joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18012551c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0c88]
mov rbx, rdx
test rax, rax
jne 0x1801255bf
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180125574
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0c88], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0c88]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801255e8
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180125614
cmp dword [rbp - 0x10], 0x10000
je 0x180125614
cmp qword [rbp - 0x18], 0x1000
jb 0x180125614
cmp dword [rbp - 8], 0x1000000
je 0x180125610
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180125616
mov al, 1
jmp 0x180125616
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180125bf8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0958]
mov rbx, rdx
test rax, rax
jne 0x180125c9b
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180125c50
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0958], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0958]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180125cc4
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180125cf0
cmp dword [rbp - 0x10], 0x10000
je 0x180125cf0
cmp qword [rbp - 0x18], 0x1000
jb 0x180125cf0
cmp dword [rbp - 8], 0x1000000
je 0x180125cec
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180125cf2
mov al, 1
jmp 0x180125cf2
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801262d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0ad8]
mov rbx, rdx
test rax, rax
jne 0x180126377
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18012632c
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0ad8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0ad8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801263a0
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801263cc
cmp dword [rbp - 0x10], 0x10000
je 0x1801263cc
cmp qword [rbp - 0x18], 0x1000
jb 0x1801263cc
cmp dword [rbp - 8], 0x1000000
je 0x1801263c8
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801263ce
mov al, 1
jmp 0x1801263ce
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180128298
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0c30]
mov rbx, rdx
test rax, rax
jne 0x18012833b
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801282f0
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0c30], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0c30]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180128364
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180128390
cmp dword [rbp - 0x10], 0x10000
je 0x180128390
cmp qword [rbp - 0x18], 0x1000
jb 0x180128390
cmp dword [rbp - 8], 0x1000000
je 0x18012838c
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180128392
mov al, 1
jmp 0x180128392
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18012a25c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0a80]
mov rbx, rdx
test rax, rax
jne 0x18012a2ff
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18012a2b4
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0a80], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0a80]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18012a328
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18012a354
cmp dword [rbp - 0x10], 0x10000
je 0x18012a354
cmp qword [rbp - 0x18], 0x1000
jb 0x18012a354
cmp dword [rbp - 8], 0x1000000
je 0x18012a350
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18012a356
mov al, 1
jmp 0x18012a356
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18012c220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0cc0]
mov rbx, rdx
test rax, rax
jne 0x18012c2c3
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18012c278
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0cc0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0cc0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18012c2ec
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18012c318
cmp dword [rbp - 0x10], 0x10000
je 0x18012c318
cmp qword [rbp - 0x18], 0x1000
jb 0x18012c318
cmp dword [rbp - 8], 0x1000000
je 0x18012c314
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18012c31a
mov al, 1
jmp 0x18012c31a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18012e1e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0c18]
mov rbx, rdx
test rax, rax
jne 0x18012e287
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18012e23c
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0c18], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0c18]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18012e2b0
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18012e2dc
cmp dword [rbp - 0x10], 0x10000
je 0x18012e2dc
cmp qword [rbp - 0x18], 0x1000
jb 0x18012e2dc
cmp dword [rbp - 8], 0x1000000
je 0x18012e2d8
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18012e2de
mov al, 1
jmp 0x18012e2de
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18012e8c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0c68]
mov rbx, rdx
test rax, rax
jne 0x18012e963
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18012e918
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0c68], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0c68]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18012e98c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18012e9b8
cmp dword [rbp - 0x10], 0x10000
je 0x18012e9b8
cmp qword [rbp - 0x18], 0x1000
jb 0x18012e9b8
cmp dword [rbp - 8], 0x1000000
je 0x18012e9b4
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18012e9ba
mov al, 1
jmp 0x18012e9ba
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180130884
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0988]
mov rbx, rdx
test rax, rax
jne 0x180130927
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801308dc
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0988], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0988]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180130950
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18013097c
cmp dword [rbp - 0x10], 0x10000
je 0x18013097c
cmp qword [rbp - 0x18], 0x1000
jb 0x18013097c
cmp dword [rbp - 8], 0x1000000
je 0x180130978
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18013097e
mov al, 1
jmp 0x18013097e
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180132848
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0710]
mov rbx, rdx
test rax, rax
jne 0x1801328eb
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801328a0
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0710], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0710]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180132914
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180132940
cmp dword [rbp - 0x10], 0x10000
je 0x180132940
cmp qword [rbp - 0x18], 0x1000
jb 0x180132940
cmp dword [rbp - 8], 0x1000000
je 0x18013293c
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180132942
mov al, 1
jmp 0x180132942
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180132f24
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c07e8]
mov rbx, rdx
test rax, rax
jne 0x180132fc7
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180132f7c
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c07e8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c07e8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180132ff0
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18013301c
cmp dword [rbp - 0x10], 0x10000
je 0x18013301c
cmp qword [rbp - 0x18], 0x1000
jb 0x18013301c
cmp dword [rbp - 8], 0x1000000
je 0x180133018
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18013301e
mov al, 1
jmp 0x18013301e
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180134ee8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0898]
mov rbx, rdx
test rax, rax
jne 0x180134f8b
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180134f40
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0898], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0898]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180134fb4
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180134fe0
cmp dword [rbp - 0x10], 0x10000
je 0x180134fe0
cmp qword [rbp - 0x18], 0x1000
jb 0x180134fe0
cmp dword [rbp - 8], 0x1000000
je 0x180134fdc
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180134fe2
mov al, 1
jmp 0x180134fe2
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801355c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c08f8]
mov rbx, rdx
test rax, rax
jne 0x180135667
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18013561c
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c08f8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c08f8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180135690
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801356bc
cmp dword [rbp - 0x10], 0x10000
je 0x1801356bc
cmp qword [rbp - 0x18], 0x1000
jb 0x1801356bc
cmp dword [rbp - 8], 0x1000000
je 0x1801356b8
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801356be
mov al, 1
jmp 0x1801356be
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180148930
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rsi, rdx
mov qword [rbp - 0x10], 0xba49
mov r15b, cl
mov dword [rbp - 8], 0xff410000
lea rax, [0x180148c40]
mov byte [rbp - 4], 0xe2
xor r13d, r13d
mov qword [rbp + 0x50], rax
lea rdx, [rbp + 0x50]
mov rbx, r9
lea rcx, [rbp - 0xe]
lea r8d, [r13 + 8]
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov dword [rbp + 0x40], r13d
lea r14d, [r13 + 0xd]
mov dil, r13b
test rbx, rbx
je 0x180148aa1
test r15b, r15b
je 0x1801489f5
lea rcx, [rbx + 1]
test rcx, rcx
je 0x180148aa1
cmp dword [rbx + 0x14], r13d
je 0x180148aa1
mov r8d, dword [rbx + 0x14]
mov rdx, rsi
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
lea r9, [rbp + 0x40]
mov edx, r14d
lea r8d, [r13 + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180148a3f
mov r8d, r14d
lea rdx, [rbp - 0x10]
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov dil, 1
mov byte [rbx], dil
jmp 0x180148a3f
lea r15, [rbx + 1]
test r15, r15
je 0x180148aa1
cmp dword [rbx + 0x14], r13d
je 0x180148aa1
mov r14d, dword [rbx + 0x14]
lea r9, [rbp + 0x40]
mov edx, r14d
mov r8d, 0x40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180148a3f
mov r8d, r14d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov dil, 1
mov byte [rbx], r13b
mov rbx, qword [0x1802c0d18]
test rbx, rbx
jne 0x180148a77
lea rcx, [0x18027fdbc]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtFlushInstructionCache
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802c0d18], rax
mov rbx, rax
test rax, rax
je 0x180148a88
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, r14d
mov rdx, rsi
mov rcx, rax
call rbx
mov r8d, dword [rbp + 0x40]
lea r9, [rbp + 0x40]
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, dil
jmp 0x180148aa3
xor al, al
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x180148ab8
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x20
cmp dword [0x1802bd27c], 0
je 0x180148b4f
xor eax, eax
lea rdi, [0x1802bd280]
lea ecx, [rax + 0x28]
rep stosb byte [rdi], al
jmp 0x180148b35
test byte [0x1802bd28e], 4
je 0x180148b35
mov edi, dword [0x1802bd288]
xor eax, eax
mov r8d, dword [0x1802bd278]
mov ecx, edi
mov rdx, qword [0x1802bd280]
shr rcx, 2
test rcx, rcx
je 0x180148b11
xor dword [rdx + rax*4], r8d
inc rax
cmp rax, rcx
jb 0x180148b05
lea rax, [rcx*4]
jmp 0x180148b22
xor byte [rax + rdx], r8b
inc rax
cmp rax, rdi
jb 0x180148b1b
cmp byte [0x1802bd2a8], 0
sete byte [0x1802bd2a8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
lea rdx, [0x1802bd280]
call qword [sym.imp.KERNEL32.dll_HeapWalk]
test eax, eax
jne 0x180148adb
add rsp, 0x20
pop rdi
ret