joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800f1ff0
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x2a
jb 0x1800f1ffd
mov word [rcx + 0x58], r11w
ret

Function at 0x1800f2024
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x2a
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f2031
xor edx, edx
mov word [rcx + 0x58], dx
ret

Function at 0x1800f2080
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x2b
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f208d
xor edx, edx
mov word [rcx + 0x5a], dx
ret

Function at 0x1800f20f8
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x2c
jb 0x1800f2105
mov word [rcx + 0x5c], r11w
ret

Function at 0x1800f2140
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x1e
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f214d
xor edx, edx
mov word [rcx + 0x40], dx
ret

Function at 0x1800f2170
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x1e
jb 0x1800f217d
mov word [rcx + 0x40], r11w
ret

Function at 0x1800f21d0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x2f
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f21dd
xor edx, edx
mov word [rcx + 0x62], dx
ret

Function at 0x1800f2214
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x30
jb 0x1800f2221
mov word [rcx + 0x64], r11w
ret

Function at 0x1800f225c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x33
jb 0x1800f2269
mov word [rcx + 0x6a], r11w
ret

Function at 0x1800f22a4
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x26
jb 0x1800f22b1
mov word [rcx + 0x50], r11w
ret
Function at 0x1800f2350
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x25
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f235d
xor edx, edx
mov word [rcx + 0x4e], dx
ret

Function at 0x1800f23ac
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x25
jb 0x1800f23b9
mov word [rcx + 0x4e], r11w
ret

Function at 0x1800f2464
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x23
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f2471
xor edx, edx
mov word [rcx + 0x4a], dx
ret

Function at 0x1800f255c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 3
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f2569
xor edx, edx
mov word [rcx + 0xa], dx
ret

Function at 0x1800f25a8
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 6
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f25b5
xor edx, edx
mov word [rcx + 0x10], dx
ret
Function at 0x1800f2d40
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 7
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f2d4d
xor edx, edx
mov word [rcx + 0x12], dx
ret

Function at 0x1800f2d9c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 3
jb 0x1800f2da9
mov word [rcx + 0xa], r11w
ret
Function at 0x1800f6b94
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x65
jb 0x1800f6ba1
mov word [rcx + 0xce], r11w
ret

Function at 0x1800f6be0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x56
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f6bed
xor edx, edx
mov word [rcx + 0xb0], dx
ret

Function at 0x1800f6c24
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x4f
jb 0x1800f6c31
mov word [rcx + 0xa2], r11w
ret

Function at 0x1800f6c70
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x66
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f6c7d
xor edx, edx
mov word [rcx + 0xd0], dx
ret

Function at 0x1800f6cb4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x60
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f6cc1
xor edx, edx
mov word [rcx + 0xc4], dx
ret

Function at 0x1800f6d24
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x5e
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f6d31
xor edx, edx
mov word [rcx + 0xc0], dx
ret

Function at 0x1800f6da0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x54
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f6dad
xor edx, edx
mov word [rcx + 0xac], dx
ret

Function at 0x1800f6de4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x4b
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800f6df1
xor edx, edx
mov word [rcx + 0x9a], dx
ret
Function at 0x1800f9f18
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x11
jb 0x1800f9f1f
mov byte [rcx + 0x15], 0
ret
Function at 0x180102620
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x63
jb 0x18010262d
mov word [rcx + 0xca], r11w
ret

Function at 0x180102684
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x23
jb 0x180102691
mov word [rcx + 0x4a], r11w
ret

Function at 0x1801026cc
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x4d
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1801026d9
xor edx, edx
mov word [rcx + 0x9e], dx
ret

Function at 0x18010272c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x57
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x180102739
xor edx, edx
mov word [rcx + 0xb2], dx
ret

Function at 0x1801027c0
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x57
jb 0x1801027cd
mov word [rcx + 0xb2], r11w
ret

Function at 0x180102814
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x4a
jb 0x180102821
mov word [rcx + 0x98], r11w
ret

Function at 0x18010284c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x20
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x180102859
xor edx, edx
mov word [rcx + 0x44], dx
ret

Function at 0x18010291c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x1f
jb 0x180102929
mov word [rcx + 0x42], r11w
ret

Function at 0x180102980
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x52
jb 0x18010298d
mov word [rcx + 0xa8], r11w
ret

Function at 0x1801029d4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x3c
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1801029e1
xor edx, edx
mov word [rcx + 0x7c], dx
ret
Function at 0x180102a18
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x36
jb 0x180102a25
mov word [rcx + 0x70], r11w
ret

Function at 0x180102a60
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x3a
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x180102a6d
xor edx, edx
mov word [rcx + 0x78], dx
ret

Function at 0x180102a90
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x40
jb 0x180102a9d
mov word [rcx + 0x84], r11w
ret

Function at 0x180102ac8
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x3c
jb 0x180102ad5
mov word [rcx + 0x7c], r11w
ret
Function at 0x180103188
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x14
jb 0x18010318f
mov byte [rcx + 0x18], 0
ret

Function at 0x1801031f0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x59
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1801031fd
xor edx, edx
mov word [rcx + 0xb6], dx
ret

Function at 0x180103234
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x48
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x180103241
xor edx, edx
mov word [rcx + 0x94], dx
ret
Function at 0x1801039bc
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x45
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1801039c9
xor edx, edx
mov word [rcx + 0x8e], dx
ret
Function at 0x180104588
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xd
jb 0x18010458f
mov byte [rcx + 0x11], 0
ret
Function at 0x180107a6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c07e0]
mov rbx, rdx
test rax, rax
jne 0x180107b0f
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180107ac4
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c07e0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c07e0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180107b38
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180107b64
cmp dword [rbp - 0x10], 0x10000
je 0x180107b64
cmp qword [rbp - 0x18], 0x1000
jb 0x180107b64
cmp dword [rbp - 8], 0x1000000
je 0x180107b60
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180107b66
mov al, 1
jmp 0x180107b66
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180109a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0c78]
mov rbx, rdx
test rax, rax
jne 0x180109ad3
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180109a88
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0c78], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0c78]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180109afc
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180109b28
cmp dword [rbp - 0x10], 0x10000
je 0x180109b28
cmp qword [rbp - 0x18], 0x1000
jb 0x180109b28
cmp dword [rbp - 8], 0x1000000
je 0x180109b24
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180109b2a
mov al, 1
jmp 0x180109b2a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18010b9f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0780]
mov rbx, rdx
test rax, rax
jne 0x18010ba97
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18010ba4c
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0780], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0780]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18010bac0
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18010baec
cmp dword [rbp - 0x10], 0x10000
je 0x18010baec
cmp qword [rbp - 0x18], 0x1000
jb 0x18010baec
cmp dword [rbp - 8], 0x1000000
je 0x18010bae8
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18010baee
mov al, 1
jmp 0x18010baee
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18010c0d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0bd8]
mov rbx, rdx
test rax, rax
jne 0x18010c173
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18010c128
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0bd8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0bd8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18010c19c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18010c1c8
cmp dword [rbp - 0x10], 0x10000
je 0x18010c1c8
cmp qword [rbp - 0x18], 0x1000
jb 0x18010c1c8
cmp dword [rbp - 8], 0x1000000
je 0x18010c1c4
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18010c1ca
mov al, 1
jmp 0x18010c1ca
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18010e094
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0ca8]
mov rbx, rdx
test rax, rax
jne 0x18010e137
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18010e0ec
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0ca8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0ca8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18010e160
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18010e18c
cmp dword [rbp - 0x10], 0x10000
je 0x18010e18c
cmp qword [rbp - 0x18], 0x1000
jb 0x18010e18c
cmp dword [rbp - 8], 0x1000000
je 0x18010e188
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18010e18e
mov al, 1
jmp 0x18010e18e
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18010e770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0948]
mov rbx, rdx
test rax, rax
jne 0x18010e813
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18010e7c8
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0948], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0948]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18010e83c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18010e868
cmp dword [rbp - 0x10], 0x10000
je 0x18010e868
cmp qword [rbp - 0x18], 0x1000
jb 0x18010e868
cmp dword [rbp - 8], 0x1000000
je 0x18010e864
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18010e86a
mov al, 1
jmp 0x18010e86a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180110734
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c07b8]
mov rbx, rdx
test rax, rax
jne 0x1801107d7
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18011078c
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c07b8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c07b8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180110800
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18011082c
cmp dword [rbp - 0x10], 0x10000
je 0x18011082c
cmp qword [rbp - 0x18], 0x1000
jb 0x18011082c
cmp dword [rbp - 8], 0x1000000
je 0x180110828
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18011082e
mov al, 1
jmp 0x18011082e
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret