joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800013eb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18000a008]
jne 0x18000106a
rol rcx, 0x10
test cx, 0xffff
jne 0x180001066
repz ret
ror rcx, 0x10
jmp 0x180001344
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18000b100]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18000b1f8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1800013c9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18000b100]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1800013eb
mov rax, qword [rsp + 0x88]
mov qword [0x18000b1f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18000b198], rax
mov rax, qword [0x18000b1f8]
mov qword [0x18000b070], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18000b180], rax
mov dword [0x18000b060], 0xc0000409
mov dword [0x18000b064], 1
mov rax, qword [0x18000a008]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18000a010]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18000b0f8], eax
mov ecx, 1
call fcn.180002ccc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180007278]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18000b0f8], 0
jne 0x180001472
mov ecx, 1
call fcn.180002ccc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x180001db0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180001c24
Function at 0x180005df8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.180001558
xor ebx, ebx
mov rdi, rax
cmp qword [0x18000bdc0], rbx
jne 0x180005efe
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180005fd3
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180005fd3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18000bdc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18000bdc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18000bdd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18000bde0], rax
test rax, rax
je 0x180005ef5
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18000bdd8], rax
jmp 0x180005f05
mov rax, qword [0x18000bdd8]
jmp 0x180005f0c
mov rax, qword [0x18000bdd8]
mov r11, qword [0x18000bde0]
cmp rax, rdi
je 0x180005f74
cmp r11, rdi
je 0x180005f74
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18000bde0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180005f74
test rax, rax
je 0x180005f74
call rsi
test rax, rax
je 0x180005f6e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180005f6e
test byte [rsp + 0x38], 1
jne 0x180005f74
bts ebp, 0x15
jmp 0x180005fb2
mov rcx, qword [0x18000bdc8]
cmp rcx, rdi
je 0x180005fb2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180005fb2
call rax
mov rbx, rax
test rax, rax
je 0x180005fb2
mov rcx, qword [0x18000bdd0]
cmp rcx, rdi
je 0x180005fb2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180005fb2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18000bdc0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180005fd3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x180005fd5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180016440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
lea rcx, [0x180090648]
nop
nop
nop
nop
nop
nop
mov dword [rbp - 0x20], 0x736f6c43
mov dword [rbp - 0x1c], 0x6e614865
mov dword [rbp - 0x18], 0x656c64
nop
nop
nop
nop
nop
nop
nop
lea rcx, [0x180090538]
nop
nop
nop
nop
nop
nop
mov dword [rbp - 0x10], 0x6e72656b
mov dword [rbp - 0xc], 0x32336c65
mov dword [rbp - 8], 0x6c6c642e
mov byte [rbp - 4], 0
nop
nop
nop
nop
nop
nop
nop
mov r8, rbx
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x10]
call fcn.1800169f0
nop
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1800164d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov ebx, edx
mov rdi, rcx
lea rcx, [0x1800907d8]
nop
nop
nop
nop
nop
nop
movdqa xmm0, xmmword [0x18009d420]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x40], 0
nop
nop
nop
nop
nop
nop
nop
lea rcx, [0x180090804]
nop
nop
nop
nop
nop
nop
mov dword [rsp + 0x20], 0x6e72656b
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
nop
nop
nop
nop
nop
nop
nop
mov r9d, ebx
mov r8, rdi
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.180016fb0
nop
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x180016560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
lea rcx, [0x18009080c]
nop
nop
nop
nop
nop
nop
movdqa xmm0, xmmword [0x18009d3f0]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], reloc.WS2_32.dll_WSAStartup
nop
nop
nop
nop
nop
nop
nop
lea rcx, [0x180090844]
nop
nop
nop
nop
nop
nop
mov dword [rsp + 0x20], 0x6e72656b
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
nop
nop
nop
nop
nop
nop
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1800172a0
nop
add rsp, 0x58
ret

Function at 0x1800165e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rdi, r8
mov rsi, rdx
mov rbx, qword [0x1800b9520]
lea rcx, [0x18009091c]
nop
nop
nop
nop
nop
nop
movdqa xmm0, xmmword [0x18009d200]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x6e6f6974
mov byte [rsp + 0x54], 0
nop
nop
nop
nop
nop
nop
nop
lea rcx, [0x1800908d4]
nop
nop
nop
nop
nop
nop
mov dword [rsp + 0x30], 0x70617370
mov dword [rsp + 0x34], 0x6c642e69
mov word [rsp + 0x38], 0x6c
nop
nop
nop
nop
nop
nop
nop
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.180017b70
nop
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x180016720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
lea rcx, [0x180090998]
nop
nop
nop
nop
nop
nop
movdqa xmm0, xmmword [0x18009d1d0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x40], 0
nop
nop
nop
nop
nop
nop
nop
lea rcx, [0x180090954]
nop
nop
nop
nop
nop
nop
mov dword [rsp + 0x20], 0x6e72656b
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
nop
nop
nop
nop
nop
nop
nop
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.180016cd0
nop
add rsp, 0x50
pop rbx
ret

Function at 0x1800167a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
lea rcx, [0x180090980]
nop
nop
nop
nop
nop
nop
movdqa xmm0, xmmword [0x18009d1d0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x40], 0
nop
nop
nop
nop
nop
nop
nop
lea rcx, [0x1800909a0]
nop
nop
nop
nop
nop
nop
mov dword [rsp + 0x20], 0x6e72656b
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
nop
nop
nop
nop
nop
nop
nop
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.180018160
nop
add rsp, 0x50
pop rbx
ret

Function at 0x180016820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
lea rcx, [0x180090ad4]
nop
nop
nop
nop
nop
nop
movdqa xmm0, xmmword [0x18009d220]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x40], 0
nop
nop
nop
nop
nop
nop
nop
lea rcx, [0x180090b0c]
nop
nop
nop
nop
nop
nop
mov dword [rsp + 0x20], 0x6e72656b
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
nop
nop
nop
nop
nop
nop
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1800172a0
nop
add rsp, 0x58
ret

Function at 0x1800168a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
lea rcx, [0x180090b34]
nop
nop
nop
nop
nop
nop
movdqa xmm0, xmmword [0x18009d2f0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x746365
nop
nop
nop
nop
nop
nop
nop
lea rcx, [0x180090adc]
nop
nop
nop
nop
nop
nop
mov dword [rsp + 0x20], 0x6e72656b
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
nop
nop
nop
nop
nop
nop
nop
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.180018750
nop
add rsp, 0x50
pop rbx
ret

Function at 0x180016920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
lea rcx, [0x180090b78]
nop
nop
nop
nop
nop
nop
mov dword [rbp - 0x10], 0x50746547
mov dword [rbp - 0xc], 0x41636f72
mov dword [rbp - 8], 0x65726464
mov word [rbp - 4], 0x7373
mov byte [rbp - 2], 0
nop
nop
nop
nop
nop
nop
nop
lea rcx, [0x180090ba4]
nop
nop
nop
nop
nop
nop
mov dword [rbp - 0x20], 0x6e72656b
mov dword [rbp - 0x1c], 0x32336c65
mov dword [rbp - 0x18], 0x6c6c642e
mov byte [rbp - 0x14], 0
nop
nop
nop
nop
nop
nop
nop
mov r9, rbx
mov r8, rdi
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x20]
call fcn.180018a40
nop
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x1800169f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r12, r8
mov r15, rdx
mov r14, rcx
mov ecx, dword [0x1800c1dc0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rdi, qword [rax + rcx*8]
add rdi, rdx
xor r13d, r13d
lea rbx, [r13 - 1]
lea rsi, [0x1800c4b58]
mov eax, dword [rdi]
cmp dword [0x1800c492c], eax
jg 0x180016bb1
mov eax, dword [rdi]
cmp dword [0x1800c4b0c], eax
jg 0x180016bf9
mov rcx, r14
call qword [0x1800c4948]
lea rsi, [0x1800c4bf0]
mov eax, dword [rdi]
cmp dword [0x1800c4940], eax
jg 0x180016c87
mov eax, dword [rdi]
cmp dword [0x1800c4bc4], eax
jg 0x180016ad0
mov rax, qword [0x1800c48e0]
mov rcx, r14
call rax
mov rcx, rax
mov rdx, r15
call fcn.180015fd0
mov rcx, r12
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp rax
inc r8
cmp byte [rax + r8], 0
je 0x180016b5a
jmp 0x180016ab1
inc rbx
cmp byte [rax + rbx], 0
je 0x180016b84
jmp 0x180016ac1
lea rcx, [0x1800c4bc4]
call fcn.1800779b8
cmp dword [0x1800c4bc4], 0xffffffff
jne 0x180016a7d
cmp qword [0x1800c4c08], 0x10
cmovae rsi, qword [0x1800c4bf0]
lea rcx, [0x180090484]
nop
nop
nop
nop
nop
nop
mov dword [rbp - 0x20], 0x6e72656b
mov dword [rbp - 0x1c], 0x32336c65
mov dword [rbp - 0x18], 0x6c6c642e
mov byte [rbp - 0x14], 0
nop
nop
nop
nop
nop
nop
lea rcx, [rbp - 0x20]
call qword [0x1800840c8]
mov qword [rbp - 0x20], r13
mov dword [rbp - 0x18], r13d
mov byte [rbp - 0x14], r13b
mov rdx, rsi
mov rcx, rax
call fcn.180015fd0
mov qword [0x1800c48e0], rax
lea rcx, [0x1800c4bc4]
call fcn.180077958
jmp 0x180016a7d
mov rdx, rax
mov rcx, rsi
call fcn.180002f70
nop
lea rcx, [0x18007fbf0]
call fcn.180077e6c
nop
lea rcx, [0x1800c492c]
call fcn.180077958
jmp 0x180016a47
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.180002f70
nop
lea rcx, [0x18007fb80]
call fcn.180077e6c
nop
lea rcx, [0x1800c4940]
call fcn.180077958
jmp 0x180016a73
lea rcx, [0x1800c492c]
call fcn.1800779b8
cmp dword [0x1800c492c], ebx
jne 0x180016a47
lea rdx, [0x18009fa1b]
lea rcx, [rbp - 0x20]
call fcn.180018d30
nop
mov qword [0x1800c4b58], r13
movdqa xmm0, xmmword [0x18009d180]
movdqu xmmword [0x1800c4b68], xmm0
mov r8, rbx
jmp 0x180016ab1
lea rcx, [0x1800c4b0c]
call fcn.1800779b8
cmp dword [0x1800c4b0c], 0xffffffff
jne 0x180016a55
cmp qword [0x1800c4b70], 0x10
cmovae rsi, qword [0x1800c4b58]
lea rcx, [0x180090484]
nop
nop
nop
nop
nop
nop
mov dword [rbp - 0x20], 0x6e72656b
mov dword [rbp - 0x1c], 0x32336c65
mov dword [rbp - 0x18], 0x6c6c642e
mov byte [rbp - 0x14], 0
nop
nop
nop
nop
nop
nop
lea rcx, [rbp - 0x20]
call qword [0x1800840c8]
mov qword [rbp - 0x20], r13
mov dword [rbp - 0x18], r13d
mov byte [rbp - 0x14], r13b
mov rdx, rsi
mov rcx, rax
call fcn.180015fd0
mov qword [0x1800c4948], rax
lea rcx, [0x1800c4b0c]
call fcn.180077958
jmp 0x180016a55
lea rcx, [0x1800c4940]
call fcn.1800779b8
cmp dword [0x1800c4940], 0xffffffff
jne 0x180016a73
lea rdx, [0x18009e180]
lea rcx, [rbp - 0x20]
call fcn.180018e00
nop
mov qword [0x1800c4bf0], r13
movdqa xmm0, xmmword [0x18009d180]
movdqu xmmword [0x1800c4c00], xmm0
jmp 0x180016ac1
Function at 0x180016cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r12, r8
mov r15, rdx
mov r14, rcx
mov ecx, dword [0x1800c1dc0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rdi, qword [rax + rcx*8]
add rdi, rdx
xor r13d, r13d
lea rbx, [r13 - 1]
lea rsi, [0x1800c4b80]
mov eax, dword [rdi]
cmp dword [0x1800c4b14], eax
jg 0x180016e91
mov eax, dword [rdi]
cmp dword [0x1800c49f0], eax
jg 0x180016ed9
mov rcx, r14
call qword [0x1800c4b40]
lea rsi, [0x1800c49a0]
mov eax, dword [rdi]
cmp dword [0x1800c4cf8], eax
jg 0x180016f67
mov eax, dword [rdi]
cmp dword [0x1800c4b38], eax
jg 0x180016db0
mov rax, qword [0x1800c4a20]
mov rcx, r14
call rax
mov rcx, rax
mov rdx, r15
call fcn.180015fd0
mov rcx, r12
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp rax
inc r8
cmp byte [rax + r8], 0
je 0x180016e3a
jmp 0x180016d91
inc rbx
cmp byte [rax + rbx], 0
je 0x180016e64
jmp 0x180016da1
lea rcx, [0x1800c4b38]
call fcn.1800779b8
cmp dword [0x1800c4b38], 0xffffffff
jne 0x180016d5d
cmp qword [0x1800c49b8], 0x10
cmovae rsi, qword [0x1800c49a0]
lea rcx, [0x180090484]
nop
nop
nop
nop
nop
nop
mov dword [rbp - 0x20], 0x6e72656b
mov dword [rbp - 0x1c], 0x32336c65
mov dword [rbp - 0x18], 0x6c6c642e
mov byte [rbp - 0x14], 0
nop
nop
nop
nop
nop
nop
lea rcx, [rbp - 0x20]
call qword [0x1800840c8]
mov qword [rbp - 0x20], r13
mov dword [rbp - 0x18], r13d
mov byte [rbp - 0x14], r13b
mov rdx, rsi
mov rcx, rax
call fcn.180015fd0
mov qword [0x1800c4a20], rax
lea rcx, [0x1800c4b38]
call fcn.180077958
jmp 0x180016d5d
mov rdx, rax
mov rcx, rsi
call fcn.180002f70
nop
lea rcx, [0x18007fb10]
call fcn.180077e6c
nop
lea rcx, [0x1800c4b14]
call fcn.180077958
jmp 0x180016d27
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.180002f70
nop
lea rcx, [0x18007faa0]
call fcn.180077e6c
nop
lea rcx, [0x1800c4cf8]
call fcn.180077958
jmp 0x180016d53
lea rcx, [0x1800c4b14]
call fcn.1800779b8
cmp dword [0x1800c4b14], ebx
jne 0x180016d27
lea rdx, [0x18009fa6b]
lea rcx, [rbp - 0x20]
call fcn.180018d30
nop
mov qword [0x1800c4b80], r13
movdqa xmm0, xmmword [0x18009d180]
movdqu xmmword [0x1800c4b90], xmm0
mov r8, rbx
jmp 0x180016d91
lea rcx, [0x1800c49f0]
call fcn.1800779b8
cmp dword [0x1800c49f0], 0xffffffff
jne 0x180016d35
cmp qword [0x1800c4b98], 0x10
cmovae rsi, qword [0x1800c4b80]
lea rcx, [0x180090484]
nop
nop
nop
nop
nop
nop
mov dword [rbp - 0x20], 0x6e72656b
mov dword [rbp - 0x1c], 0x32336c65
mov dword [rbp - 0x18], 0x6c6c642e
mov byte [rbp - 0x14], 0
nop
nop
nop
nop
nop
nop
lea rcx, [rbp - 0x20]
call qword [0x1800840c8]
mov qword [rbp - 0x20], r13
mov dword [rbp - 0x18], r13d
mov byte [rbp - 0x14], r13b
mov rdx, rsi
mov rcx, rax
call fcn.180015fd0
mov qword [0x1800c4b40], rax
lea rcx, [0x1800c49f0]
call fcn.180077958
jmp 0x180016d35
lea rcx, [0x1800c4cf8]
call fcn.1800779b8
cmp dword [0x1800c4cf8], 0xffffffff
jne 0x180016d53
lea rdx, [0x18009e1c0]
lea rcx, [rbp - 0x20]
call fcn.180018e00
nop
mov qword [0x1800c49a0], r13
movdqa xmm0, xmmword [0x18009d180]
movdqu xmmword [0x1800c49b0], xmm0
jmp 0x180016da1
Function at 0x180016fb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov r13d, r9d
mov r12, r8
mov r15, rdx
mov r14, rcx
mov ecx, dword [0x1800c1dc0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov rbx, 0xffffffffffffffff
lea rdi, [0x1800c4a58]
mov eax, dword [rsi]
cmp dword [0x1800c4968], eax
jg 0x180017170
mov eax, dword [rsi]
cmp dword [0x1800c4ca4], eax
jg 0x1800171bc
mov rcx, r14
call qword [0x1800c4958]
lea rdi, [0x1800c4ba0]
mov eax, dword [rsi]
cmp dword [0x1800c4aa4], eax
jg 0x18001724a
mov eax, dword [rsi]
cmp dword [0x1800c48b0], eax
jg 0x18001708f
mov rax, qword [0x1800c48f0]
mov rcx, r14
call rax
mov rcx, rax
mov rdx, r15
call fcn.180015fd0
mov edx, r13d
mov rcx, r12
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
jmp rax
inc r8
cmp byte [rax + r8], 0
je 0x180017119
jmp 0x180017070
inc rbx
cmp byte [rax + rbx], 0
je 0x180017143
jmp 0x180017080
lea rcx, [0x1800c48b0]
call fcn.1800779b8
cmp dword [0x1800c48b0], 0xffffffff
jne 0x18001703d
cmp qword [0x1800c4bb8], 0x10
cmovae rdi, qword [0x1800c4ba0]
lea rcx, [0x180090484]
nop
nop
nop
nop
nop
nop
mov dword [rbp - 0x28], 0x6e72656b
mov dword [rbp - 0x24], 0x32336c65
mov dword [rbp - 0x20], 0x6c6c642e
mov byte [rbp - 0x1c], 0
nop
nop
nop
nop
nop
nop
lea rcx, [rbp - 0x28]
call qword [0x1800840c8]
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov dword [rbp - 0x20], ecx
mov byte [rbp - 0x1c], cl
mov rdx, rdi
mov rcx, rax
call fcn.180015fd0
mov qword [0x1800c48f0], rax
lea rcx, [0x1800c48b0]
call fcn.180077958
jmp 0x18001703d
mov rdx, rax
mov rcx, rdi
call fcn.180002f70
nop
lea rcx, [0x18007fa30]
call fcn.180077e6c
nop
lea rcx, [0x1800c4968]
call fcn.180077958
jmp 0x180017007
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.180002f70
nop
lea rcx, [0x18007f9c0]
call fcn.180077e6c
nop
lea rcx, [0x1800c4aa4]
call fcn.180077958
jmp 0x180017033
lea rcx, [0x1800c4968]
call fcn.1800779b8
cmp dword [0x1800c4968], ebx
jne 0x180017007
lea rdx, [0x18009fac3]
lea rcx, [rbp - 0x28]
call fcn.180018d30
nop
mov qword [0x1800c4a58], 0
movdqa xmm0, xmmword [0x18009d180]
movdqu xmmword [0x1800c4a68], xmm0
mov r8, rbx
jmp 0x180017070
lea rcx, [0x1800c4ca4]
call fcn.1800779b8
cmp dword [0x1800c4ca4], 0xffffffff
jne 0x180017015
cmp qword [0x1800c4a70], 0x10
cmovae rdi, qword [0x1800c4a58]
lea rcx, [0x180090484]
nop
nop
nop
nop
nop
nop
mov dword [rbp - 0x28], 0x6e72656b
mov dword [rbp - 0x24], 0x32336c65
mov dword [rbp - 0x20], 0x6c6c642e
mov byte [rbp - 0x1c], 0
nop
nop
nop
nop
nop
nop
lea rcx, [rbp - 0x28]
call qword [0x1800840c8]
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov dword [rbp - 0x20], ecx
mov byte [rbp - 0x1c], cl
mov rdx, rdi
mov rcx, rax
call fcn.180015fd0
mov qword [0x1800c4958], rax
lea rcx, [0x1800c4ca4]
call fcn.180077958
