joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800dde90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800dded2
cmp qword [rbp + 0x1c0], 0
jne 0x1800dded9
xor al, al
jmp 0x1800de0bc
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0680
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800de0a3
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800de09f
int3
xor al, al
jmp 0x1800de0bc
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e1920
movzx eax, al
test eax, eax
jne 0x1800de0ba
xor al, al
jmp 0x1800de0bc
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800de0e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800de122
cmp qword [rbp + 0x1c0], 0
jne 0x1800de129
xor al, al
jmp 0x1800de30c
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0680
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800de2f3
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800de2ef
int3
xor al, al
jmp 0x1800de30c
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e1b20
movzx eax, al
test eax, eax
jne 0x1800de30a
xor al, al
jmp 0x1800de30c
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800de330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800de372
cmp qword [rbp + 0x1c0], 0
jne 0x1800de379
xor al, al
jmp 0x1800de55c
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0680
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800de543
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800de53f
int3
xor al, al
jmp 0x1800de55c
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e1d20
movzx eax, al
test eax, eax
jne 0x1800de55a
xor al, al
jmp 0x1800de55c
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800de580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800de5c2
cmp qword [rbp + 0x1c0], 0
jne 0x1800de5c9
xor al, al
jmp 0x1800de7ac
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0680
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800de793
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800de78f
int3
xor al, al
jmp 0x1800de7ac
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e1f20
movzx eax, al
test eax, eax
jne 0x1800de7aa
xor al, al
jmp 0x1800de7ac
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800de7d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800de812
cmp qword [rbp + 0x1c0], 0
jne 0x1800de819
xor al, al
jmp 0x1800de9fc
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0680
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800de9e3
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800de9df
int3
xor al, al
jmp 0x1800de9fc
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e2120
movzx eax, al
test eax, eax
jne 0x1800de9fa
xor al, al
jmp 0x1800de9fc
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e0920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e0959
xor al, al
jmp 0x1800e0b07
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e096e
xor al, al
jmp 0x1800e0b07
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0990
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e0afb
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800e0af7
int3
xor al, al
jmp 0x1800e0b07
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e0b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e0b59
xor al, al
jmp 0x1800e0d07
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e0b6e
xor al, al
jmp 0x1800e0d07
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0990
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e0cfb
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800e0cf7
int3
xor al, al
jmp 0x1800e0d07
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e0d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e0d59
xor al, al
jmp 0x1800e0f07
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e0d6e
xor al, al
jmp 0x1800e0f07
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0990
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e0efb
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800e0ef7
int3
xor al, al
jmp 0x1800e0f07
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e0f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e0f59
xor al, al
jmp 0x1800e1107
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e0f6e
xor al, al
jmp 0x1800e1107
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0990
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e10fb
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800e10f7
int3
xor al, al
jmp 0x1800e1107
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e1120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e1159
xor al, al
jmp 0x1800e1307
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e116e
xor al, al
jmp 0x1800e1307
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0990
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e12fb
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800e12f7
int3
xor al, al
jmp 0x1800e1307
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret