joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800cffc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [rsp + 0x10], dx
mov word [rsp + 8], cx
sub rsp, 0xc8
movabs rax, 0x730afcc2499b7
mov qword [rsp + 0x58], rax
mov rax, qword [0x180147238]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0xb832
mov byte [rsp], 0x5c
mov eax, 0xffffa4c4
mov word [rsp + 0xc], ax
mov eax, 0x8bf
mov word [rsp + 8], ax
mov eax, dword [0x180147230]
mov dword [rsp + 0x34], eax
mov byte [rsp + 1], 0x9d
mov eax, dword [0x180147230]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], 0x89db4481
mov dword [rsp + 0x40], 0x131
mov dword [rsp + 0x44], 0xd93466b
mov rax, qword [0x180147238]
mov qword [rsp + 0x70], rax
movzx eax, word [0x18014727c]
mov word [rsp + 0x10], ax
movzx eax, word [0x18014725c]
mov qword [rsp + 0x78], rax
mov rax, qword [0x180147240]
mov qword [rsp + 0x80], rax
mov eax, 0xcf76
mov word [rsp + 0x14], ax
mov eax, 0x2dc2
mov word [rsp + 0x18], ax
mov dword [rsp + 0x48], 0x324ee9d8
movsxd rax, dword [0x180147274]
mov qword [rsp + 0x88], rax
movzx eax, byte [0x180147228]
mov byte [rsp + 2], al
movzx eax, word [0x18014728c]
mov byte [rsp + 3], al
mov eax, 0x354b
mov word [rsp + 0x1c], ax
movzx eax, word [0x1801471dc]
mov word [rsp + 0x20], ax
mov eax, dword [0x18014720c]
mov word [rsp + 0x24], ax
mov eax, dword [0x180147240]
mov dword [rsp + 0x4c], eax
movsxd rax, dword [0x18014729c]
mov qword [rsp + 0x90], rax
mov eax, 0xad
mov word [rsp + 0x28], ax
movsxd rax, dword [0x1801472a0]
mov qword [rsp + 0x98], rax
movzx eax, byte [0x180147157]
movzx eax, al
mov qword [rsp + 0xa0], rax
movsx eax, word [0x1801472b8]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x180147174]
mov byte [rsp + 4], al
mov eax, dword [0x180147264]
mov dword [rsp + 0x54], eax
mov eax, 0xbc8
mov word [rsp + 0x2c], ax
mov eax, dword [0x1801472b0]
mov qword [rsp + 0xa8], rax
mov rax, qword [0x180147238]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 0xc201
movzx eax, byte [0x180147290]
mov byte [rsp + 5], al
mov rax, qword [0x180147268]
mov word [rsp + 0x30], ax
movzx eax, word [0x18014725c]
add eax, 0x42dd
mov word [0x180147288], ax
mov eax, 0x526f
mov word [rsp + 8], ax
mov eax, dword [0x180147274]
not eax
cdqe
mov rcx, qword [0x180147230]
imul rcx, rax
mov rax, rcx
mov qword [0x180147280], rax
movzx eax, word [0x180147278]
movsx rax, ax
movabs rcx, 0xeb9ed5a54b2b
imul rax, rcx
mov rcx, qword [0x180147290]
sub rcx, rax
mov rax, rcx
mov qword [0x180147290], rax
movzx eax, word [rsp + 0xc]
add rsp, 0xc8
ret
Function at 0x1800d0200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 8], cl
sub rsp, 0xc8
mov byte [rsp + 8], 0x44
movzx eax, byte [0x18014719e]
movzx eax, al
mov qword [rsp + 0x98], rax
mov eax, dword [0x180147258]
mov dword [rsp + 0x60], eax
mov qword [rsp + 0xa0], 0x77b8
mov rax, qword [0x180147250]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x3c], 0x4b4f
mov dword [rsp + 0x64], 0xed
mov qword [rsp + 0x88], 0x9c
movzx eax, word [0x1801472b0]
mov word [rsp + 0x10], ax
movzx eax, word [0x18014727c]
mov byte [rsp], al
mov eax, 0xa42
mov word [rsp + 0x18], ax
mov eax, 0x1f8f
mov word [rsp + 0x1c], ax
movzx eax, word [0x180147224]
mov word [rsp + 0x20], ax
mov eax, 0x39ec
mov word [rsp + 4], ax
movzx eax, word [0x180147270]
movsx rax, ax
mov qword [rsp + 0x58], rax
movsx eax, byte [0x180147173]
mov dword [rsp + 0x68], eax
movzx eax, word [0x18014725c]
mov dword [rsp + 0x6c], eax
mov eax, dword [0x180147274]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x50], 0x1b1b
movzx eax, word [0x18014728c]
mov word [rsp + 0x14], ax
movsx eax, word [0x180147224]
mov dword [rsp + 0x44], eax
mov rax, qword [0x180147240]
mov qword [rsp + 0xa8], rax
mov eax, 0x2bd0
mov word [rsp + 0x24], ax
mov eax, 0x43dd
mov word [rsp + 0x28], ax
mov eax, 0x27ab
mov word [rsp + 0x2c], ax
mov eax, dword [0x18014711c]
cdqe
mov qword [rsp + 0xb0], rax
movsx eax, byte [0x18014711b]
mov dword [rsp + 0x70], eax
mov eax, dword [0x18014724c]
mov dword [rsp + 0x74], eax
movzx eax, word [0x180147278]
cwde
mov dword [rsp + 0x78], eax
movzx eax, byte [0x180147172]
mov byte [rsp + 9], al
movzx eax, word [0x180147270]
mov byte [rsp + 0xa], al
movzx eax, byte [0x180147157]
mov byte [rsp + 0xb], al
mov eax, dword [0x18014711c]
mov byte [rsp + 0xc], al
movzx eax, word [0x1801472b8]
mov word [rsp + 0x30], ax
mov eax, 0x6ae8
mov word [rsp + 0x34], ax
mov dword [rsp + 0x7c], 0x162e2cf2
mov eax, 0xedb4
mov word [rsp + 0x38], ax
mov dword [rsp + 0x80], 0x5b09be3
mov byte [rsp + 0xd], 0x66
movzx eax, word [rsp + 4]
mov byte [rsp], al
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x1800d03d4
mov rax, qword [0x1801472a8]
mov qword [rsp + 0x48], rax
jmp 0x1800d03de
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x10], ax
movzx eax, word [rsp + 4]
movzx eax, ax
sar eax, 2
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x40]
cdqe
mov rcx, qword [rsp + 0x88]
sub rcx, 0x1403410
sub rax, rcx
not rax
mov rcx, qword [rsp + 0x50]
not rcx
add rax, rcx
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x44], eax
movzx eax, word [rsp + 0x14]
add rsp, 0xc8
ret
Function at 0x1800d0730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [rsp + 0x18], r8w
mov word [rsp + 0x10], dx
mov word [rsp + 8], cx
sub rsp, 0xc8
mov qword [rsp + 0x90], 0x48ec
mov eax, 0x8662
mov word [rsp + 0x40], ax
mov rax, qword [0x180147280]
mov byte [rsp + 2], al
mov dword [rsp + 0x60], 0x331b0664
mov eax, dword [0x18014711c]
mov word [rsp + 4], ax
movzx eax, word [0x180147260]
movsx rax, ax
mov qword [rsp + 0x50], rax
mov eax, 0x69b2
mov word [rsp + 0x20], ax
mov dword [rsp + 0x64], 0x6afc928
movzx eax, byte [0x1801472b8]
mov byte [rsp + 0xc], al
mov byte [rsp], 0x24
mov dword [rsp + 0x68], 0x606f
movsxd rax, dword [0x1801472b4]
mov qword [rsp + 0x58], rax
mov eax, 0xa190
mov word [rsp + 0x24], ax
movzx eax, byte [0x180147156]
mov byte [rsp + 0xd], al
movzx eax, word [0x180147274]
mov word [rsp + 0x28], ax
mov eax, dword [0x180147258]
mov word [rsp + 8], ax
mov eax, 0xffffec7f
mov word [rsp + 0x2c], ax
mov eax, 0xffffbddf
mov word [rsp + 0x3c], ax
mov byte [rsp + 1], 0x76
movzx eax, byte [0x18014719e]
mov byte [rsp + 0x11], al
mov eax, 0x927154f3
mov qword [rsp + 0x98], rax
movzx eax, byte [0x180147172]
mov byte [rsp + 0xe], al
mov eax, dword [0x1801472b0]
mov qword [rsp + 0x48], rax
movzx eax, byte [0x180147156]
mov byte [rsp + 0xf], al
mov dword [rsp + 0x6c], 0x7a4d71e2
mov dword [rsp + 0x70], 0x4f6f694b
mov dword [rsp + 0x74], 0xaef358de
mov byte [rsp + 0x10], 0x23
mov dword [rsp + 0x78], 6
mov eax, 0xce8495a0
mov qword [rsp + 0xa0], rax
mov eax, 0xffff89be
mov word [rsp + 0x30], ax
movzx eax, word [0x180147260]
cwde
mov dword [rsp + 0x7c], eax
mov eax, dword [0x180147258]
mov word [rsp + 0x34], ax
mov qword [rsp + 0xa8], 0xbd
mov dword [rsp + 0x88], 0x3162
mov dword [rsp + 0x80], 0xb4741073
mov eax, 0x2e6
mov word [rsp + 0x38], ax
mov qword [rsp + 0xb0], 0x14e4
mov eax, dword [0x180147290]
mov dword [rsp + 0x84], eax
movzx eax, byte [0x180147156]
add eax, 0x46997916
mov byte [rsp], al
movzx eax, byte [0x180147176]
movzx eax, al
xor eax, 0xf22cd9c
mov dword [0x18014724c], eax
movsx eax, word [0x180147248]
movzx ecx, byte [0x180147156]
not ecx
cmp eax, ecx
jl 0x1800d092d
movzx eax, word [rsp + 8]
cwde
not eax
test eax, eax
jne 0x1800d092d
cmp dword [0x180147274], 0
jne 0x1800d092d
mov dword [rsp + 0x1c], 1
jmp 0x1800d0935
mov dword [rsp + 0x1c], 0
mov rax, qword [rsp + 0x50]
movzx ecx, byte [0x18014719e]
movzx ecx, cl
cmp rax, rcx
jne 0x1800d0953
mov dword [rsp + 0x14], 1
jmp 0x1800d095b
mov dword [rsp + 0x14], 0
movzx eax, word [rsp + 8]
cwde
cmp eax, dword [rsp + 0x14]
je 0x1800d0971
mov dword [rsp + 0x18], 1
jmp 0x1800d0979
mov dword [rsp + 0x18], 0
mov eax, dword [rsp + 0x18]
not eax
cmp dword [rsp + 0x1c], eax
je 0x1800d0997
mov rax, qword [rsp + 0x58]
imul rax, qword [rsp + 0x48]
not rax
mov byte [rsp + 1], al
movsx eax, word [0x180147174]
sub eax, 0xc
mov word [rsp + 4], ax
movzx eax, word [rsp + 4]
movsx rax, ax
mov rcx, qword [rsp + 0x50]
not rcx
xor rax, rcx
mov word [0x180147174], ax
movzx eax, byte [rsp + 2]
movzx eax, al
imul eax, eax, 0x11
cdqe
mov qword [rsp + 0x58], rax
movzx eax, word [rsp + 0x48]
add rsp, 0xc8
ret
Function at 0x1800d7ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
movzx eax, byte [0x180147316]
mov byte [rsp + 8], al
movzx eax, byte [0x180147366]
mov byte [rsp], al
mov qword [rsp + 0x58], 0x60536a98
mov byte [rsp + 9], 0x10
mov eax, 0xffff9a26
mov word [rsp + 0x18], ax
movzx eax, byte [0x180147317]
mov byte [rsp + 0xa], al
movzx eax, word [0x180147420]
mov word [rsp + 0x1c], ax
mov rax, qword [0x180147440]
mov byte [rsp + 1], al
movzx eax, word [0x180147454]
mov qword [rsp + 0x70], rax
mov byte [rsp + 0xb], 0xcb
mov dword [rsp + 0x38], 0x789e7164
mov eax, 0xffffb12a
mov word [rsp + 0x14], ax
mov eax, 0x2e04
mov word [rsp + 4], ax
mov dword [rsp + 0x3c], 0xd3
movsx rax, byte [0x18014733e]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x40], 0xfc7b8e84
movsx rax, byte [0x180147312]
mov qword [rsp + 0x68], rax
movsx eax, byte [0x180147316]
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x60], 0x7312
movzx eax, word [0x1801473d4]
mov word [rsp + 0x20], ax
movzx eax, byte [0x1801472e6]
movsx ax, al
mov word [rsp + 0x24], ax
mov eax, 0x59
mov word [rsp + 0x28], ax
movabs rax, 0xf0393e4b6176b
mov qword [rsp + 0x80], rax
mov eax, dword [0x18014743c]
mov byte [rsp + 0xc], al
movzx eax, byte [0x180147367]
movzx eax, al
mov dword [rsp + 0x48], eax
mov byte [rsp + 0xd], 5
movzx eax, byte [0x180147317]
mov byte [rsp + 0xe], al
mov rax, qword [0x180147478]
mov qword [rsp + 0x88], rax
movzx eax, byte [0x180147460]
mov byte [rsp + 0xf], al
mov eax, 0xffffc495
mov word [rsp + 0x2c], ax
mov qword [rsp + 0x90], 0xbf
mov eax, 0xcf
mov word [rsp + 0x30], ax
movzx eax, byte [0x180147317]
mov word [rsp + 0x34], ax
movsx rax, byte [0x18014733e]
mov qword [rsp + 0x98], rax
mov rax, qword [0x180147440]
mov byte [rsp + 0x10], al
mov dword [rsp + 0x4c], 0x92
movzx eax, byte [0x1801472e7]
movsx eax, al
mov dword [rsp + 0x50], eax
mov qword [rsp + 0xa0], 0x6c22
movsx rax, byte [0x180147316]
mov qword [rsp + 0xa8], rax
movsx eax, word [0x18014745c]
movsx ecx, word [rsp + 4]
lea eax, [rcx + rax - 0x26b1]
mov word [rsp + 4], ax
mov eax, 0x8728af77
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov byte [rsp], al
movzx eax, byte [rsp + 1]
add eax, 0xbe
cdqe
mov qword [rsp + 0x60], rax
movzx eax, word [rsp + 0x14]
movsx rax, ax
mov rcx, qword [0x180147470]
sub rcx, rax
mov rax, rcx
mov word [rsp + 4], ax
movzx eax, byte [0x180147366]
movsx eax, al
add eax, 0x1dc2
mov byte [0x180147311], al
mov rax, qword [rsp + 0x68]
add rsp, 0xb8
ret
Function at 0x1800d8140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [rsp + 0x10], dx
mov word [rsp + 8], cx
sub rsp, 0xc8
movzx eax, word [0x180147314]
mov dword [rsp + 0x44], eax
mov byte [rsp + 8], 0x6b
mov qword [rsp + 0x80], 0xf5
mov qword [rsp + 0x88], 0xd1
mov rax, qword [0x180147410]
mov qword [rsp + 0x90], rax
movzx eax, word [0x180147464]
mov word [rsp + 0x40], ax
mov byte [rsp + 9], 0x41
movzx eax, byte [0x180147438]
mov byte [rsp + 0xa], al
mov byte [rsp + 0xb], 0xbe
mov byte [rsp + 3], 0xb9
movsx rax, word [0x180147438]
mov qword [rsp + 0x98], rax
mov byte [rsp + 1], 0xad
mov byte [rsp + 2], 0x33
mov eax, dword [0x1801473ec]
mov eax, eax
mov qword [rsp + 0x18], rax
mov byte [rsp + 0xc], 0x31
movzx eax, byte [0x1801472e7]
movsx rax, al
mov qword [rsp + 0x70], rax
mov eax, dword [0x1801473ec]
mov byte [rsp], al
mov eax, 0x255
mov word [rsp + 4], ax
mov eax, 0xffffa181
mov word [rsp + 0x48], ax
mov rax, qword [0x180147418]
mov word [rsp + 0x20], ax
movzx eax, byte [0x180147313]
movzx eax, al
mov qword [rsp + 0x78], rax
mov rax, qword [0x180147410]
mov word [rsp + 0x24], ax
movsx rax, word [0x18014737c]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], 0x6c
mov qword [rsp + 0xa0], 0x4db2
mov eax, 0x508e
mov word [rsp + 0x28], ax
movzx eax, byte [0x180147311]
movzx eax, al
mov dword [rsp + 0x4c], eax
movzx eax, word [0x180147314]
mov dword [rsp + 0x50], eax
mov rax, qword [0x180147408]
mov word [rsp + 0x2c], ax
movzx eax, word [0x1801473d4]
mov word [rsp + 0x30], ax
movzx eax, word [0x180147478]
mov word [rsp + 0x34], ax
movzx eax, byte [0x180147454]
mov byte [rsp + 0xd], al
mov eax, 0xb2b0
mov word [rsp + 0x38], ax
mov dword [rsp + 0x54], 0x7c
mov eax, dword [0x180147400]
mov eax, eax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 0xc8
movzx eax, byte [0x18014737e]
movsx eax, al
mov dword [rsp + 0x58], eax
mov eax, 0x2696
mov word [rsp + 0x3c], ax
mov rax, qword [0x180147418]
mov dword [rsp + 0x5c], eax
mov eax, 1
mov word [rsp + 4], ax
movzx eax, byte [rsp + 2]
movzx eax, al
sub eax, 0x8939
cdqe
mov qword [rsp + 0x68], rax
movzx eax, byte [0x180147311]
dec al
mov byte [0x180147311], al
movzx eax, word [rsp + 4]
mov dword [rsp + 0x10], eax
cmp dword [rsp + 0x10], 0
je 0x1800d8338
cmp dword [rsp + 0x10], 1
je 0x1800d8374
jmp 0x1800d838a
movzx eax, byte [rsp]
movsx eax, al
sub eax, 0x6575
cdqe
mov rcx, qword [rsp + 0x18]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x18], rax
movzx eax, byte [rsp + 1]
xor eax, 0xd7
cdqe
mov rcx, qword [rsp + 0x18]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x18], rax
jmp 0x1800d838a
movzx eax, byte [rsp]
dec al
mov byte [rsp], al
movzx eax, byte [0x18178e9c8]
mov byte [0x180147317], al
movzx eax, byte [rsp + 3]
test eax, eax
je 0x1800d83c1
movzx eax, byte [rsp + 1]
mov ecx, dword [0x180147460]
sub ecx, eax
mov eax, ecx
mov ecx, dword [0x180147460]
add ecx, eax
mov eax, ecx
mov dword [0x180147460], eax
mov rax, qword [0x1801473f0]
not rax
mov qword [rsp + 0x70], rax
movabs rax, 0xb16d899a312fc
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov word [0x1801473d4], ax
mov eax, dword [rsp + 0x44]
add rsp, 0xc8
ret
Function at 0x1800d8640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov byte [rsp + 8], cl
sub rsp, 0xb8
movzx eax, byte [0x18014737f]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x50], 0x96fe
mov rax, qword [0x180147408]
mov word [rsp + 0x10], ax
mov eax, 0x3abe
mov word [rsp + 0x14], ax
mov byte [rsp + 1], 0xcb
mov qword [rsp + 0x58], 0x95
movabs rax, 0xcbd7f7b7b9641
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0xacba
mov dword [rsp + 0x3c], 0x2f90
movzx eax, byte [0x180147313]
movzx eax, al
mov word [rsp + 0x18], ax
mov eax, 0xff212620
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x4c
mov byte [rsp + 2], 0xce
movzx eax, byte [0x180147313]
movzx eax, al
mov qword [rsp + 0x80], rax
mov eax, 0x1d
mov word [rsp + 0xc], ax
movabs rax, 0x76c038bea66ff
mov qword [rsp + 0x88], rax
mov eax, 0x4fff
mov word [rsp + 0x1c], ax
mov byte [rsp + 3], 0x3b
mov eax, 0xcf6e
mov word [rsp + 0x20], ax
movzx eax, byte [0x180147438]
mov byte [rsp + 4], al
mov eax, 0xffff8746
mov word [rsp + 0x24], ax
mov eax, dword [0x180147470]
mov dword [rsp + 0x40], eax
mov eax, 0xcf79f30f
mov qword [rsp + 0x90], rax
movzx eax, byte [0x180147313]
movzx eax, al
mov qword [rsp + 0x98], rax
movzx eax, word [0x180147470]
mov word [rsp + 0x28], ax
movzx eax, byte [0x180147428]
mov byte [rsp + 5], al
mov byte [rsp + 6], 0xaa
mov eax, 0xffffa719
mov word [rsp + 0x2c], ax
mov eax, dword [0x180147400]
mov dword [rsp + 0x44], eax
mov eax, dword [0x18014743c]
mov byte [rsp + 7], al
mov eax, 0xffffe654
mov word [rsp + 0x30], ax
mov byte [rsp + 8], 0x44
mov byte [rsp + 9], 0xb8
mov dword [rsp + 0x48], 0xdb51
mov byte [rsp + 0xa], 0x99
mov eax, 0x47
mov word [rsp + 0x34], ax
mov qword [rsp + 0xa0], 0xf94
mov rax, qword [0x180147440]
mov byte [rsp + 0xb], al
movzx eax, byte [0x1801472e7]
mov byte [rsp], al
movsx eax, word [rsp + 0xc]
mov byte [0x180147317], 0x8f
movzx eax, byte [rsp]
add rsp, 0xb8
ret
Function at 0x1800dc820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x28], 0x12
mov byte [rsp + 0x30], 0xdb
mov byte [rsp + 0x31], 0xdc
mov byte [rsp + 0x32], 0x47
mov byte [rsp + 0x33], 0x66
mov byte [rsp + 0x34], 0x5b
mov byte [rsp + 0x35], 0x6b
mov byte [rsp + 0x36], 0xd5
mov byte [rsp + 0x37], 0xdf
mov byte [rsp + 0x38], 0x7a
mov byte [rsp + 0x39], 0x65
mov byte [rsp + 0x3a], 0x73
mov byte [rsp + 0x3b], 0xd5
mov byte [rsp + 0x3c], 0xe1
mov byte [rsp + 0x3d], 0xda
mov byte [rsp + 0x3e], 0x4e
mov byte [rsp + 0x3f], 0x42
mov byte [rsp + 0x40], 0x47
mov byte [rsp + 0x41], 2
mov eax, 0xbdc
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x1800dc929
mov eax, 0xbdc
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x181b8e144]
mov rcx, qword gs:[0x58]
mov edx, 0xbdc
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xbc8
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1800f5800
lea rcx, [0x18010eef0]
call fcn.1800f9df4
nop
mov eax, 0xbc8
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x58
ret
Function at 0x1800f5460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
movzx eax, byte [0x180147316]
mov byte [rsp + 0x38], al
movzx eax, byte [0x180147366]
mov byte [rsp + 0x2c], al
mov qword [rsp + 0x90], 0x60536a98
mov byte [rsp + 0x39], 0x10
mov eax, 0xffff9a26
mov word [rsp + 0x40], ax
movzx eax, byte [0x180147317]
mov byte [rsp + 0x20], al
movzx eax, word [0x180147420]
mov word [rsp + 0x30], ax
mov rax, qword [0x180147440]
mov byte [rsp + 0x2d], al
movzx eax, word [0x180147454]
mov qword [rsp + 0x88], rax
mov byte [rsp + 0x21], 0xcb
mov dword [rsp + 0x60], 0x789e7164
mov eax, 0xffffb12a
mov word [rsp + 0x28], ax
mov eax, 0x2e04
mov word [rsp + 0x44], ax
mov dword [rsp + 0x70], 0xd3
movsx rax, byte [0x18014733e]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x74], 0xfc7b8e84
movsx rax, byte [0x180147312]
mov qword [rsp + 0x98], rax
movsx eax, byte [0x180147316]
mov dword [rsp + 0x58], eax
mov qword [rsp + 0xa0], 0x7312
movzx eax, word [0x1801473d4]
mov word [rsp + 0x24], ax
movzx eax, byte [0x1801472e6]
movsx ax, al
mov word [rsp + 0x34], ax
mov eax, 0x59
mov word [rsp + 0x48], ax
movabs rax, 0xf0393e4b6176b
mov qword [rsp + 0xa8], rax
mov eax, dword [0x18014743c]
mov byte [rsp + 0x3a], al
movzx eax, byte [0x180147367]
movzx eax, al
mov dword [rsp + 0x78], eax
mov byte [rsp + 0x3b], 5
movzx eax, byte [0x180147317]
mov byte [rsp + 0x3c], al
mov rax, qword [0x180147478]
mov qword [rsp + 0xb0], rax
movzx eax, byte [0x180147460]
mov byte [rsp + 0x3d], al
mov eax, 0xffffc495
mov word [rsp + 0x4c], ax
mov qword [rsp + 0xb8], 0xbf
mov eax, 0xcf
mov word [rsp + 0x50], ax
movzx eax, byte [0x180147317]
mov word [rsp + 0x54], ax
movsx rax, byte [0x18014733e]
mov qword [rsp + 0xc0], rax
mov rax, qword [0x180147440]
mov byte [rsp + 0x3e], al
mov dword [rsp + 0x7c], 0x92
movzx eax, byte [0x1801472e7]
movsx eax, al
mov dword [rsp + 0x80], eax
mov qword [rsp + 0xc8], 0x6c22
movsx rax, byte [0x180147316]
mov qword [rsp + 0xd0], rax
imul rax, qword [0x180147468], 0xb745
mov dword [rsp + 0x58], eax
movzx eax, word [rsp + 0x24]
cwde
mov ecx, dword [0x180147404]
sub eax, ecx
movzx ecx, word [rsp + 0x24]
movsx ecx, cx
or ecx, eax
mov eax, ecx
mov word [rsp + 0x24], ax
mov rax, qword [rsp + 0xf0]
mov qword [0x18178e9c0], rax
movzx eax, word [rsp + 0x24]
movsx rax, ax
movabs rcx, 0xc71e15966ce7f
and rax, rcx
mov ecx, dword [0x1801473ec]
mov ecx, ecx
xor rcx, rax
mov rax, rcx
mov dword [0x1801473ec], eax
mov byte [0x1801472fb], 1
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 1
je 0x1800f5748
jmp 0x1800f574d
call fcn.1800f32e0
movzx eax, word [rsp + 0x30]
movzx ecx, word [rsp + 0x40]
movsx ecx, cx
add eax, ecx
movzx ecx, word [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov word [rsp + 0x30], ax
mov eax, dword [rsp + 0x60]
mov eax, eax
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov eax, 1
add rsp, 0xe8
ret
Function at 0x1800f5e30
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x28], 0x41
mov byte [rsp + 0x30], 0xbc
mov byte [rsp + 0x31], 0xb8
mov byte [rsp + 0x32], 0xea
mov byte [rsp + 0x33], 0xed
mov byte [rsp + 0x34], 0xeb
mov byte [rsp + 0x35], 0xc9
mov byte [rsp + 0x36], 0x6e
mov byte [rsp + 0x37], 0xe3
mov byte [rsp + 0x38], 0x4b
mov byte [rsp + 0x39], 0x1a
mov byte [rsp + 0x3a], 0x65
mov byte [rsp + 0x3b], 0x42
mov byte [rsp + 0x3c], 0xec
mov byte [rsp + 0x3d], 0xbd
mov byte [rsp + 0x3e], 0xb9
mov byte [rsp + 0x3f], 0xbb
mov byte [rsp + 0x40], 0xbc
mov byte [rsp + 0x41], 0x9e
mov byte [rsp + 0x42], 0x33
mov byte [rsp + 0x43], 0xb5
mov byte [rsp + 0x44], 0x4d
mov byte [rsp + 0x45], 0x40
mov byte [rsp + 0x46], 0x65
mov byte [rsp + 0x47], 0x11
mov byte [rsp + 0x48], 0xe8
mov byte [rsp + 0x49], 0xbf
mov byte [rsp + 0x4a], 0xbf
mov byte [rsp + 0x4b], 0xef
mov byte [rsp + 0x4c], 0xba
mov byte [rsp + 0x4d], 0x99
mov byte [rsp + 0x4e], 0x32
mov byte [rsp + 0x4f], 0xb7
mov byte [rsp + 0x50], 0x18
mov byte [rsp + 0x51], 0x16
mov byte [rsp + 0x52], 0x31
mov byte [rsp + 0x53], 0x18
mov byte [rsp + 0x54], 0xb9
mov byte [rsp + 0x55], 0xbc
mov byte [rsp + 0x56], 0xbe
mov byte [rsp + 0x57], 0xea
mov byte [rsp + 0x58], 0xbe
mov byte [rsp + 0x59], 0x98
mov byte [rsp + 0x5a], 0x39
mov byte [rsp + 0x5b], 0xb4
mov byte [rsp + 0x5c], 0x4f
mov byte [rsp + 0x5d], 0x41
mov byte [rsp + 0x5e], 0x3a
mov byte [rsp + 0x5f], 0x43
mov byte [rsp + 0x60], 0xec
mov byte [rsp + 0x61], 0xb0
mov byte [rsp + 0x62], 0xbf
mov byte [rsp + 0x63], 0xbc
mov byte [rsp + 0x64], 0xea
mov byte [rsp + 0x65], 0x9f
mov byte [rsp + 0x66], 0x38
mov byte [rsp + 0x67], 0xb9
mov byte [rsp + 0x68], 0x10
mov byte [rsp + 0x69], 0x47
mov byte [rsp + 0x6a], 0x32
mov byte [rsp + 0x6b], 0x46
mov byte [rsp + 0x6c], 0xea
mov byte [rsp + 0x6d], 0xef
mov byte [rsp + 0x6e], 0xec
mov byte [rsp + 0x6f], 0xbe
mov byte [rsp + 0x70], 0x89
mov eax, 0xae4
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x1800f6027
mov eax, 0xae4
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x181b8e144]
mov rcx, qword gs:[0x58]
mov edx, 0xae4
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xaa0
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1800f5870
lea rcx, [0x18010ec50]
call fcn.1800f9df4
nop
mov eax, 0xaa0
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x88
ret