jmp 0x180017015
lea rcx, [0x1800c4aa4]
call fcn.1800779b8
cmp dword [0x1800c4aa4], 0xffffffff
jne 0x180017033
lea rdx, [0x18009e290]
lea rcx, [rbp - 0x28]
call fcn.180018e00
nop
mov qword [0x1800c4ba0], 0
movdqa xmm0, xmmword [0x18009d180]
movdqu xmmword [0x1800c4bb0], xmm0
jmp 0x180017080
Function at 0x180017e70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov r13, r9
mov r12, r8
mov r15, rdx
mov r14, rcx
mov ecx, dword [0x1800c1dc0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov rbx, 0xffffffffffffffff
lea rdi, [0x1800c4a80]
mov eax, dword [rsi]
cmp dword [0x1800c4c58], eax
jg 0x180018030
mov eax, dword [rsi]
cmp dword [0x1800c4ca8], eax
jg 0x18001807c
mov rcx, r14
call qword [0x1800c4960]
lea rdi, [0x1800c4d00]
mov eax, dword [rsi]
cmp dword [0x1800c4b24], eax
jg 0x18001810a
mov eax, dword [rsi]
cmp dword [0x1800c4b50], eax
jg 0x180017f4f
mov rax, qword [0x1800c49e8]
mov rcx, r14
call rax
mov rcx, rax
mov rdx, r15
call fcn.180015fd0
mov rdx, r13
mov rcx, r12
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
jmp rax
inc r8
cmp byte [rax + r8], 0
je 0x180017fd9
jmp 0x180017f30
inc rbx
cmp byte [rax + rbx], 0
je 0x180018003
jmp 0x180017f40
lea rcx, [0x1800c4b50]
call fcn.1800779b8
cmp dword [0x1800c4b50], 0xffffffff
jne 0x180017efd
cmp qword [0x1800c4d18], 0x10
cmovae rdi, qword [0x1800c4d00]
lea rcx, [0x180090484]
nop
nop
nop
nop
nop
nop
mov dword [rbp - 0x28], 0x6e72656b
mov dword [rbp - 0x24], 0x32336c65
mov dword [rbp - 0x20], 0x6c6c642e
mov byte [rbp - 0x1c], 0
nop
nop
nop
nop
nop
nop
lea rcx, [rbp - 0x28]
call qword [0x1800840c8]
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov dword [rbp - 0x20], ecx
mov byte [rbp - 0x1c], cl
mov rdx, rdi
mov rcx, rax
call fcn.180015fd0
mov qword [0x1800c49e8], rax
lea rcx, [0x1800c4b50]
call fcn.180077958
jmp 0x180017efd
mov rdx, rax
mov rcx, rdi
call fcn.180002f70
nop
lea rcx, [0x18007f5d0]
call fcn.180077e6c
nop
lea rcx, [0x1800c4c58]
call fcn.180077958
jmp 0x180017ec7
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.180002f70
nop
lea rcx, [0x18007f560]
call fcn.180077e6c
nop
lea rcx, [0x1800c4b24]
call fcn.180077958
jmp 0x180017ef3
lea rcx, [0x1800c4c58]
call fcn.1800779b8
cmp dword [0x1800c4c58], ebx
jne 0x180017ec7
lea rdx, [0x18009fc53]
lea rcx, [rbp - 0x28]
call fcn.180018d30
nop
mov qword [0x1800c4a80], 0
movdqa xmm0, xmmword [0x18009d180]
movdqu xmmword [0x1800c4a90], xmm0
mov r8, rbx
jmp 0x180017f30
lea rcx, [0x1800c4ca8]
call fcn.1800779b8
cmp dword [0x1800c4ca8], 0xffffffff
jne 0x180017ed5
cmp qword [0x1800c4a98], 0x10
cmovae rdi, qword [0x1800c4a80]
lea rcx, [0x180090484]
nop
nop
nop
nop
nop
nop
mov dword [rbp - 0x28], 0x6e72656b
mov dword [rbp - 0x24], 0x32336c65
mov dword [rbp - 0x20], 0x6c6c642e
mov byte [rbp - 0x1c], 0
nop
nop
nop
nop
nop
nop
lea rcx, [rbp - 0x28]
call qword [0x1800840c8]
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov dword [rbp - 0x20], ecx
mov byte [rbp - 0x1c], cl
mov rdx, rdi
mov rcx, rax
call fcn.180015fd0
mov qword [0x1800c4960], rax
lea rcx, [0x1800c4ca8]
call fcn.180077958
jmp 0x180017ed5
lea rcx, [0x1800c4b24]
call fcn.1800779b8
cmp dword [0x1800c4b24], 0xffffffff
jne 0x180017ef3
lea rdx, [0x18009e3a0]
lea rcx, [rbp - 0x28]
call fcn.180018e00
nop
mov qword [0x1800c4d00], 0
movdqa xmm0, xmmword [0x18009d180]
movdqu xmmword [0x1800c4d10], xmm0
jmp 0x180017f40