, rdx
mov rdi, rcx
mov word [rbp - 0x1d], 0x6854
mov dword [rbp - 0x18], 0x6e6f4364
mov word [rbp - 0x20], 0x6547
mov word [rbp - 0x1a], 0x6165
mov byte [rbp - 0x1e], 0x74
mov byte [rbp - 0x1b], 0x72
call fcn.180008900
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008f59
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x180008f74
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
mov word [rbp - 0x20], 0x6547
mov ebx, 0x7fffffff
mov dword [rbp - 0x16], 0x726f6972
mov dword [rbp - 0x12], 0x797469
mov word [rbp - 0x1d], 0x6854
mov dword [rbp - 0x1a], 0x50646165
mov byte [rbp - 0x1e], 0x74
mov byte [rbp - 0x1b], 0x72
call fcn.180008900
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008fe3
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x180009004
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov word [rbp - 0x28], 0x657a
mov dword [rbp - 0x21], 0x536c6163
mov dword [rbp - 0x1d], 0x69746365
mov word [rbp - 0x19], 0x6e6f
mov dword [rbp - 0x25], 0x69746972
mov dword [rbp - 0x30], 0x74696e49
mov dword [rbp - 0x2c], 0x696c6169
mov byte [rbp - 0x17], 0
mov byte [rbp - 0x26], 0x43
call fcn.180008900
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009075
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18000908c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov dword [rbp - 0x1d], 0x72436576
mov dword [rbp - 0x13], 0x74636553
mov dword [rbp - 0x17], 0x6c616369
mov word [rbp - 0x20], 0x654c
mov word [rbp - 0x19], 0x7469
mov word [rbp - 0xe], 0x6e6f
mov byte [rbp - 0xf], 0x69
mov byte [rbp - 0x1e], 0x61
mov byte [rbp - 0xc], 0
call fcn.180008900
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800090f9
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
lea rcx, [0x180051a08]
jmp 0x18000908c

Function at 0x180009110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov word [rbp - 0x16], 0x4179
mov byte [rbp - 0x14], bl
mov rdi, rcx
mov dword [rbp - 0x1b], 0x61726269
mov dword [rbp - 0x20], 0x64616f4c
mov byte [rbp - 0x17], 0x72
mov byte [rbp - 0x1c], 0x4c
call fcn.180008900
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009173
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x180009194
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14d, r8d
mov word [rbp - 0x17], 0x64
mov esi, edx
mov dword [rbp - 0x1c], 0x65726854
mov edi, ecx
mov dword [rbp - 0x20], 0x6e65704f
xor ebx, ebx
mov byte [rbp - 0x18], 0x61
call fcn.180008900
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800091f4
mov r8d, r14d
mov edx, esi
mov ecx, edi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000b910
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180009298
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, qword [rbp + 0x60]
mov r15d, r9d
mov r14d, r8d
mov rsi, rdx
mov rdi, rcx
mov ebx, 1
call fcn.1800088a4
test rax, rax
je 0x180009327
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1c], 0x6570
mov rcx, rax
mov word [rbp - 0x1f], 0x6765
mov dword [rbp - 0x17], 0x41784579
mov byte [rbp - 0x13], 0
mov byte [rbp - 0x20], 0x52
mov word [rbp - 0x19], 0x654b
mov byte [rbp - 0x1a], 0x6e
mov byte [rbp - 0x1d], 0x4f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009327
mov r9d, r15d
mov qword [rsp + 0x20], r12
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000b910
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x180009344
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, qword [rbp + 0x68]
mov r15, r9
mov r13, qword [rbp + 0x70]
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov ebx, 1
call fcn.1800088a4
test rax, rax
je 0x1800093da
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x20], 0x756c6156
mov rcx, rax
mov dword [rbp - 0x28], 0x51676552
mov dword [rbp - 0x24], 0x79726575
mov word [rbp - 0x19], 0x41
mov word [rbp - 0x1c], 0x4565
mov byte [rbp - 0x1a], 0x78
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800093da
mov qword [rsp + 0x28], r13
mov r9, r15
mov r8, r14
mov qword [rsp + 0x20], r12
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000b910
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1800093fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov word [rbp - 0x1d], 0x6d75
or ebx, 0xffffffff
mov dword [rbp - 0x17], 0x646165
mov word [rbp - 0x1a], 0x6854
mov word [rbp - 0x1f], 0x7365
mov byte [rbp - 0x18], 0x72
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0x1b], 0x65
call fcn.180008900
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009465
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x180009484
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov word [rbp - 0x11], 0x7974
mov byte [rbp - 0xf], bl
mov esi, edx
mov rdi, rcx
mov dword [rbp - 0x20], 0x54746553
mov word [rbp - 0x1c], 0x7268
mov word [rbp - 0x14], 0x726f
mov dword [rbp - 0x19], 0x72506461
mov byte [rbp - 0x12], 0x69
mov byte [rbp - 0x15], 0x69
mov byte [rbp - 0x1a], 0x65
call fcn.180008900
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800094f7
mov edx, esi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000956c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov dword [rbp - 0x1c], 0x54646e65
or ebx, 0xffffffff
mov dword [rbp - 0x18], 0x61657268
mov dword [rbp - 0x20], 0x70737553
mov word [rbp - 0x14], 0x64
call fcn.180008900
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800095cb
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1800095ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov dword [rbp - 0x1a], 0x69463233
mov byte [rbp - 0x13], bl
mov rsi, rdx
mov rdi, rcx
mov dword [rbp - 0x1e], 0x64616572
mov word [rbp - 0x15], 0x7473
mov word [rbp - 0x20], 0x6854
mov byte [rbp - 0x16], 0x72
call fcn.180008900
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009653
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x180009670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov word [rbp - 0x1d], 0x6165
mov byte [rbp - 0x14], bl
mov rsi, rdx
mov rdi, rcx
mov dword [rbp - 0x1a], 0x654e3233
mov word [rbp - 0x16], 0x7478
mov word [rbp - 0x20], 0x6854
mov byte [rbp - 0x1e], 0x72
mov byte [rbp - 0x1b], 0x64
call fcn.180008900
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800096da
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800096f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r15d, r9d
mov dword [rbp - 0x24], 0x416c6175
mov r14d, r8d
mov dword [rbp - 0x1f], 0x636f6c
mov rsi, rdx
mov dword [rbp - 0x28], 0x74726956
mov rdi, rcx
mov byte [rbp - 0x20], 0x6c
xor ebx, ebx
call fcn.180008900
mov rcx, rax
lea rdx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009765
mov r9d, r15d
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.18000b910
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x18000980c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, qword [rbp + 0x60]
mov r15d, r9d
mov r14, r8
mov word [rbp - 0x20], 0x6956
mov rsi, rdx
mov dword [rbp - 0x1d], 0x6c617574
mov rdi, rcx
mov dword [rbp - 0x13], 0x784574
xor ebx, ebx
mov dword [rbp - 0x19], 0x746f7250
mov byte [rbp - 0x1e], 0x72
mov word [rbp - 0x15], 0x6365
call fcn.180008900
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000988f
mov r9d, r15d
mov qword [rsp + 0x20], r12
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000b910
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1800098ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov word [rbp - 0x1d], 0x7574
mov byte [rbp - 0x14], bl
mov r14, r8
mov rsi, rdx
mov dword [rbp - 0x18], 0x79726575
mov rdi, rcx
mov word [rbp - 0x20], 0x6956
mov word [rbp - 0x1a], 0x516c
mov byte [rbp - 0x1b], 0x61
mov byte [rbp - 0x1e], 0x72
call fcn.180008900
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000991c
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000b910
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800099b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x104
call fcn.18000ca50
lea rcx, [rsp + 0x30]
mov word [rsp + 0x56], 0x4552
mov word [rsp + 0x51], 0x464f
mov word [rsp + 0x59], 0x7325
mov word [rsp + 0x54], 0x4157
mov byte [rsp + 0x53], 0x54
mov byte [rsp + 0x58], 0x5c
mov byte [rsp + 0x5b], 0
mov byte [rsp + 0x50], 0x53
call fcn.18000b42c
mov rcx, rax
call fcn.18000b708
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.18000b7cc
lea rcx, [rsp + 0x30]
call fcn.18000b3e4
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18000b3ac
mov rax, rbx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rbp
ret

Function at 0x180009a88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp + 0x150], rax
cmp edx, 1
jne 0x180009b7d
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x69
mov dword [rsp + 0x34], 0x700070
mov word [rsp + 0x20], ax
lea rdx, [rsp + 0x20]
mov eax, 0x20
mov dword [rsp + 0x3c], 0x74
lea rcx, [rsp + 0x40]
mov word [rsp + 0x2e], ax
mov dword [rsp + 0x26], 0x610074
mov dword [rsp + 0x2a], 0x74006e
mov dword [rsp + 0x22], 0x73006e
mov dword [rsp + 0x38], 0x72006f
mov dword [rsp + 0x30], 0x750073
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180009bb1
lea rdx, [sym.drvhlp.dll_pjhu2q]
lea rcx, [0x1800519e8]
call fcn.18000ab74
lea rdx, [sym.drvhlp.dll_yevqvj]
lea rcx, [0x180051968]
call fcn.18000ab74
lea rdx, [sym.drvhlp.dll_pdqtzl]
lea rcx, [0x1800519a8]
call fcn.18000ab74
lea rdx, [sym.drvhlp.dll_gbqfec]
lea rcx, [0x180051998]
call fcn.18000ab74
jmp 0x180009bb1
test edx, edx
jne 0x180009bb1
lea rcx, [0x1800519e8]
call fcn.18000a0d4
lea rcx, [0x180051968]
call fcn.18000a0d4
lea rcx, [0x1800519a8]
call fcn.18000a0d4
lea rcx, [0x180051998]
call fcn.18000a0d4
mov eax, 1
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rbp
ret
Function at 0x180009ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r15, r9
mov r14, r8
mov esi, edx
mov rdi, rcx
xor ebx, ebx
call fcn.180008954
test rax, rax
je 0x180008a1c
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x27], 0x4e6c6c61
mov rcx, rax
mov dword [rbp - 0x23], 0x48747865
mov word [rbp - 0x1f], 0x6f6f
mov word [rbp - 0x1c], 0x7845
mov byte [rbp - 0x28], 0x43
mov byte [rbp - 0x1a], bl
mov byte [rbp - 0x1d], 0x6b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008a1c
mov r9, r15
mov r8, r14
mov edx, esi
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.18000b910
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r9, r8
mov r8, rdx
mov edx, ecx
xor ecx, ecx
jmp 0x1800089a0

Function at 0x18000a4ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
call fcn.180008954
test rax, rax
je 0x18000a509
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1f], 0x676e6972
mov rcx, rax
mov byte [rbp - 0x20], 0x42
mov dword [rbp - 0x17], 0x6f54776f
mov dword [rbp - 0x1b], 0x646e6957
mov word [rbp - 0x12], 0x706f
mov byte [rbp - 0x10], bl
mov byte [rbp - 0x13], 0x54
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x18000a524
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
call fcn.180008954
test rax, rax
je 0x18000a57c
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x41746553
mov rcx, rax
mov dword [rbp - 0x1a], 0x57657669
mov word [rbp - 0x1c], 0x7463
mov dword [rbp - 0x14], 0x776f64
mov word [rbp - 0x16], 0x6e69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x18000a598
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
call fcn.180008954
test rax, rax
je 0x18000a5f9
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x1b], 0x72676572
mov rcx, rax
mov dword [rbp - 0x16], 0x57646e75
mov dword [rbp - 0x12], 0x6f646e69
mov dword [rbp - 0x20], 0x46746553
mov word [rbp - 0xe], 0x77
mov byte [rbp - 0x1c], 0x6f
mov byte [rbp - 0x17], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x18000a614
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180050e78]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
call fcn.180008954
test rax, rax
je 0x18000a664
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x17], 0x736f50
mov rcx, rax
mov dword [rbp - 0x20], 0x57746553
mov dword [rbp - 0x1b], 0x776f646e
mov byte [rbp - 0x1c], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000b910
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400016a0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r15, rdx
mov rsi, rcx
sub r15, rcx
mov r9d, 4
mov qword [rsp + 0x38], r15
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [r15 + rcx]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1400016e0
sub r9, 1
jne 0x1400016d0
mov r15, qword [rsp + 0x40]
mov r12b, 1
lea r10, str.cw
mov r8, rsi
mov r9d, 4
nop
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r10]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140001720
inc r8
sub r9, 1
jne 0x140001710
movzx eax, byte [rsi + 5]
movzx ecx, byte [rsi + 1]
mov byte [rsi + 1], al
movzx eax, byte [rsi + 9]
mov byte [rsi + 5], al
movzx eax, byte [rsi + 0xd]
mov byte [rsi + 9], al
movzx eax, byte [rsi + 0xa]
mov byte [rsi + 0xd], cl
movzx ecx, byte [rsi + 2]
mov byte [rsi + 2], al
movzx eax, byte [rsi + 0xe]
mov byte [rsi + 0xa], cl
movzx ecx, byte [rsi + 6]
mov byte [rsi + 6], al
movzx eax, byte [rsi + 0xf]
mov byte [rsi + 0xe], cl
movzx ecx, byte [rsi + 3]
mov byte [rsi + 3], al
movzx eax, byte [rsi + 0xb]
mov byte [rsi + 0xf], al
movzx eax, byte [rsi + 7]
mov byte [rsi + 0xb], al
mov byte [rsi + 7], cl
cmp r12b, 0xa
je 0x1400018ae
lea r14, [rsi + 2]
lea ebp, [rdx + 4]
nop dword [rax]
nop word [rax + rax]
movzx edi, byte [r14 - 2]
movzx r8d, byte [r14 - 1]
movzx edx, dil
movzx ebx, byte [r14 + 1]
xor dl, r8b
movzx r10d, byte [r14]
lea r14, [r14 + 4]
movzx eax, dl
movzx r9d, bl
shr al, 7
add dl, dl
movzx eax, al
xor r9b, r10b
imul ecx, eax, 0x1b
movzx r11d, r9b
xor r11b, dil
xor r11b, r8b
xor cl, dl
movzx edx, r8b
xor cl, dil
xor dl, r10b
xor cl, r11b
movzx eax, dl
mov byte [r14 - 6], cl
xor dil, bl
shr al, 7
add dl, dl
movzx eax, al
imul ecx, eax, 0x1b
movzx eax, r9b
shr al, 7
add r9b, r9b
movzx eax, al
xor cl, dl
xor cl, r8b
xor cl, r11b
mov byte [r14 - 5], cl
imul ecx, eax, 0x1b
movzx eax, dil
shr al, 7
add dil, dil
movzx eax, al
xor cl, r9b
xor cl, r10b
xor cl, r11b
mov byte [r14 - 4], cl
imul ecx, eax, 0x1b
xor cl, dil
xor cl, bl
xor cl, r11b
mov byte [r14 - 3], cl
sub rbp, 1
jne 0x1400017b0
movzx r8d, r12b
lea r9d, [rbp + 4]
shl r8, 4
mov rax, rsi
sub r8, rsi
add r8, r15
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x140001890
sub r9, 1
jne 0x140001880
inc r12b
jmp 0x1400016fe
mov r15, qword [rsp + 0x38]
mov edx, 4
nop dword [rax + rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [r15 + rsi + 0xa0]
xor byte [rsi], al
inc rsi
sub rcx, 1
jne 0x1400018d0
sub rdx, 1
jne 0x1400018c0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret