joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400108d0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x48
cmp dword [0x140118d40], 1
je 0x14001097b
lea r13, [0x1400e8150]
lea rbx, [0x140118d40]
mov rcx, r13
call sym.pthread_spin_lock
mov r12, qword [0x140118cf0]
test r12, r12
jne 0x140010921
jmp 0x140010b15
mov rax, qword [r12 + 0x18]
test rax, rax
je 0x140010ae0
mov r12, rax
cmp qword [r12], rbx
jne 0x140010910
add dword [r12 + 0x10], 1
lea r14, [r12 + 8]
mov rcx, r13
call sym.pthread_spin_unlock
mov rcx, r14
call sym.pthread_mutex_lock
mov ebx, dword [0x140118d40]
test ebx, ebx
jne 0x1400109a0
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400e8168], eax
cmp eax, 0xffffffff
je sym.__pthread_self_lite.cold
mov dword [0x140118d40], 1
mov rcx, r14
call sym.pthread_mutex_unlock
mov rcx, r12
call sym.leaveOnceObject.part.0
mov ecx, dword [0x1400e8168]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x1400109d0
mov rax, r12
add rsp, 0x48
pop rbx
pop r12
pop r13
pop r14
ret
cmp ebx, 1
je 0x14001096b
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r9d, ebx
lea r8, [0x140118d40]
lea rdx, [0x1400ee052]
mov rcx, rax
call sym.fprintf
jmp 0x14001096b
call sym.pop_pthread_mem
cmp qword [sym.__dyn_tls_pthread], 0
mov rbx, rax
je 0x14001098f
test rax, rax
je 0x14001098f
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call sym.pthread_spin_destroy
cmp eax, 1
je 0x140010b3a
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call r14
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call r14
lea r9, [rbx + 0x28]
mov r8, r13
mov rdx, r12
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je sym.__pthread_self_lite.cold
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, dword [0x1400e8168]
mov rdx, rbx
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je sym.__pthread_self_lite.cold
mov r12, rbx
mov rax, r12
add rsp, 0x48
pop rbx
pop r12
pop r13
pop r14
ret
mov edx, 0x20
mov ecx, 1
call sym.calloc
mov qword [rax], rbx
mov dword [rax + 0x10], 1
mov qword [r12 + 0x18], rax
mov r12, rax
lea r14, [r12 + 8]
xor edx, edx
mov rcx, r14
call sym.pthread_mutex_init
jmp 0x140010932
mov edx, 0x20
mov ecx, 1
call sym.calloc
mov qword [rax], rbx
mov r12, rax
mov dword [rax + 0x10], 1
mov qword [0x140118cf0], rax
jmp 0x140010b01
call sym.replace_spin_keys.part.0
nop
Function at 0x140010fd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
sub rsp, 0x20
test edx, edx
jne 0x140011000
test r8, r8
je 0x1400110b8
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
cmp edx, 1
je 0x1400110e0
cmp edx, 3
jne 0x140010fe7
mov ecx, dword [0x1400e8168]
cmp ecx, 0xffffffff
je 0x140010fe7
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x140010fe7
test byte [rax + 0x40], 0x30
je 0x140011110
mov rcx, qword [rax + 0x1d8]
test rcx, rcx
je 0x140011042
call sym._pthread_cleanup_dest.part.0
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x14001106d
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r13
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140011063
call r13
pxor xmm0, xmm0
movups xmmword [r12 + 0x28], xmm0
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x1400111a4
cmp qword [r12 + 0x1d0], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
je 0x140011210
mov ecx, dword [0x1400e8168]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x140010fe7
mov rcx, qword [0x140118d00]
test rcx, rcx
je 0x140010fe7
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov qword [0x140118d00], 0
jmp 0x140010fe7
lea rdx, [sym.SetThreadName_VEH]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [0x140118d00], rax
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
mov rcx, qword [rax + 0x30]
mov eax, dword [rax + 0xbc]
test eax, eax
jne 0x1400111b0
test rcx, rcx
je 0x14001112d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r12 + 0x1d8]
mov qword [r12 + 0x30], 0
mov dword [r12 + 0xbc], 1
test rcx, rcx
je 0x140011154
call sym._pthread_cleanup_dest.part.0
lea r14, [r12 + 0x38]
lea r13, [r12 + 0x68]
test byte [r12 + 0x44], 4
je 0x1400111f0
mov rcx, qword [r12 + 0x28]
mov dword [r12], 0xdeadbeef
test rcx, rcx
je 0x140011182
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x28], 0
mov rcx, r14
call sym.pthread_mutex_destroy
mov rcx, r13
call sym.pthread_spin_destroy
cmp eax, 1
jne 0x14001108a
call sym.replace_spin_keys.part.0
nop dword [rax]
test rcx, rcx
je 0x1400111bb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x30], 0
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x1400111a4
mov qword [r12 + 0x68], 0xffffffffffffffff
jmp 0x140010fe7
mov rcx, r14
call sym.pthread_mutex_destroy
mov rcx, r13
call sym.pthread_spin_destroy
cmp eax, 1
jne 0x1400111dd
jmp 0x1400111a4
mov rcx, r12
call sym.push_pthread_mem.part.0
jmp 0x1400110a2

Function at 0x140011cb0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400e8168], eax
cmp eax, 0xffffffff
je sym.pthread_tls_init.cold
add rsp, 0x28
ret
Function at 0x140012520
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
lea r13, [0x1400e8158]
mov r12, rcx
mov rcx, r13
mov ebx, edx
call sym.pthread_mutex_lock
mov rax, qword [0x140118d18]
test rax, rax
je 0x1400125a0
mov r9, qword [0x140118d20]
lea r8, [rax - 1]
xor ecx, ecx
cmp rax, 1
jne 0x140012576
jmp 0x140012620
cmp rax, rcx
je 0x1400125a0
lea r8, [rax - 1]
cmp r8, rcx
jb 0x1400125a0
lea rax, [rcx + r8]
shr rax, 1
mov rdx, rax
shl rdx, 4
add rdx, r9
cmp r12, qword [rdx + 8]
je 0x1400125c0
jb 0x140012568
lea rcx, [rax + 1]
cmp r8, rcx
jae 0x140012576
nop dword [rax + rax]
mov rcx, r13
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
mov rax, qword [rdx]
test rax, rax
je 0x1400125a0
cmp qword [rax + 0x1d8], r12
jne 0x1400125a0
test byte [rax + 0x40], 0xc
jne 0x1400125a0
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x1400125a0
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x1400125a0
mov rcx, r13
call sym.pthread_mutex_unlock
test ebx, ebx
je 0x140012618
sub ebx, 2
cmp ebx, 0x15
ja 0x14001262f
mov rcx, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp sym.pthread_cancel
xor eax, eax
jmp 0x1400125ad
cmp r12, qword [r9 + 8]
jne 0x1400125a0
mov rax, qword [r9]
jmp 0x1400125c3
mov eax, 0x16
jmp 0x1400125ad
Function at 0x1400128e0
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call sym.pop_pthread_mem
mov r12, rax
test rax, rax
je 0x140012b41
test rdi, rdi
je 0x14001291a
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x140012987
add ebx, 1
cmp ebx, 1
je 0x140012a90
mov ecx, 0x14
call r14
cmp ebx, 5
jne 0x140012955
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
je 0x140012b8a
cmp qword [r12 + 0x30], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x140012b2a
xor edx, edx
test rsi, rsi
je 0x1400129ff
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x140012b58
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [sym.pthread_create_wrapper]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140012af0
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x140012ac0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x140012aa0
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ecx, ecx
call r13
jmp 0x140012955
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140012a6f
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x140012a45
mov edx, 2
cmp eax, edx
cmovle edx, eax
cmp eax, 0xf
mov eax, 0xf
cmovge edx, eax
jmp 0x140012a45
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140012b00
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
je 0x140012b8a
mov qword [r12 + 0x68], 0xffffffffffffffff
pxor xmm0, xmm0
movups xmmword [r12 + 0x28], xmm0
test rdi, rdi
je 0x140012b36
mov qword [rdi], 0
cmp qword [r12 + 0x1d0], 0
je 0x140012b80
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call sym.__pthread_self_lite
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x1400129ff
mov rcx, r12
call sym.push_pthread_mem.part.0
jmp 0x140012b41
call sym.replace_spin_keys.part.0
nop
Function at 0x1400164f0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x14001651c
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x140094ac0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x140094ae7
call rbp
cmp dword [rax], 4
jne 0x140094b04
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x140094ae0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400acd50
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400acd78
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400acdc0
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400acd90
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1400acdcc
call rbp
cmp dword [rax], 4
je 0x1400acd90
lea rcx, [0x1400ec428]
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400ad1e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400ad208
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400ad250
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400ad220
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1400ad25c
call rbp
cmp dword [rax], 4
je 0x1400ad220
lea rcx, [0x1400ec428]
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400e74a0
Capabilities:
Allocate or change rwx memory
Create process on windows
Delete file
Execute shellcode via indirect call
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
sub rsp, 0x28
call dbg.__main
mov rax, qword [0x1400eee00]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x1400eedf0]
mov r8, qword [rax]
mov rax, qword [0x1400eede0]
mov rcx, qword [rax]
add rsp, 0x28
jmp sym.WinMain
Function at 0x18001e424
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov word [rbp - 0x16], 0x4179
mov byte [rbp - 0x14], bl
mov rdi, rcx
mov dword [rbp - 0x1b], 0x61726269
mov dword [rbp - 0x20], 0x64616f4c
mov byte [rbp - 0x17], 0x72
mov byte [rbp - 0x1c], 0x4c
call fcn.18001f520
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001e487
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180001600
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x18001e4ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp - 8], rax
mov word [rbp - 0x14], 0x536c
mov dword [rbp - 0x19], 0x63697469
mov dword [rbp - 0x11], 0x6f697463
mov dword [rbp - 0x1e], 0x43726574
mov word [rbp - 0xd], 0x6e
mov byte [rbp - 0x12], 0x65
mov word [rbp - 0x20], 0x6e45
mov byte [rbp - 0x15], 0x61
mov byte [rbp - 0x1a], 0x72
call fcn.18001f520
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001e516
lea rcx, [0x18005cb38]
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180001600
add rsp, 0x40
pop rbp
ret
sub rsp, 0x28
cmp dword [0x18005c928], 0
jne 0x180021859
call fcn.18001ed84
mov edx, 0x200
lea rcx, [0x18005c930]
call fcn.18001e530
mov dword [0x18005c928], 1
add rsp, 0x28
jmp 0x18001e4ac

Function at 0x18001e530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov word [rbp - 0x14], 0x79
mov rbx, rcx
mov word [rbp - 0x1f], 0x6c74
mov word [rbp - 0x1a], 0x4d6f
mov word [rbp - 0x17], 0x6f6d
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0x15], 0x72
mov word [rbp - 0x1c], 0x7265
mov byte [rbp - 0x1d], 0x5a
mov byte [rbp - 0x18], 0x65
call fcn.18001f520
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001e5a3
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180001600
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x18001e624
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp - 8], rax
mov dword [rbp - 0xf], 0x6e6f69
mov word [rbp - 0x15], 0x6c61
mov word [rbp - 0x1a], 0x6972
mov word [rbp - 0x1d], 0x6576
mov word [rbp - 0x20], 0x654c
mov word [rbp - 0x18], 0x6974
mov byte [rbp - 0x1b], 0x43
mov dword [rbp - 0x13], 0x74636553
mov byte [rbp - 0x1e], 0x61
mov byte [rbp - 0x16], 0x63
call fcn.18001f520
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001e693
lea rcx, [0x18005cb38]
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180001600
add rsp, 0x40
pop rbp
ret

Function at 0x18001e6ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
mov word [rbp - 0x17], 0x7250
mov ebx, 0x7fffffff
mov dword [rbp - 0x1e], 0x72685474
mov dword [rbp - 0x13], 0x79746972
mov word [rbp - 0x1a], 0x6165
mov word [rbp - 0x15], 0x6f69
mov byte [rbp - 0xf], 0
mov word [rbp - 0x20], 0x6547
mov byte [rbp - 0x18], 0x64
call fcn.18001f520
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001e720
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180001600
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x18001e744
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov dword [rbp - 0x1b], 0x6854646e
or ebx, 0xffffffff
mov dword [rbp - 0x16], 0x646165
mov dword [rbp - 0x20], 0x70737553
mov byte [rbp - 0x1c], 0x65
mov byte [rbp - 0x17], 0x72
call fcn.18001f520
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001e7a5
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180001600
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x18001e7cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov word [rbp - 0x20], 0x6956
xor ebx, ebx
mov dword [rbp - 0x17], 0x636f6c
mov dword [rbp - 0x1d], 0x6c617574
mov word [rbp - 0x19], 0x6c41
mov byte [rbp - 0x1e], 0x72
call fcn.18001f520
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001e83b
lea edx, [rbx + 0x78]
mov r8d, 0x3000
lea r9d, [rbx + 0x20]
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180001600
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x18001e8f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov word [rbp - 0x15], 0x79
mov rdi, rcx
mov word [rbp - 0x18], 0x6575
xor ebx, ebx
mov word [rbp - 0x1b], 0x6c61
mov dword [rbp - 0x20], 0x74726956
mov byte [rbp - 0x16], 0x72
mov byte [rbp - 0x19], 0x51
mov byte [rbp - 0x1c], 0x75
call fcn.18001f520
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001e968
lea r8d, [rbx + 0x30]
mov rdx, rsi
mov rcx, rdi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180001600
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x18001ea1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp - 8], rax
mov esi, edx
mov dword [rbp - 0x1b], 0x64616572
mov rdi, rcx
mov word [rbp - 0x13], 0x6972
xor ebx, ebx
mov word [rbp - 0x10], 0x79
mov word [rbp - 0x16], 0x6972
mov byte [rbp - 0x11], 0x74
mov byte [rbp - 0x17], 0x50
mov dword [rbp - 0x20], 0x54746553
mov byte [rbp - 0x14], 0x6f
mov byte [rbp - 0x1c], 0x68
call fcn.18001f520
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001ea90
mov edx, esi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180001600
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x18001eab4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov dword [rbp - 0x1b], 0x6d657473
mov word [rbp - 0x1d], 0x7953
mov word [rbp - 0x20], 0x6547
mov word [rbp - 0x14], 0x6f
mov word [rbp - 0x17], 0x6e49
mov byte [rbp - 0x15], 0x66
mov byte [rbp - 0x1e], 0x74
call fcn.18001f520
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001eb15
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180001600
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x18001eb34
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180031010]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov word [rbp - 0x1b], 0x7268
mov byte [rbp - 0x16], bl
mov edi, r8d
mov word [rbp - 0x18], 0x6461
mov dword [rbp - 0x20], 0x6e65704f
mov byte [rbp - 0x1c], 0x54
mov byte [rbp - 0x19], 0x65
call fcn.18001f520
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001eb9d
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180001600
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret