joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800104b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov word [rbp - 0x17], 0x7250
mov dword [rbp - 0x1e], 0x72685474
mov dword [rbp - 0x13], 0x79746972
mov word [rbp - 0x1a], 0x6165
mov word [rbp - 0x15], 0x6f69
mov byte [rbp - 0xf], 0
mov word [rbp - 0x20], 0x6547
mov byte [rbp - 0x18], 0x64
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001053d
mov rcx, rbx
call rax
jmp 0x180010542
mov eax, 0x7fffffff
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180014260
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x180010560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x1b], 0x6854646e
mov dword [rbp - 0x16], 0x646165
mov dword [rbp - 0x20], 0x70737553
mov byte [rbp - 0x1c], 0x65
mov byte [rbp - 0x17], 0x72
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800105dc
mov rcx, rbx
call rax
jmp 0x1800105df
or eax, 0xffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014260
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x180010600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov word [rbp - 0x20], 0x6956
mov dword [rbp - 0x17], 0x636f6c
mov dword [rbp - 0x1d], 0x6c617574
mov word [rbp - 0x19], 0x6c41
mov byte [rbp - 0x1e], 0x72
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001068a
mov edx, 0x78
mov r8d, 0x3000
mov rcx, rbx
lea r9d, [rdx - 0x58]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014260
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x1800108d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov edi, edx
mov dword [rbp - 0x1b], 0x64616572
mov word [rbp - 0x13], 0x6972
mov word [rbp - 0x10], 0x79
mov word [rbp - 0x16], 0x6972
mov byte [rbp - 0x11], 0x74
mov byte [rbp - 0x17], 0x50
mov dword [rbp - 0x20], 0x54746553
mov byte [rbp - 0x14], 0x6f
mov byte [rbp - 0x1c], 0x68
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010966
mov edx, edi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180014260
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x180010a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
mov ebx, r8d
mov word [rbp - 0x2b], 0x7268
mov word [rbp - 0x28], 0x6461
mov dword [rbp - 0x30], 0x6e65704f
mov byte [rbp - 0x26], 0
mov byte [rbp - 0x2c], 0x54
mov byte [rbp - 0x29], 0x65
mov dword [rbp - 0x19], 0x6c642e32
mov word [rbp - 0x15], 0x6c
mov dword [rbp - 0x1f], 0x656e7265
mov word [rbp - 0x1b], 0x336c
mov byte [rbp - 0x20], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010ac3
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014260
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x180010ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, qword [rbp + 0x58]
mov rbx, rcx
lea rcx, [rbp - 0x38]
mov r14d, r9d
mov rsi, r8
mov rdi, rdx
mov dword [rbp - 0x26], 0x61757472
mov dword [rbp - 0x1b], 0x784574
mov dword [rbp - 0x21], 0x746f7250
mov word [rbp - 0x28], 0x6956
mov word [rbp - 0x1d], 0x6365
mov byte [rbp - 0x22], 0x6c
mov dword [rbp - 0x31], 0x6c642e32
mov word [rbp - 0x2d], 0x6c
mov dword [rbp - 0x37], 0x656e7265
mov word [rbp - 0x33], 0x336c
mov byte [rbp - 0x38], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010c40
mov r9d, r14d
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], r15
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014260
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180010c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov word [rbp - 0x15], 0x64
mov dword [rbp - 0x1e], 0x656d7573
mov dword [rbp - 0x1a], 0x65726854
mov word [rbp - 0x20], 0x6552
mov byte [rbp - 0x16], 0x61
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010cdd
mov rcx, rbx
call rax
jmp 0x180010ce0
or eax, 0xffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014260
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x180010d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x20], 0x65536c61
mov dword [rbp - 0x1a], 0x6e6f69
mov dword [rbp - 0x2a], 0x657a696c
mov dword [rbp - 0x2e], 0x61697469
mov word [rbp - 0x1c], 0x7463
mov word [rbp - 0x25], 0x6972
mov word [rbp - 0x30], 0x6e49
mov word [rbp - 0x22], 0x6369
mov byte [rbp - 0x26], 0x43
mov byte [rbp - 0x23], 0x74
mov dword [rbp - 0x39], 0x6c642e32
mov word [rbp - 0x35], 0x6c
mov dword [rbp - 0x3f], 0x656e7265
mov word [rbp - 0x3b], 0x336c
mov byte [rbp - 0x40], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010d96
lea rcx, [0x18005cc30]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014260
add rsp, 0x60
pop rbp
ret

Function at 0x180010db0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x17], 0x6c6c64
mov dword [rbp - 0x1b], 0x2e323369
mov word [rbp - 0x1d], 0x7061
mov word [rbp - 0x20], 0x6441
mov byte [rbp - 0x1e], 0x76
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180010e35
lea rdx, [rbp - 0x30]
mov rcx, rax
mov word [rbp - 0x30], 0x6552
mov word [rbp - 0x2a], 0x6573
mov word [rbp - 0x2d], 0x6c43
mov dword [rbp - 0x28], 0x79654b
mov byte [rbp - 0x2e], 0x67
mov byte [rbp - 0x2b], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010e35
mov rcx, rbx
call rax
jmp 0x180010e3a
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014260
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180010e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, qword [rbp + 0x30]
lea rcx, [rbp - 0x30]
mov rbx, rdx
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2b], 0x2e323369
mov word [rbp - 0x2d], 0x7061
mov word [rbp - 0x30], 0x6441
mov byte [rbp - 0x2e], 0x76
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180010f04
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x16], 0x417845
mov word [rbp - 0x20], 0x6552
mov dword [rbp - 0x1d], 0x6e65704f
mov word [rbp - 0x19], 0x654b
mov byte [rbp - 0x1e], 0x67
mov byte [rbp - 0x17], 0x79
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010f04
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rdi
call rax
jmp 0x180010f09
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014260
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret

Function at 0x180010f30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x30]
mov rbx, rdx
mov word [rbp - 0x17], 0x6946
mov dword [rbp - 0x1c], 0x6c75646f
mov dword [rbp - 0x20], 0x4d746547
mov word [rbp - 0x12], 0x6d61
mov byte [rbp - 0x18], 0x65
mov word [rbp - 0xf], 0x41
mov word [rbp - 0x14], 0x4e65
mov byte [rbp - 0x15], 0x6c
mov byte [rbp - 0x10], 0x65
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010fc7
mov r8d, 0x104
mov rdx, rbx
xor ecx, ecx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180014260
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x180010ff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
mov rsi, r9
mov rdi, r8
mov ebx, edx
mov word [rbp - 0x2c], 0x3233
mov dword [rbp - 0x2a], 0x6c6c642e
mov word [rbp - 0x2f], 0x6573
mov byte [rbp - 0x26], 0
mov byte [rbp - 0x30], 0x55
mov byte [rbp - 0x2d], 0x72
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180011089
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x14], 0x7845
mov byte [rbp - 0x12], 0
mov dword [rbp - 0x19], 0x6f6f4874
mov dword [rbp - 0x1d], 0x78654e6c
mov word [rbp - 0x1f], 0x6c61
mov byte [rbp - 0x15], 0x6b
mov byte [rbp - 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011089
mov r9, rsi
mov r8, rdi
mov edx, ebx
xor ecx, ecx
call rax
jmp 0x18001108b
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014260
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov r9, r8
mov r8, rdx
mov edx, ecx
jmp 0x180010ff0

Function at 0x1800110b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov rsi, r8
mov rdi, rdx
mov word [rbp - 0x12], 0x6e6f
mov dword [rbp - 0x17], 0x74637572
mov word [rbp - 0xf], 0x6361
mov word [rbp - 0x1a], 0x736e
mov word [rbp - 0xc], 0x65
mov byte [rbp - 0x10], 0x43
mov dword [rbp - 0x1f], 0x6873756c
mov byte [rbp - 0x18], 0x74
mov byte [rbp - 0x20], 0x46
mov byte [rbp - 0xd], 0x68
mov byte [rbp - 0x1b], 0x49
mov byte [rbp - 0x13], 0x69
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011159
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180014260
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x180011270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov rdi, rdx
mov word [rbp - 0x19], 0x4e32
mov word [rbp - 0x1c], 0x6461
mov dword [rbp - 0x17], 0x747865
mov byte [rbp - 0x1a], 0x33
mov word [rbp - 0x1f], 0x7268
mov byte [rbp - 0x1d], 0x65
mov byte [rbp - 0x20], 0x54
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800112fd
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014260
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x180011320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov rdi, rdx
mov dword [rbp - 0x1d], 0x33646165
mov word [rbp - 0x17], 0x7269
mov word [rbp - 0x14], 0x74
mov word [rbp - 0x19], 0x4632
mov word [rbp - 0x1f], 0x7268
mov byte [rbp - 0x20], 0x54
mov byte [rbp - 0x15], 0x73
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800113af
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014260
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x1800113e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x40]
mov ebx, edx
mov dword [rbp - 0x1c], 0x746f6873
mov dword [rbp - 0x2e], 0x65746165
mov word [rbp - 0x22], 0x3233
mov word [rbp - 0x28], 0x6c6f
mov word [rbp - 0x30], 0x7243
mov word [rbp - 0x25], 0x6c65
mov word [rbp - 0x1f], 0x616e
mov word [rbp - 0x2a], 0x6f54
mov byte [rbp - 0x26], 0x68
mov byte [rbp - 0x1d], 0x70
mov byte [rbp - 0x18], 0
mov byte [rbp - 0x23], 0x70
mov byte [rbp - 0x20], 0x53
mov dword [rbp - 0x39], 0x6c642e32
mov word [rbp - 0x35], 0x6c
mov dword [rbp - 0x3f], 0x656e7265
mov word [rbp - 0x3b], 0x336c
mov byte [rbp - 0x40], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011488
mov edx, ebx
mov ecx, 4
call rax
jmp 0x18001148c
or rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014260
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180011630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x30]
mov word [rbp - 0x11], 0x64
mov dword [rbp - 0x1a], 0x746e6572
mov word [rbp - 0x20], 0x6547
mov word [rbp - 0x1d], 0x7543
mov dword [rbp - 0x16], 0x65726854
mov byte [rbp - 0x1e], 0x74
mov byte [rbp - 0x1b], 0x72
mov byte [rbp - 0x12], 0x61
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800116c1
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180014260
add rsp, 0x50
pop rbp
ret
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180014260
add rsp, 0x50
pop rbp
ret
Function at 0x180011710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rcx
lea rcx, [rsp + 0x48]
call fcn.180011ed0
cmp qword [rax + 0x18], 0x10
jb 0x180011752
mov rax, qword [rax]
lea rcx, [rsp + 0x38]
mov rdx, rax
mov qword [rsp + 0x20], rcx
call fcn.180010e60
cmp qword [rsp + 0x60], 0x10
movsxd rbx, eax
jb 0x180011779
mov rcx, qword [rsp + 0x48]
call fcn.180015074
test rbx, rbx
jne 0x180011932
lea rcx, [rbp + 0x91]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x90], bl
call fcn.180017c60
mov rbx, qword [rsp + 0x38]
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x7a], 0x736c61
mov word [rsp + 0x78], 0x7668
mov dword [rsp + 0x71], 0x6c6c64
mov dword [rsp + 0x6d], 0x2e323369
mov word [rsp + 0x6b], 0x7061
mov word [rsp + 0x68], 0x6441
mov byte [rsp + 0x6a], 0x76
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180011928
lea rdx, [rsp + 0x48]
mov rcx, rax
mov dword [rsp + 0x54], 0x41784565
mov dword [rsp + 0x50], 0x756c6156
mov word [rsp + 0x4b], 0x7551
mov word [rsp + 0x48], 0x6552
mov word [rsp + 0x4d], 0x7265
mov byte [rsp + 0x4f], 0x79
mov byte [rsp + 0x4a], 0x67
mov byte [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011928
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x90]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call rax
test eax, eax
jne 0x180011928
cmp dword [rsp + 0x40], eax
jbe 0x180011928
lea rcx, [rbp - 0x7f]
xor edx, edx
mov r8d, 0x103
mov byte [rbp - 0x80], al
call fcn.180017c60
lea r9, [rsp + 0x30]
lea rcx, [rbp - 0x80]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov word [rsp + 0x30], 0x6425
mov byte [rsp + 0x32], 0
mov qword [rsp + 0x20], rdi
call fcn.180014ebc
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x68], 0x776c6853
mov dword [rsp + 0x6c], 0x2e697061
mov word [rsp + 0x71], 0x6c6c
mov byte [rsp + 0x73], 0
mov byte [rsp + 0x70], 0x64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180011928
lea rdx, [rsp + 0x48]
mov rcx, rax
mov dword [rsp + 0x4d], 0x414972
mov word [rsp + 0x4b], 0x7453
mov word [rsp + 0x48], 0x7453
mov byte [rsp + 0x4a], 0x72
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011928
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x90]
call rax
test rax, rax
je 0x180011928
mov rcx, qword [rsp + 0x38]
call fcn.180010db0
mov eax, 1
jmp 0x18001193b
mov rcx, qword [rsp + 0x38]
call fcn.180010db0
mov rcx, rdi
call qword [0x18005c9f8]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.180014260
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180011990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rcx
lea rcx, [rsp + 0x48]
call fcn.180011ed0
cmp qword [rax + 0x18], 0x10
jb 0x1800119d2
mov rax, qword [rax]
lea rcx, [rsp + 0x38]
mov rdx, rax
mov qword [rsp + 0x20], rcx
call fcn.180010e60
cmp qword [rsp + 0x60], 0x10
movsxd rbx, eax
jb 0x1800119f9
mov rcx, qword [rsp + 0x48]
call fcn.180015074
test rbx, rbx
jne 0x180011bba
lea rcx, [rbp + 0x91]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x90], bl
call fcn.180017c60
mov byte [rsp + 0x7d], bl
mov rbx, qword [rsp + 0x38]
lea rcx, [rsp + 0x68]
mov word [rsp + 0x7b], 0x736c
mov word [rsp + 0x78], 0x7668
mov byte [rsp + 0x7a], 0x61
mov dword [rsp + 0x71], 0x6c6c64
mov dword [rsp + 0x6d], 0x2e323369
mov word [rsp + 0x6b], 0x7061
mov word [rsp + 0x68], 0x6441
mov byte [rsp + 0x6a], 0x76
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180011bb0
lea rdx, [rsp + 0x48]
mov rcx, rax
mov dword [rsp + 0x54], 0x41784565
mov dword [rsp + 0x50], 0x756c6156
mov word [rsp + 0x4b], 0x7551
mov word [rsp + 0x48], 0x6552
mov word [rsp + 0x4d], 0x7265
mov byte [rsp + 0x4f], 0x79
mov byte [rsp + 0x4a], 0x67
mov byte [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011bb0
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x90]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call rax
test eax, eax
jne 0x180011bb0
cmp dword [rsp + 0x40], eax
jbe 0x180011bb0
lea rcx, [rbp - 0x7f]
xor edx, edx
mov r8d, 0x103
mov byte [rbp - 0x80], al
call fcn.180017c60
lea r9, [rsp + 0x30]
lea rcx, [rbp - 0x80]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov word [rsp + 0x30], 0x6425
mov byte [rsp + 0x32], 0
mov qword [rsp + 0x20], rdi
call fcn.180014ebc
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x68], 0x776c6853
mov dword [rsp + 0x6c], 0x2e697061
mov word [rsp + 0x71], 0x6c6c
mov byte [rsp + 0x73], 0
mov byte [rsp + 0x70], 0x64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180011bb0
lea rdx, [rsp + 0x48]
mov rcx, rax
mov dword [rsp + 0x4d], 0x414972
mov word [rsp + 0x4b], 0x7453
mov word [rsp + 0x48], 0x7453
mov byte [rsp + 0x4a], 0x72
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011bb0
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x90]
call rax
test rax, rax
je 0x180011bb0
mov rcx, qword [rsp + 0x38]
call fcn.180010db0
mov eax, 1
jmp 0x180011bc3
mov rcx, qword [rsp + 0x38]
call fcn.180010db0
mov rcx, rdi
call qword [0x18005c990]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.180014260
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret