joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b204
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
or ebx, 0xffffffff
mov word [rbp - 5], 0x64
mov dword [rbp - 0xe], 0x656d7573
mov dword [rbp - 0xa], 0x65726854
mov word [rbp - 0x10], 0x6552
mov byte [rbp - 6], 0x61
call fcn.18000a82c
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000b258
mov rcx, rdi
call rax
mov ebx, eax
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x18000b26c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov word [rbp - 4], 0x79
mov word [rbp - 0xf], 0x6c74
mov word [rbp - 0xa], 0x4d6f
mov word [rbp - 7], 0x6f6d
mov byte [rbp - 0x10], 0x52
mov byte [rbp - 5], 0x72
mov word [rbp - 0xc], 0x7265
mov byte [rbp - 0xd], 0x5a
mov byte [rbp - 8], 0x65
call fcn.18000a82c
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000b2d1
mov rdx, rbx
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret

Function at 0x18000b2e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov edi, edx
mov rsi, rcx
xor ebx, ebx
mov dword [rbp - 0x1b], 0x64616572
mov word [rbp - 0x13], 0x6972
mov word [rbp - 0x10], 0x79
mov word [rbp - 0x16], 0x6972
mov byte [rbp - 0x11], 0x74
mov byte [rbp - 0x17], 0x50
mov dword [rbp - 0x20], 0x54746553
mov byte [rbp - 0x14], 0x6f
mov byte [rbp - 0x1c], 0x68
call fcn.18000a82c
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000b352
mov edx, edi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x18000b42c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
or ebx, 0xffffffff
mov dword [rbp - 0xb], 0x6854646e
mov dword [rbp - 6], 0x646165
mov dword [rbp - 0x10], 0x70737553
mov byte [rbp - 0xc], 0x65
mov byte [rbp - 7], 0x72
call fcn.18000a82c
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000b47f
mov rcx, rdi
call rax
mov ebx, eax
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret
Function at 0x18000b494
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rbp - 0xd], 0x33646165
mov word [rbp - 7], 0x7269
mov word [rbp - 4], 0x74
mov word [rbp - 9], 0x4632
mov word [rbp - 0xf], 0x7268
mov byte [rbp - 0x10], 0x54
mov byte [rbp - 5], 0x73
call fcn.18000a82c
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000b4fb
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x18000b514
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov word [rbp - 9], 0x4e32
mov word [rbp - 0xc], 0x6461
mov dword [rbp - 7], 0x747865
mov byte [rbp - 0xa], 0x33
mov word [rbp - 0xf], 0x7268
mov byte [rbp - 0xd], 0x65
mov byte [rbp - 0x10], 0x54
call fcn.18000a82c
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000b579
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x18000b590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov edi, r9d
mov esi, r8d
mov r14, rdx
mov r15, rcx
xor ebx, ebx
mov word [rbp - 0x10], 0x6956
mov dword [rbp - 7], 0x636f6c
mov dword [rbp - 0xd], 0x6c617574
mov word [rbp - 9], 0x6c41
mov byte [rbp - 0xe], 0x72
call fcn.18000a82c
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000b5ff
mov r9d, edi
mov r8d, esi
mov rdx, r14
mov rcx, r15
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret

Function at 0x18000b6a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15, rcx
xor ebx, ebx
mov dword [rbp - 0x1e], 0x61757472
mov dword [rbp - 0x13], 0x784574
mov dword [rbp - 0x19], 0x746f7250
mov word [rbp - 0x20], 0x6956
mov word [rbp - 0x15], 0x6365
mov byte [rbp - 0x1a], 0x6c
call fcn.18000a82c
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x18000b726
mov rax, qword [rbp + 0x40]
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18000b744
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
mov word [rbp - 5], 0x79
mov word [rbp - 8], 0x6575
mov word [rbp - 0xb], 0x6c61
mov dword [rbp - 0x10], 0x74726956
mov byte [rbp - 6], 0x72
mov byte [rbp - 9], 0x51
mov byte [rbp - 0xc], 0x75
call fcn.18000a82c
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000b7b4
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x18000c350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
call fcn.18000a898
test rax, rax
je 0x18000c39c
lea rdx, [rsp + 0x20]
mov rcx, rax
mov word [rsp + 0x25], 0x6957
mov dword [rsp + 0x20], 0x6e697242
mov dword [rsp + 0x27], 0x776f646e
mov dword [rsp + 0x2d], 0x706f54
mov byte [rsp + 0x24], 0x67
mov word [rsp + 0x2b], 0x6f54
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rsp, 0x48
ret
add rsp, 0x48
ret

Function at 0x18000c3b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
call fcn.18000a898
test rax, rax
je 0x18000c3fa
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x2b], 0x776f646e
mov dword [rsp + 0x25], 0x65766974
mov dword [rsp + 0x20], 0x41746553
mov word [rsp + 0x29], 0x6957
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x24], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rsp, 0x38
ret
add rsp, 0x38
ret

Function at 0x18000c400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
call fcn.18000a898
test rax, rax
je 0x18000c45b
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x23], 0x65726f46
mov dword [rsp + 0x2f], 0x776f646e
mov dword [rsp + 0x2a], 0x57646e75
mov word [rsp + 0x20], 0x6553
mov word [rsp + 0x27], 0x7267
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x33], 0
mov byte [rsp + 0x2e], 0x69
mov byte [rsp + 0x29], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rsp, 0x48
ret
add rsp, 0x48
ret

Function at 0x18000c460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
call fcn.18000a898
test rax, rax
je 0x18000c4a7
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x21], 0x69577465
mov dword [rsp + 0x28], 0x736f5077
mov word [rsp + 0x25], 0x646e
mov byte [rsp + 0x20], 0x53
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x27], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rsp, 0x38
ret
add rsp, 0x38
ret
Function at 0x18000d980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x148
cmp edx, 1
jne 0x18000da5b
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call fcn.18000ab94
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.180010694
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x26], 0x75732074
mov dword [rsp + 0x2c], 0x74726f
mov dword [rsp + 0x21], 0x6174736e
mov word [rsp + 0x2a], 0x7070
mov byte [rsp + 0x20], 0x69
mov byte [rsp + 0x25], 0x6e
call fcn.18000b3a8
test rax, rax
jne 0x18000da8f
lea rdx, [sym.gphelper.dll_yw3l65]
lea rcx, [0x180072298]
call fcn.18000e6ac
test eax, eax
je 0x18000da8f
lea rdx, [sym.gphelper.dll_xbrc14]
lea rcx, [0x180072278]
call fcn.18000e6ac
test eax, eax
je 0x18000da8f
lea rdx, [sym.gphelper.dll_e8i6q7]
lea rcx, [0x180072310]
call fcn.18000e6ac
test eax, eax
je 0x18000da8f
lea rdx, [sym.gphelper.dll_xebox4]
lea rcx, [0x1800722d0]
call fcn.18000e6ac
mov eax, 1
add rsp, 0x148
ret
test edx, edx
jne 0x18000da8f
lea rcx, [0x180072298]
call fcn.18000e8fc
lea rcx, [0x180072278]
call fcn.18000e8fc
lea rcx, [0x180072310]
call fcn.18000e8fc
lea rcx, [0x1800722d0]
call fcn.18000e8fc
mov eax, 1
add rsp, 0x148
ret
Function at 0x18000dab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x3a0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x380], rbx
mov rbx, rcx
lea rcx, [rbp + 0x151]
xor edx, edx
mov r8d, 0x103
mov word [rbp + 8], 0x4f53
mov dword [rbp + 0xd], 0x5c455241
mov byte [rbp + 0x11], 0
mov word [rbp + 0xb], 0x5754
mov byte [rbp + 0xa], 0x46
mov dword [rbp + 0x399], 0x732573
mov byte [rbp + 0x398], 0x25
mov byte [rbp + 0x150], 0
call fcn.18000f350
lea rcx, [rbp + 0x20]
call fcn.18000c2a0
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x18000db25
mov rdx, qword [rax]
test rdx, rdx
jne 0x18000db2e
xor eax, eax
jmp 0x18000db84
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000db32
inc eax
cmp eax, 0x3fffffff
jle 0x18000db49
xor eax, eax
jmp 0x18000db84
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18000db65
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180011550
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x30]
call fcn.18000bfd0
mov qword [rsp + 0x28], rax
lea rax, [rbp + 8]
lea r9, [rbp + 0x398]
lea rcx, [rbp + 0x150]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.180010888
cmp qword [rbp + 0x38], 8
jb 0x18000dbbe
mov rcx, qword [rbp + 0x20]
call fcn.180010150
lea rax, [rbp + 0x18]
lea rdx, [rbp + 0x150]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.18000b080
test eax, eax
jne 0x18000dcc7
lea rcx, [rbp + 0x261]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x260], al
call fcn.18000f350
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x390]
lea rdx, [rbp]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x260]
xor r8d, r8d
mov dword [rbp + 2], 0x736c61
mov word [rbp], 0x7668
mov qword [rsp + 0x20], rax
call fcn.18000b138
test eax, eax
jne 0x18000dcbe
cmp dword [rbp + 0x390], eax
jbe 0x18000dcbe
lea rcx, [rbp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x40], al
call fcn.18000f350
lea r9, [rbp + 0x388]
lea rcx, [rbp + 0x40]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov word [rbp + 0x388], 0x6425
mov byte [rbp + 0x38a], 0
mov qword [rsp + 0x20], rbx
call fcn.180010888
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x260]
call fcn.18000b3a8
test rax, rax
je 0x18000dcbe
mov rcx, qword [rbp + 0x18]
call fcn.18000aff8
mov eax, 1
mov rbx, qword [rbp + 0x380]
lea rsp, [rbp + 0x370]
pop rbp
ret
mov rcx, qword [rbp + 0x18]
call fcn.18000aff8
mov rcx, rbx
call qword [0x1800722d0]
mov rbx, qword [rbp + 0x380]
lea rsp, [rbp + 0x370]
pop rbp
ret
Function at 0x18000dce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x3a0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x380], rbx
mov rbx, rcx
lea rcx, [rbp + 0x151]
xor edx, edx
mov r8d, 0x103
mov dword [rbp + 0xa], 0x41575446
mov word [rbp + 8], 0x4f53
mov dword [rbp + 0xe], 0x5c4552
mov word [rbp + 0x398], 0x7325
mov word [rbp + 0x39b], 0x73
mov byte [rbp + 0x39a], 0x25
mov byte [rbp + 0x150], 0
call fcn.18000f350
lea rcx, [rbp + 0x20]
call fcn.18000c2a0
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x18000dd56
mov rdx, qword [rax]
test rdx, rdx
jne 0x18000dd5f
xor eax, eax
jmp 0x18000ddb5
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000dd63
inc eax
cmp eax, 0x3fffffff
jle 0x18000dd7a
xor eax, eax
jmp 0x18000ddb5
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18000dd96
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180011550
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x30]
call fcn.18000bfd0
mov qword [rsp + 0x28], rax
lea rax, [rbp + 8]
lea r9, [rbp + 0x398]
lea rcx, [rbp + 0x150]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.180010888
cmp qword [rbp + 0x38], 8
jb 0x18000ddef
mov rcx, qword [rbp + 0x20]
call fcn.180010150
lea rax, [rbp + 0x18]
lea rdx, [rbp + 0x150]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.18000b080
test eax, eax
jne 0x18000def6
lea rcx, [rbp + 0x261]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x260], al
call fcn.18000f350
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x390]
lea rdx, [rbp]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x260]
xor r8d, r8d
mov dword [rbp + 2], 0x736c61
mov word [rbp], 0x7668
mov qword [rsp + 0x20], rax
call fcn.18000b138
test eax, eax
jne 0x18000deed
cmp dword [rbp + 0x390], eax
jbe 0x18000deed
lea rcx, [rbp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x40], al
call fcn.18000f350
lea r9, [rbp + 0x388]
lea rcx, [rbp + 0x40]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov word [rbp + 0x388], 0x6425
mov byte [rbp + 0x38a], 0
mov qword [rsp + 0x20], rbx
call fcn.180010888
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x260]
call fcn.18000b3a8
test rax, rax
je 0x18000deed
mov rcx, qword [rbp + 0x18]
call fcn.18000aff8
mov rax, rbx
mov rbx, qword [rbp + 0x380]
lea rsp, [rbp + 0x370]
pop rbp
ret
mov rcx, qword [rbp + 0x18]
call fcn.18000aff8
mov rcx, rbx
call qword [0x180072310]
mov rbx, qword [rbp + 0x380]
lea rsp, [rbp + 0x370]
pop rbp
ret
Function at 0x18000df10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x3a0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x380], rbx
mov rbx, rcx
lea rcx, [rbp + 0x151]
xor edx, edx
mov r8d, 0x103
mov dword [rbp + 9], 0x5754464f
mov dword [rbp + 0xd], 0x5c455241
mov byte [rbp + 8], 0x53
mov byte [rbp + 0x11], 0
mov word [rbp + 0x398], 0x7325
mov word [rbp + 0x39b], 0x73
mov byte [rbp + 0x39a], 0x25
mov byte [rbp + 0x150], 0
call fcn.18000f350
lea rcx, [rbp + 0x20]
call fcn.18000c2a0
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x18000df88
mov rdx, qword [rax]
test rdx, rdx
jne 0x18000df91
xor eax, eax
jmp 0x18000dfe7
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000df95
inc eax
cmp eax, 0x3fffffff
jle 0x18000dfac
xor eax, eax
jmp 0x18000dfe7
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18000dfc8
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180011550
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x30]
call fcn.18000bfd0
mov qword [rsp + 0x28], rax
lea rax, [rbp + 8]
lea r9, [rbp + 0x398]
lea rcx, [rbp + 0x150]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.180010888
cmp qword [rbp + 0x38], 8
jb 0x18000e021
mov rcx, qword [rbp + 0x20]
call fcn.180010150
lea rax, [rbp + 0x18]
lea rdx, [rbp + 0x150]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.18000b080
test eax, eax
jne 0x18000e131
lea rcx, [rbp + 0x261]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x260], al
call fcn.18000f350
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x390]
lea rdx, [rbp]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x260]
xor r8d, r8d
mov word [rbp + 3], 0x736c
mov word [rbp], 0x7668
mov byte [rbp + 5], 0
mov qword [rsp + 0x20], rax
mov byte [rbp + 2], 0x61
call fcn.18000b138
test eax, eax
jne 0x18000e128
cmp dword [rbp + 0x390], eax
jbe 0x18000e128
lea rcx, [rbp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x40], al
call fcn.18000f350
lea r9, [rbp + 0x388]
lea rcx, [rbp + 0x40]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov word [rbp + 0x388], 0x6425
mov byte [rbp + 0x38a], 0
mov qword [rsp + 0x20], rbx
call fcn.180010888
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x260]
call fcn.18000b3a8
test rax, rax
je 0x18000e128
mov rcx, qword [rbp + 0x18]
call fcn.18000aff8
mov eax, 1
mov rbx, qword [rbp + 0x380]
lea rsp, [rbp + 0x370]
pop rbp
ret
mov rcx, qword [rbp + 0x18]
call fcn.18000aff8
mov rcx, rbx
call qword [0x180072278]
mov rbx, qword [rbp + 0x380]
lea rsp, [rbp + 0x370]
pop rbp
ret
Function at 0x18000e150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x3d0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x3a0], rbx
mov qword [rbp + 0x3a8], rsi
mov qword [rbp + 0x3b0], rdi
mov rbx, rcx
mov esi, r8d
mov qword [rbp + 0x3b8], r14
mov r14, rdx
lea rcx, [rbp + 0x61]
xor edx, edx
mov r8d, 0x103
mov edi, r9d
mov word [rbp + 0x1a], 0x5446
mov word [rbp + 0x20], 0x5c
mov word [rbp + 0x1d], 0x5241
mov word [rbp + 0x18], 0x4f53
mov byte [rbp + 0x1f], 0x45
mov byte [rbp + 0x1c], 0x57
mov dword [rbp + 4], 0x73257325
mov byte [rbp + 8], 0
mov byte [rbp + 0x60], 0
call fcn.18000f350
lea rcx, [rbp + 0x38]
call fcn.18000c2a0
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x18000e1dc
mov rdx, qword [rax]
test rdx, rdx
jne 0x18000e1e5
xor eax, eax
jmp 0x18000e242
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000e1f0
inc eax
cmp eax, 0x3fffffff
jle 0x18000e207
xor eax, eax
jmp 0x18000e242
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18000e223
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180011550
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x40]
call fcn.18000bfd0
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x18]
lea r9, [rbp + 4]
lea rcx, [rbp + 0x60]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.180010888
cmp qword [rbp + 0x50], 8
jb 0x18000e276
mov rcx, qword [rbp + 0x38]
call fcn.180010150
lea rax, [rbp + 0x28]
lea rdx, [rbp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.18000b080
test eax, eax
jne 0x18000e36b
lea rcx, [rbp + 0x281]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x280], al
call fcn.18000f350
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x30]
lea rdx, [rbp + 0xc]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x280]
xor r8d, r8d
mov dword [rbp + 0xe], 0x736c61
mov word [rbp + 0xc], 0x7668
mov qword [rsp + 0x20], rax
call fcn.18000b138
test eax, eax
jne 0x18000e362
cmp dword [rbp + 0x30], eax
jbe 0x18000e362
lea rcx, [rbp + 0x171]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x170], al
call fcn.18000f350
lea r9, [rbp]
lea rcx, [rbp + 0x170]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov word [rbp], 0x6425
mov byte [rbp + 2], 0
mov qword [rsp + 0x20], rbx
call fcn.180010888
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x280]
call fcn.18000b3a8
test rax, rax
je 0x18000e362
mov rcx, qword [rbp + 0x28]
call fcn.18000aff8
mov eax, 1
jmp 0x18000e39b
mov rcx, qword [rbp + 0x28]
call fcn.18000aff8
mov eax, dword [rbp + 0x3d0]
mov r9d, edi
mov r8d, esi
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x3c8]
mov rdx, r14
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x3c0]
mov rcx, rbx
mov dword [rsp + 0x20], eax
call qword [0x180072298]
mov rbx, qword [rbp + 0x3a0]
mov rsi, qword [rbp + 0x3a8]
mov rdi, qword [rbp + 0x3b0]
mov r14, qword [rbp + 0x3b8]
lea rsp, [rbp + 0x390]
pop rbp
ret
Function at 0x18000e3c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rsi, r9
mov r14, r8
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.18000a898
mov rdi, rax
test rax, rax
je 0x18000a95b
lea rdx, [rbp - 0x10]
mov rcx, rax
mov word [rbp - 4], 0x7845
mov byte [rbp - 2], bl
mov dword [rbp - 9], 0x6f6f4874
mov dword [rbp - 0xd], 0x78654e6c
mov word [rbp - 0xf], 0x6c61
mov byte [rbp - 5], 0x6b
mov byte [rbp - 0x10], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a952
mov r9, rsi
mov r8, r14
mov edx, r15d
mov rcx, r12
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov r9, r8
mov r8, rdx
mov edx, ecx
xor ecx, ecx
jmp 0x18000a8d0