joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18008076c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199b98]
mov rbx, rdx
test rax, rax
jne 0x18008081d
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1800807cb
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199b98], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199b98]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180080846
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180080872
cmp dword [rbp - 0x18], 0x10000
je 0x180080872
cmp qword [rbp - 0x20], 0x1000
jb 0x180080872
cmp dword [rbp - 0x10], 0x1000000
je 0x18008086e
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180080874
mov al, 1
jmp 0x180080874
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180080eac
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199940]
mov rbx, rdx
test rax, rax
jne 0x180080f5d
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180080f0b
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199940], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199940]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180080f86
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180080fb2
cmp dword [rbp - 0x18], 0x10000
je 0x180080fb2
cmp qword [rbp - 0x20], 0x1000
jb 0x180080fb2
cmp dword [rbp - 0x10], 0x1000000
je 0x180080fae
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180080fb4
mov al, 1
jmp 0x180080fb4
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180082758
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199c50]
mov rbx, rdx
test rax, rax
jne 0x180082809
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1800827b7
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199c50], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199c50]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180082832
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18008285e
cmp dword [rbp - 0x18], 0x10000
je 0x18008285e
cmp qword [rbp - 0x20], 0x1000
jb 0x18008285e
cmp dword [rbp - 0x10], 0x1000000
je 0x18008285a
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180082860
mov al, 1
jmp 0x180082860
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180082e98
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1801999a8]
mov rbx, rdx
test rax, rax
jne 0x180082f49
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180082ef7
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1801999a8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1801999a8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180082f72
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180082f9e
cmp dword [rbp - 0x18], 0x10000
je 0x180082f9e
cmp qword [rbp - 0x20], 0x1000
jb 0x180082f9e
cmp dword [rbp - 0x10], 0x1000000
je 0x180082f9a
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180082fa0
mov al, 1
jmp 0x180082fa0
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1800835d8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199c48]
mov rbx, rdx
test rax, rax
jne 0x180083689
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180083637
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199c48], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199c48]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1800836b2
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800836de
cmp dword [rbp - 0x18], 0x10000
je 0x1800836de
cmp qword [rbp - 0x20], 0x1000
jb 0x1800836de
cmp dword [rbp - 0x10], 0x1000000
je 0x1800836da
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x1800836e0
mov al, 1
jmp 0x1800836e0
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180084e84
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199978]
mov rbx, rdx
test rax, rax
jne 0x180084f35
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180084ee3
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199978], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199978]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180084f5e
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180084f8a
cmp dword [rbp - 0x18], 0x10000
je 0x180084f8a
cmp qword [rbp - 0x20], 0x1000
jb 0x180084f8a
cmp dword [rbp - 0x10], 0x1000000
je 0x180084f86
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180084f8c
mov al, 1
jmp 0x180084f8c
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180086730
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1801998b8]
mov rbx, rdx
test rax, rax
jne 0x1800867e1
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18008678f
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1801998b8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1801998b8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18008680a
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180086836
cmp dword [rbp - 0x18], 0x10000
je 0x180086836
cmp qword [rbp - 0x20], 0x1000
jb 0x180086836
cmp dword [rbp - 0x10], 0x1000000
je 0x180086832
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180086838
mov al, 1
jmp 0x180086838
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180086e70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199ad0]
mov rbx, rdx
test rax, rax
jne 0x180086f21
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180086ecf
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199ad0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199ad0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180086f4a
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180086f76
cmp dword [rbp - 0x18], 0x10000
je 0x180086f76
cmp qword [rbp - 0x20], 0x1000
jb 0x180086f76
cmp dword [rbp - 0x10], 0x1000000
je 0x180086f72
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180086f78
mov al, 1
jmp 0x180086f78
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1800875b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199be8]
mov rbx, rdx
test rax, rax
jne 0x180087661
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18008760f
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199be8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199be8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18008768a
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800876b6
cmp dword [rbp - 0x18], 0x10000
je 0x1800876b6
cmp qword [rbp - 0x20], 0x1000
jb 0x1800876b6
cmp dword [rbp - 0x10], 0x1000000
je 0x1800876b2
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x1800876b8
mov al, 1
jmp 0x1800876b8
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180088e5c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199cf0]
mov rbx, rdx
test rax, rax
jne 0x180088f0d
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180088ebb
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199cf0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199cf0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180088f36
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180088f62
cmp dword [rbp - 0x18], 0x10000
je 0x180088f62
cmp qword [rbp - 0x20], 0x1000
jb 0x180088f62
cmp dword [rbp - 0x10], 0x1000000
je 0x180088f5e
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180088f64
mov al, 1
jmp 0x180088f64
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18008a708
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199ba8]
mov rbx, rdx
test rax, rax
jne 0x18008a7b9
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18008a767
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199ba8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199ba8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18008a7e2
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18008a80e
cmp dword [rbp - 0x18], 0x10000
je 0x18008a80e
cmp qword [rbp - 0x20], 0x1000
jb 0x18008a80e
cmp dword [rbp - 0x10], 0x1000000
je 0x18008a80a
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18008a810
mov al, 1
jmp 0x18008a810
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18008bfb4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1801998e0]
mov rbx, rdx
test rax, rax
jne 0x18008c065
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18008c013
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1801998e0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1801998e0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18008c08e
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18008c0ba
cmp dword [rbp - 0x18], 0x10000
je 0x18008c0ba
cmp qword [rbp - 0x20], 0x1000
jb 0x18008c0ba
cmp dword [rbp - 0x10], 0x1000000
je 0x18008c0b6
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18008c0bc
mov al, 1
jmp 0x18008c0bc
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18008d860
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199cd8]
mov rbx, rdx
test rax, rax
jne 0x18008d911
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18008d8bf
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199cd8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199cd8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18008d93a
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18008d966
cmp dword [rbp - 0x18], 0x10000
je 0x18008d966
cmp qword [rbp - 0x20], 0x1000
jb 0x18008d966
cmp dword [rbp - 0x10], 0x1000000
je 0x18008d962
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18008d968
mov al, 1
jmp 0x18008d968
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18008dfa0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199898]
mov rbx, rdx
test rax, rax
jne 0x18008e051
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18008dfff
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199898], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199898]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18008e07a
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18008e0a6
cmp dword [rbp - 0x18], 0x10000
je 0x18008e0a6
cmp qword [rbp - 0x20], 0x1000
jb 0x18008e0a6
cmp dword [rbp - 0x10], 0x1000000
je 0x18008e0a2
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18008e0a8
mov al, 1
jmp 0x18008e0a8
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret