joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180009f84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov word [rbp - 0x11], 0x64
mov dword [rbp - 0x1a], 0x746e6572
mov word [rbp - 0x20], 0x6547
mov word [rbp - 0x1d], 0x7543
mov dword [rbp - 0x16], 0x65726854
mov byte [rbp - 0x1e], 0x74
mov byte [rbp - 0x1b], 0x72
mov byte [rbp - 0x12], 0x61
call fcn.180009c94
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009fdb
call rax
mov rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x180009fec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov edi, r8d
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
mov word [rbp - 0x17], 0x6946
mov dword [rbp - 0x1c], 0x6c75646f
mov dword [rbp - 0x20], 0x4d746547
mov word [rbp - 0x12], 0x6d61
mov byte [rbp - 0x18], 0x65
mov word [rbp - 0xf], 0x41
mov word [rbp - 0x14], 0x4e65
mov byte [rbp - 0x15], 0x6c
mov byte [rbp - 0x10], 0x65
call fcn.180009c94
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a068
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x18000a084
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rbx, rcx
mov dword [rbp - 0xb], 0x6d657473
mov word [rbp - 0xd], 0x7953
mov word [rbp - 0x10], 0x6547
mov word [rbp - 4], 0x6f
mov word [rbp - 7], 0x6e49
mov byte [rbp - 5], 0x66
mov byte [rbp - 0xe], 0x74
call fcn.180009c94
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a0d7
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x18000a0e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rbp - 0x1d], 0x65726854
mov dword [rbp - 0x13], 0x747865
mov word [rbp - 0x20], 0x6547
mov dword [rbp - 0x18], 0x6e6f4364
mov byte [rbp - 0x14], 0x74
mov byte [rbp - 0x1e], 0x74
mov byte [rbp - 0x19], 0x61
call fcn.180009c94
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a14b
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x18000a164
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
mov ebx, 0x7fffffff
mov word [rbp - 0x17], 0x7250
mov dword [rbp - 0x1e], 0x72685474
mov dword [rbp - 0x13], 0x79746972
mov word [rbp - 0x1a], 0x6165
mov word [rbp - 0x15], 0x6f69
mov byte [rbp - 0xf], 0
mov word [rbp - 0x20], 0x6547
mov byte [rbp - 0x18], 0x64
call fcn.180009c94
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a1ca
mov rcx, rdi
call rax
mov ebx, eax
mov rdi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x18000a1dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov rdi, r8
mov esi, edx
mov r14, rcx
mov dword [rbp - 0xe], 0x7972746e
mov word [rbp - 0x1d], 0x6854
mov byte [rbp - 0xa], bl
mov word [rbp - 0x12], 0x6f74
mov word [rbp - 0x15], 0x656c
mov word [rbp - 0x20], 0x6547
mov dword [rbp - 0x1a], 0x53646165
mov word [rbp - 0x10], 0x4572
mov byte [rbp - 0x1e], 0x74
mov byte [rbp - 0x1b], 0x72
mov byte [rbp - 0x13], 0x63
mov byte [rbp - 0x16], 0x65
call fcn.180009c94
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a263
mov r8, rdi
mov edx, esi
mov rcx, r14
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x18000a280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
mov dword [rbp - 0x10], 0x65536c61
mov dword [rbp - 0xa], 0x6e6f69
mov dword [rbp - 0x1a], 0x657a696c
mov dword [rbp - 0x1e], 0x61697469
mov word [rbp - 0xc], 0x7463
mov word [rbp - 0x15], 0x6972
mov word [rbp - 0x20], 0x6e49
mov word [rbp - 0x12], 0x6369
mov byte [rbp - 0x16], 0x43
mov byte [rbp - 0x13], 0x74
call fcn.180009c94
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a2e8
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x18000a2f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
mov dword [rbp - 0xf], 0x6e6f69
mov word [rbp - 0x15], 0x6c61
mov word [rbp - 0x1a], 0x6972
mov word [rbp - 0x1d], 0x6576
mov word [rbp - 0x20], 0x654c
mov word [rbp - 0x18], 0x6974
mov byte [rbp - 0x1b], 0x43
mov dword [rbp - 0x13], 0x74636553
mov byte [rbp - 0x1e], 0x61
mov byte [rbp - 0x16], 0x63
call fcn.180009c94
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a358
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
lea rcx, [0x18006cc68]
jmp 0x18000a2f4
Function at 0x18000a364
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov edi, r8d
mov esi, edx
mov r14d, ecx
mov word [rbp - 0xb], 0x7268
mov word [rbp - 8], 0x6461
mov byte [rbp - 6], bl
mov dword [rbp - 0x10], 0x6e65704f
mov byte [rbp - 0xc], 0x54
mov byte [rbp - 9], 0x65
call fcn.180009c94
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a3cb
mov r8d, edi
mov edx, esi
mov ecx, r14d
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x18000a458
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov edi, r9d
mov esi, r8d
mov r14, rdx
mov r15, rcx
mov ebx, 1
call fcn.180009c5c
test rax, rax
je 0x18000a4df
lea rdx, [rbp - 0x10]
mov rcx, rax
mov dword [rbp - 6], 0x417845
mov word [rbp - 0x10], 0x6552
mov dword [rbp - 0xd], 0x6e65704f
mov word [rbp - 9], 0x654b
mov byte [rbp - 0xe], 0x67
mov byte [rbp - 7], 0x79
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x18000a4df
mov rax, qword [rbp + 0x40]
mov r9d, edi
mov r8d, esi
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x18000a4fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
mov ebx, 1
call fcn.180009c5c
test rax, rax
je 0x18000a596
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x14], 0x41784565
mov dword [rbp - 0x18], 0x756c6156
mov word [rbp - 0x1d], 0x7551
mov word [rbp - 0x20], 0x6552
mov word [rbp - 0x1b], 0x7265
mov byte [rbp - 0x19], 0x79
mov byte [rbp - 0x1e], 0x67
mov byte [rbp - 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x18000a596
mov rax, qword [rbp + 0x48]
mov r9, rdi
mov r8, rsi
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x40]
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18000a5b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
or ebx, 0xffffffff
mov word [rbp - 5], 0x64
mov dword [rbp - 0xe], 0x656d7573
mov dword [rbp - 0xa], 0x65726854
mov word [rbp - 0x10], 0x6552
mov byte [rbp - 6], 0x61
call fcn.180009c94
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a608
mov rcx, rdi
call rax
mov ebx, eax
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x18000a61c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov word [rbp - 4], 0x79
mov word [rbp - 0xf], 0x6c74
mov word [rbp - 0xa], 0x4d6f
mov word [rbp - 7], 0x6f6d
mov byte [rbp - 0x10], 0x52
mov byte [rbp - 5], 0x72
mov word [rbp - 0xc], 0x7265
mov byte [rbp - 0xd], 0x5a
mov byte [rbp - 8], 0x65
call fcn.180009c94
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a681
mov rdx, rbx
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret

Function at 0x18000a694
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov edi, edx
mov rsi, rcx
xor ebx, ebx
mov dword [rbp - 0x1b], 0x64616572
mov word [rbp - 0x13], 0x6972
mov word [rbp - 0x10], 0x79
mov word [rbp - 0x16], 0x6972
mov byte [rbp - 0x11], 0x74
mov byte [rbp - 0x17], 0x50
mov dword [rbp - 0x20], 0x54746553
mov byte [rbp - 0x14], 0x6f
mov byte [rbp - 0x1c], 0x68
call fcn.180009c94
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a702
mov edx, edi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x18000a7c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
or ebx, 0xffffffff
mov dword [rbp - 0xb], 0x6854646e
mov dword [rbp - 6], 0x646165
mov dword [rbp - 0x10], 0x70737553
mov byte [rbp - 0xc], 0x65
mov byte [rbp - 7], 0x72
call fcn.180009c94
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a81b
mov rcx, rdi
call rax
mov ebx, eax
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret
Function at 0x18000a830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rbp - 0xd], 0x33646165
mov word [rbp - 7], 0x7269
mov word [rbp - 4], 0x74
mov word [rbp - 9], 0x4632
mov word [rbp - 0xf], 0x7268
mov byte [rbp - 0x10], 0x54
mov byte [rbp - 5], 0x73
call fcn.180009c94
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a897
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x18000a8b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov word [rbp - 9], 0x4e32
mov word [rbp - 0xc], 0x6461
mov dword [rbp - 7], 0x747865
mov byte [rbp - 0xa], 0x33
mov word [rbp - 0xf], 0x7268
mov byte [rbp - 0xd], 0x65
mov byte [rbp - 0x10], 0x54
call fcn.180009c94
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a915
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x18000a92c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov edi, r9d
mov esi, r8d
mov r14, rdx
mov r15, rcx
xor ebx, ebx
mov word [rbp - 0x10], 0x6956
mov dword [rbp - 7], 0x636f6c
mov dword [rbp - 0xd], 0x6c617574
mov word [rbp - 9], 0x6c41
mov byte [rbp - 0xe], 0x72
call fcn.180009c94
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a99b
mov r9d, edi
mov r8d, esi
mov rdx, r14
mov rcx, r15
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret

Function at 0x18000aa40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov edi, r9d
mov rsi, r8
mov r14, rdx
mov r15, rcx
xor ebx, ebx
mov dword [rbp - 0x1e], 0x61757472
mov dword [rbp - 0x13], 0x784574
mov dword [rbp - 0x19], 0x746f7250
mov word [rbp - 0x20], 0x6956
mov word [rbp - 0x15], 0x6365
mov byte [rbp - 0x1a], 0x6c
call fcn.180009c94
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x18000aac2
mov rax, qword [rbp + 0x40]
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18000aae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
mov word [rbp - 5], 0x79
mov word [rbp - 8], 0x6575
mov word [rbp - 0xb], 0x6c61
mov dword [rbp - 0x10], 0x74726956
mov byte [rbp - 6], 0x72
mov byte [rbp - 9], 0x51
mov byte [rbp - 0xc], 0x75
call fcn.180009c94
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000ab50
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret

Function at 0x18000abc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
call fcn.180009d04
test rax, rax
je 0x18000ac0a
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x2b], 0x776f646e
mov dword [rsp + 0x25], 0x65766974
mov dword [rsp + 0x20], 0x41746553
mov word [rsp + 0x29], 0x6957
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x24], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rsp, 0x38
ret
add rsp, 0x38
ret

Function at 0x18000ac10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
call fcn.180009d04
test rax, rax
je 0x18000ac57
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x21], 0x69577465
mov dword [rsp + 0x28], 0x736f5077
mov word [rsp + 0x25], 0x646e
mov byte [rsp + 0x20], 0x53
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x27], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rsp, 0x38
ret
add rsp, 0x38
ret

Function at 0x18000acd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x148
cmp edx, 1
jne 0x18000ad9d
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call fcn.180009fec
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x26], 0x75732074
mov dword [rsp + 0x2c], 0x74726f
mov dword [rsp + 0x21], 0x6174736e
mov word [rsp + 0x2a], 0x7070
mov byte [rsp + 0x20], 0x69
mov byte [rsp + 0x25], 0x6e
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x18000add1
lea rdx, [sym.drvhlp.dll_k0yyk1]
lea rcx, [0x18006cba0]
call fcn.18000b2b4
test eax, eax
je 0x18000add1
lea rdx, [sym.drvhlp.dll_g8sh3u]
lea rcx, [0x18006cb98]
call fcn.18000b2b4
test eax, eax
je 0x18000add1
lea rdx, [sym.drvhlp.dll_vhywni]
lea rcx, [0x18006cc20]
call fcn.18000b2b4
test eax, eax
je 0x18000add1
lea rdx, [sym.drvhlp.dll_cv8sup]
lea rcx, [0x18006cbd8]
call fcn.18000b2b4
mov eax, 1
add rsp, 0x148
ret
test edx, edx
jne 0x18000add1
lea rcx, [0x18006cba0]
call fcn.1800316f0
lea rcx, [0x18006cb98]
call fcn.1800316f0
lea rcx, [0x18006cc20]
call fcn.1800316f0
lea rcx, [0x18006cbd8]
call fcn.1800316f0
mov eax, 1
add rsp, 0x148
ret
Function at 0x18000bb60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x180
mov rdi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x71]
xor edx, edx
mov r8d, 0x103
mov dword [rsp + 0x40], ebx
mov byte [rsp + 0x70], bl
call fcn.18000ced0
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x37], 0x73255c45
mov dword [rsp + 0x32], 0x41575446
mov word [rsp + 0x30], 0x4f53
mov byte [rsp + 0x3b], bl
mov byte [rsp + 0x36], 0x52
call fcn.18000c410
cmp qword [rax + 0x18], 0x10
jb 0x18000bbc0
mov rax, qword [rax]
lea r9, [rsp + 0x30]
lea rcx, [rsp + 0x70]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.18000e014
cmp qword [rsp + 0x60], 0x10
jb 0x18000bbef
mov rcx, qword [rsp + 0x48]
call fcn.18000dd18
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], rbx
mov byte [rdi], bl
cmp byte [rsp + 0x70], bl
je 0x18000bc19
lea rax, [rsp + 0x70]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x18000bc10
lea rdx, [rsp + 0x70]
mov r8, rbx
mov rcx, rdi
call fcn.18000c8f0
mov rbx, qword [rsp + 0x190]
mov rax, rdi
add rsp, 0x180
pop rdi
ret

Function at 0x18000bc40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
call fcn.180009d04
test rax, rax
je 0x18000bc8c
lea rdx, [rsp + 0x20]
mov rcx, rax
mov word [rsp + 0x25], 0x6957
mov dword [rsp + 0x20], 0x6e697242
mov dword [rsp + 0x27], 0x776f646e
mov dword [rsp + 0x2d], 0x706f54
mov byte [rsp + 0x24], 0x67
mov word [rsp + 0x2b], 0x6f54
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rsp, 0x48
ret
add rsp, 0x48
ret
Function at 0x1800314e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
call fcn.180009d04
test rax, rax
je 0x18003153b
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x23], 0x65726f46
mov dword [rsp + 0x2f], 0x776f646e
mov dword [rsp + 0x2a], 0x57646e75
mov word [rsp + 0x20], 0x6553
mov word [rsp + 0x27], 0x7267
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x33], 0
mov byte [rsp + 0x2e], 0x69
mov byte [rsp + 0x29], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rsp, 0x48
ret
add rsp, 0x48
ret

Function at 0x1800316e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov r14d, edx
mov r15, rcx
xor ebx, ebx
call fcn.180009d04
test rax, rax
je 0x180009db7
lea rdx, [rbp - 0x10]
mov rcx, rax
mov word [rbp - 4], 0x7845
mov byte [rbp - 2], bl
mov dword [rbp - 9], 0x6f6f4874
mov dword [rbp - 0xd], 0x78654e6c
mov word [rbp - 0xf], 0x6c61
mov byte [rbp - 5], 0x6b
mov byte [rbp - 0x10], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009db7
mov r9, rdi
mov r8, rsi
mov edx, r14d
mov rcx, r15
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov r9, r8
mov r8, rdx
mov edx, ecx
xor ecx, ecx
jmp 0x180009d3c
Function at 0x140004360
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14024a7f8]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140004463
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x24]
call fcn.14018c1e0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400043f3
nop word [rax + rax]
mov rdx, qword [rdi]
lea rcx, [rsp + 0x4c]
call fcn.140193a88
mov rcx, rbx
test eax, eax
je 0x140004435
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400043d0
mov rdx, qword [rdi]
mov eax, 0xffffffff
sub rdx, 0x18
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004412
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140188d60
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi]
mov eax, 0xffffffff
mov ebx, dword [rsp + 0x28]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000445f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
jmp 0x140004414
mov r9d, 0x40
lea r8, [0x140217bd4]
lea rdx, [0x140217bd8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0xffffffff
call fcn.1401907f0
int3
Function at 0x140005540
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140005562
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400055dc
mov rdi, r14
mov rcx, rbx
call fcn.140006e00
test rax, rax
jle 0x1400055b4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14018bb40
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400055cc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400055d4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140005576
sub r14, rdi
jmp 0x1400056bf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400055f3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400055f5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140005627
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14018bb40
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400056bc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140005662
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000569d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14019703c
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1400056bc
cmp rbp, rax
ja 0x140005670
test rbp, rbp
je 0x1400056bc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14019703c
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret