joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180048ba6
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [rbx + rdx*8]
mov cl, byte [rax + rbp + 0x3c]
cmp cl, r9b
je 0x180048bcd
test r14d, r14d
je 0x180048bcd

Function at 0x180048bbc
Capabilities:
Read file on windows

Disassembly:
mov byte [r15], cl
lea edi, [r9 - 7]
jns 0x180048bb7
jns 0x180048bb7
mov rax, qword [r11 + rdx*8]
add r15, r8
dec r14d
mov byte [rax + rbp + 0x3c], r9b
mov ecx, r13d
call 0x180096a01
test eax, eax
je 0x180048c62
mov rax, qword [rsp + 0x40]
lea rcx, [0x1800b4c20]
mov rax, qword [rcx + rax*8]
test byte [rax + rbp + 0x38], 0x80
je 0x180048c62
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x180048c62
cmp byte [rsp + 0xa0], 2
jne 0x180048c67
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0xb8]
shr r14d, 1
mov rdx, r15
mov r8d, r14d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadConsoleW]
test eax, eax
jne 0x180048c56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call 0x180084fcc
or edi, 0xffffffff
mov rcx, rbx
call 0x18008b247
mov eax, edi
jmp 0x180090e33
mov eax, dword [rsp + 0xb8]
lea edi, [rdi + rax*2]
jmp 0x180048ca2
mov byte [rsp + 0x48], sil
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0xb8]
mov r8d, r14d
mov qword [rsp + 0x20], rsi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180048d89
cmp dword [rsp + 0xb8], r12d
ja 0x180048d89
add edi, dword [rsp + 0xb8]
mov rdx, qword [rsp + 0x40]
lea r11, [0x1800b4c20]
mov rax, qword [r11 + rdx*8]
test byte [rax + rbp + 0x38], 0x80
je 0x180048c47
cmp byte [rsp + 0xa0], 2
je 0x180048ceb
mov r9, qword [rsp + 0xa8]
mov rax, r12
shr rax, 1
mov rdx, r15
movsxd r8, edi
mov ecx, r13d
mov qword [rsp + 0x20], rax
call 0x180090774
mov edi, eax
jmp 0x180090d32
mov rax, qword [rsp + 0x48]
test al, al
je 0x180048d71
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
mov ecx, r13d
movsxd r8, edi
shr r8, 1
imul ebx, dword [rsi - 5], 0
invalid
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x180048daf
call 0x180085191
mov dword [rax], 9
call 0x18008517c
mov dword [rax], 5
jmp 0x180090df3
cmp eax, 0x6d
jne 0x180048c3d
mov edi, esi
jmp 0x180090e06

Function at 0x1800492c0
Capabilities:
Get geographical location

Disassembly:
adc eax, 0x2dab3
mov ecx, 0xd
call 0x1800915a3
mov rbx, rax
test rax, rax
je 0x1800492ef
mov rcx, rax
call qword [fcn.180033240]
mov r9d, edi
mov r8, rsi
mov edx, ebp
xor edx, edx
mov rcx, r14
call 0x180091d45
mov ecx, eax
mov r9d, edi
mov r8, rsi
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]

Function at 0x18004a101
Capabilities:
Write file on windows

Disassembly:
add byte [rax - 0x75], cl
add eax, 0x66f7f
xor rax, rsp
mov qword [rbp - 0x10], rax
movsxd rsi, edx
lea rax, [0x1800b4c20]
mov r15, rsi
mov r12d, r9d
sar r15, 6
and esi, 0x3f
shl rsi, 6
mov r14, r8
mov qword [rbp - 0x28], r8
mov rbx, rcx
add r12, r8
mov rax, qword [rax + r15*8]
mov rax, qword [rax + rsi + 0x28]
mov qword [rbp - 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
xor edx, edx
mov dword [rbp - 0x34], eax
invalid
invalid
Function at 0x18004a300
Capabilities:
Write file on windows

Disassembly:
adc al, 0
add al, ch
movabs al, byte [0x8b48e02b48000320]
add eax, 0x66d76
xor rax, rsp
mov qword [rsp + 0x1440], rax
mov rbx, rcx
movsxd r10, edx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x1800b4c20]
and r10d, 0x3f
add rbp, r8
and dword [rbx], 0
mov rsi, r8
and dword [rbx + 4], 0
mov rax, qword [rcx + rax*8]
and dword [rbx + 8], 0
shl r10, 6
mov r14, qword [rax + r10 + 0x28]
cmp r8, rbp
jae 0x18004a3ca
lea rdi, [rsp + 0x40]
cmp rsi, rbp
jae 0x18004a389
mov al, byte [rsi]
inc rsi
cmp al, 0xa
jne 0x18004a377
inc dword [rbx + 8]
mov byte [rdi], 0xd
inc rdi
mov byte [rdi], al
inc rdi
lea rax, [rsp + 0x143f]
cmp rdi, rax
jb 0x18004a360
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub edi, eax
lea r9, [rsp + 0x30]
mov r8d, edi
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18004a3c2
mov eax, dword [rsp + 0x30]
add dword [rbx + 4], eax
cmp eax, edi
jb 0x18004a3ca
cmp rsi, rbp
jb 0x18004a35b
jmp 0x18004a3ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov rax, rbx
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call 0x18007b58d
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x18004a5d5
Capabilities:
Write file on windows

Disassembly:
sub rax, rcx
mov dword [rsp + 0x28], 0xd55
lea rcx, [rsp + 0x700]
sar rax, 1
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov ecx, 0xfde9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test eax, eax
je 0x18004a64f
xor esi, esi
test eax, eax
je 0x18004a63f
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x700]
mov ecx, esi
lea r9, [rsp + 0x40]
mov r8d, ebp
add rdx, rcx
mov rcx, r12
sub r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18004a64f
add esi, dword [rsp + 0x40]
cmp esi, ebp
jb 0x18004a60c
mov eax, edi
sub eax, r15d
mov dword [rbx + 4], eax
cmp rdi, r14
jmp 0x180093fd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov rax, rbx
mov rcx, qword [rsp + 0x1460]
xor rcx, rsp
call 0x18007b81a
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x18004abb9
Capabilities:
Clear file content

Disassembly:
push qword [rcx + riz*8 + 0x48]
mov edi, ebx
sub rdi, rax
test rdi, rdi
jle 0x18004ac90
mov r15d, 0x1000
mov rdx, rbp
mov ecx, r15d
call 0x18008c860
mov rbx, rax
test rax, rax
jne 0x18004abf4
call 0x180086fe1
mov dword [rax], 0xc
jmp 0x180094c71
mov edx, 0x8000
mov ecx, esi
call 0x180094a88
mov ebp, eax
mov r8d, edi
cmp rdi, r15
mov rdx, rbx
mov ecx, esi
cmovge r8d, r15d
call 0x18009478a
cmp eax, 0xffffffff
je 0x18004ac68
cdqe
sub rdi, rax
test rdi, rdi
jg 0x18004ac02
mov edx, ebp
mov ecx, esi
call 0x180094ab6
mov rcx, rbx
call 0x18008d22e
call 0x180087045
cmp dword [rax], 5
jne 0x18004ac7d
call 0x18008706f
mov dword [rax], 0xd
call 0x18008707a
mov rcx, rbx
mov edi, dword [rax]
call 0x18008d284
mov eax, edi
jmp fcn.18004ac4f
jns 0x18004ac36
xor r8d, r8d
Function at 0x18004c18b
Capabilities:
Enumerate files on windows

Disassembly:
fimul word [rdx + 0x3af9800a]
jne 0x18004c1b1
lea rax, [rsi + 1]
cmp rdx, rax
je 0x18004c1b1
invalid

Function at 0x180050809
Capabilities:
Get geographical location

Disassembly:
mov dword [rdi], r15d
mov eax, 1
jmp 0x1800a0562
fmul dword [rbp + rcx*4 + 0x44]
and al, 0x20
mov ecx, ebx
sbb edx, edx
and edx, 0xfffff002
add edx, 0x1001
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1800507da
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
push rsp
and al, 0x20
call 0x180091062
test eax, eax
jne 0x180050845
or dword [rdi], 0x304
mov dword [rdi + 4], ebx
jmp 0x1800508b0
test byte [rdi], 2
jne 0x1800508b3
cmp dword [rsi + 0x14], r15d
je 0x180050885
movsxd r8, dword [rsi + 0x14]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsi]
call 0x180090e7d
test eax, eax
jne 0x180050885
or dword [rdi], 2
mov rax, r14
mov dword [rdi + 8], ebx
mov rcx, qword [rsi]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x180050871
cmp eax, dword [rsi + 0x14]
jne 0x1800508b3
mov dword [rdi + 4], ebx
jmp 0x1800508b3
mov ecx, dword [rdi]
test cl, 1
jne 0x1800508b3
mov r8d, r15d
lea rdx, [0x180080ac0]
cmp bx, word [rdx]
je 0x1800508b3
inc r8d
add rdx, 2
movsxd rax, r8d
cmp rax, 0xa
jb 0x180050896
or ecx, 1
mov dword [rdi], ecx
mov dword [rdi + 8], ebx
mov eax, dword [rdi]
mov ecx, 0x300
and eax, ecx
cmp eax, ecx
je 0x180050971
mov eax, dword [rsi + 0x18]
lea r8, [rsp + 0x20]
neg eax
mov r9d, 0x78
mov ecx, ebx
sbb edx, edx
and edx, 0xfffff002
add edx, 0x1001
adc byte [rax], al
add bh, bh
adc eax, 0x24b3e
test eax, eax
je 0x1800507da
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
call 0x18009112b
test eax, eax
jne 0x180050937
bts dword [rdi], 9
mov eax, dword [rdi]
cmp dword [rsi + 0x18], r15d
je 0x180050917
bts eax, 8
mov dword [rdi], eax
jmp 0x180050968
cmp dword [rsi + 0x14], r15d
je 0x18005090f
mov rcx, qword [rsi]
inc r14
cmp word [rcx + r14*2], r15w
jne 0x180050920
cmp r14d, dword [rsi + 0x14]
jne 0x18005090f
mov edx, 1
jmp 0x180050956
cmp dword [rsi + 0x18], r15d
Function at 0x18005082e
Capabilities:
Get geographical location

Disassembly:
mov dword [rdi], r15d
mov eax, 1
jmp 0x1800a0562
fmul dword [rbp + rcx*4 + 0x44]
and al, 0x20
mov ecx, ebx
sbb edx, edx
and edx, 0xfffff002
add edx, 0x1001
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1800507da
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
push rsp
and al, 0x20
call 0x180091062
test eax, eax
jne 0x180050845
or dword [rdi], 0x304
mov dword [rdi + 4], ebx
jmp 0x1800508b0
test byte [rdi], 2
jne 0x1800508b3
cmp dword [rsi + 0x14], r15d
je 0x180050885
movsxd r8, dword [rsi + 0x14]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsi]
call 0x180090e7d
test eax, eax
jne 0x180050885
or dword [rdi], 2
mov rax, r14
mov dword [rdi + 8], ebx
mov rcx, qword [rsi]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x180050871
cmp eax, dword [rsi + 0x14]
jne 0x1800508b3
mov dword [rdi + 4], ebx
jmp 0x1800508b3
mov ecx, dword [rdi]
test cl, 1
jne 0x1800508b3
mov r8d, r15d
lea rdx, [0x180080ac0]
cmp bx, word [rdx]
je 0x1800508b3
inc r8d
add rdx, 2
movsxd rax, r8d
cmp rax, 0xa
jb 0x180050896
or ecx, 1
mov dword [rdi], ecx
mov dword [rdi + 8], ebx
mov eax, dword [rdi]
mov ecx, 0x300
and eax, ecx
cmp eax, ecx
je 0x180050971
mov eax, dword [rsi + 0x18]
lea r8, [rsp + 0x20]
neg eax
mov r9d, 0x78
mov ecx, ebx
sbb edx, edx
and edx, 0xfffff002
add edx, 0x1001
adc byte [rax], al
add bh, bh
adc eax, 0x24b3e
test eax, eax
je 0x1800507da
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
call 0x18009112b
test eax, eax
jne 0x180050937
bts dword [rdi], 9
mov eax, dword [rdi]
cmp dword [rsi + 0x18], r15d
je 0x180050917
bts eax, 8
mov dword [rdi], eax
jmp 0x180050968
cmp dword [rsi + 0x14], r15d
je 0x18005090f
mov rcx, qword [rsi]
inc r14
cmp word [rcx + r14*2], r15w
jne 0x180050920
cmp r14d, dword [rsi + 0x14]
jne 0x18005090f
mov edx, 1
jmp 0x180050956
cmp dword [rsi + 0x18], r15d

Function at 0x180050b3d
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x180050b5f
cmp word [rcx], si
je 0x180050b5f
lea rdx, [0x180080ab0]
call 0x180091311
test eax, eax
je 0x180050b5f
lea rdx, [0x180080ab8]
mov rcx, rbx
call 0x180091324
test eax, eax
jne 0x180050b55
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
and al, 0x30
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x180050b7c
mov eax, dword [rsp + 0x30]
jmp 0x180050b8e
mov rcx, rbx
call 0x180090319
jmp 0x180050b8e
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
mov r9d, 2
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x180050b80
xor eax, eax
jmp 0x180050b8e
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x180050b8e
call qword [sym.imp.KERNEL32.dll_GetACP]

Function at 0x180050ba7
Capabilities:
Get geographical location

Disassembly:
je 0x180050bcd
sbb byte [rdi + 0x48], dl
sub esp, 0x20
jmp 0x1800bc5ae
Function at 0x180050d66
Capabilities:
Get geographical location

Disassembly:
cwde
add byte [rax], al
add byte [rax - 0x7b], cl
sal byte [rcx + rdi*2 + 0x66], 0x44
cmp dword [rax], esp
je 0x180050de8
mov rax, qword [rbx]
test rax, rax
je 0x180050d8e
cmp word [rax], r12w
je 0x180050d8e
lea rcx, [rbp - 0x20]
call 0x1800a0784
jmp 0x180050d97
lea rcx, [rbp - 0x20]
call 0x1800a085f
cmp dword [rbp - 0x20], r12d
jne 0x180050e5e
mov edx, dword [0x18007ff20]
lea r8, [rsi + 0x98]
dec edx
lea rcx, str.american
call str.mi_nz
test al, al
je 0x180050e54
mov rax, qword [rbx]
test rax, rax
je 0x180050ddd
invalid
cmp word [rax], r12w
je 0x180050ddd
lea rcx, [rbp - 0x20]
call 0x1800a07d3
jmp 0x180050e54
lea rcx, [rbp - 0x20]
call 0x1800a08ae
jmp 0x180050e54
mov rax, qword [rbx]
test rax, rax
je 0x180050e41
cmp word [rax], r12w
je 0x180050e41
call 0x180094d83
mov rdx, rax
ror byte [rax - 0x7d], 1
leave
dec dword [rax - 0x75]
invalid
invalid
add byte [rax], al
invalid
mov dword [rbp - 0x20], 0x104

Function at 0x180050dfd
Capabilities:
Get geographical location

Disassembly:
ror byte [rax - 0x7d], 1
leave
dec dword [rax - 0x75]
and byte [rax + 0x48000000], 0xff
shl dword [rsi + 0x44], 0x39
and al, 0x48
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x180050e09
cmp rcx, 3
mov eax, r12d
lea rcx, [0x18005050c]
lea ecx, [0x18005050c]
sete al
mov dword [rdx + 0xb4], eax
mov ah, 0
add byte [rax], al
mov edx, 1
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
test byte [rbp - 0x20], 4
jne 0x180050e54
mov dword [rbp - 0x20], r12d
jmp 0x180050e54
invalid

Function at 0x180050e40
Capabilities:
Get geographical location

Disassembly:
adc eax, edi
loopne 0x180050e49
add dword [rax], eax
add bh, bh
adc eax, 0x2450a

Function at 0x180050e46
Capabilities:
Get geographical location

Disassembly:
add byte [rax], al
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [rbp - 0x18], eax
mov dword [rbp - 0x1c], eax
cmp dword [rbp - 0x20], r12d
je 0x180050f48
lea rax, [r14 + 0x100]
neg r14
fimul word [rax - 0x73]
push rbp
loopne 0x180050eb5
sbb ecx, ecx
and rcx, rax

Function at 0x180050e67
Capabilities:
Get geographical location

Disassembly:
add byte [rax], al
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [rbp - 0x18], eax
mov dword [rbp - 0x1c], eax
cmp dword [rbp - 0x20], r12d
je 0x180050f48
lea rax, [r14 + 0x100]
neg r14
fimul word [rax - 0x73]
push rbp
loopne 0x180050eb5
sbb ecx, ecx
and rcx, rax

Function at 0x180050e8f
Capabilities:
Get geographical location

Disassembly:
call 0x1800a0d67
mov ebx, eax
test eax, eax
je 0x180050f48
lea ecx, [rax - 0xfde8]
cmp ecx, 1
jbe 0x180050f48
invalid
movzx ecx, ax

Function at 0x180050e91
Capabilities:
Get geographical location

Disassembly:
call 0x1800a0d67
mov ebx, eax
test eax, eax
je 0x180050f48
lea ecx, [rax - 0xfde8]
cmp ecx, 1
jbe 0x180050f48
invalid
movzx ecx, ax
Function at 0x1800564dd
Capabilities:
Query or enumerate registry value

Disassembly:
and byte [rcx - 0x47], al
sbb dword [rax], eax
add al, byte [rax]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180056533
mov dword [rsp + 0x44], 4
mov rcx, qword [rsp + 0x70]
call fcn.18005c09b
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x68]
call fcn.18005c430
mov rcx, qword [rsp + 0x70]
call fcn.18005c43a
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call 0x18008771b
add rsp, 0x58
ret

Function at 0x1800565ae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
imul rax, rax, 0x35
mov byte [rsp + rax + 0x170], 0x74
mov eax, 1
imul rax, rax, 0x27
mov byte [rsp + rax + 0x170], 0x6f
add byte [rax], al
outsd dx, dword [rsi]
mov eax, 1
imul rax, rax, 0x20
mov byte [rsp + rax + 0x170], 0x6e
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x170], 0x6e
add dword [rax], eax
add byte [rsi - 0x48], ch
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x22
mov byte [rsp + rax + 0x170], 0x56
add byte [rsi - 0x48], dl
add dword [rax], eax
add byte [rax], al

Function at 0x1800565e9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
imul rax, rax, 0x35
mov byte [rsp + rax + 0x170], 0x74
mov eax, 1
imul rax, rax, 0x27
mov byte [rsp + rax + 0x170], 0x6f
add byte [rax], al
outsd dx, dword [rsi]
mov eax, 1
imul rax, rax, 0x20
mov byte [rsp + rax + 0x170], 0x6e
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x170], 0x6e
add dword [rax], eax
add byte [rsi - 0x48], ch
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x22
mov byte [rsp + rax + 0x170], 0x56
add byte [rsi - 0x48], dl
add dword [rax], eax
add byte [rax], al
Function at 0x180056703
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add dword [rax], eax
add byte [rdi - 0x48], dh
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x23
mov byte [rsp + rax + 0x170], 0x65
add al, 0x70
add dword [rax], eax
add byte [rbp - 0x48], ah
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x11
mov byte [rsp + rax + 0x170], 0x74
mov eax, 1
imul rax, rax, 0x33
mov byte [rsp + rax + 0x170], 0x53
mov eax, 1
imul rax, rax, 0x36
mov byte [rsp + rax + 0x170], 0x74
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x170], 0x61
mov eax, 1
imul rax, rax, 0x1e
imul eax, eax, 0x1e
mov byte [rsp + rax + 0x170], 0x72
mov eax, 1
imul rax, rax, 0x2c
mov byte [rsp + rax + 0x170], 0x74
mov eax, 1
imul rax, rax, 0x19
mov byte [rsp + rax + 0x170], 0x73
mov eax, 1
imul rax, rax, 8
or dh, al
test byte [rax + rsi*2], al
add dword [rax], eax
add byte [rax + rdi*4 + 1], bl
add byte [rax], al
add byte [rax + 0x6b], cl
sal byte [rcx], 0xc6
test byte [rax + rsi*2], al
add dword [rax], eax
add byte [rax + rdi*4 + 1], dh
add byte [rax], al
add byte [rax + 0x6b], cl
rcr byte [rdi], 0xc6
test byte [rax + rsi*2], al
add dword [rax], eax
add byte [rbp - 0x48], ah
add dword [rax], eax
add byte [rax], al

Function at 0x180056743
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [rax], al
add byte [rax + 0x6b], cl
sal byte [rcx], 0xc6
test byte [rax + rsi*2], al
add dword [rax], eax
add byte [rax + rdi*4 + 1], dh
add byte [rax], al
add byte [rax + 0x6b], cl
rcr byte [rdi], 0xc6
test byte [rax + rsi*2], al
add dword [rax], eax
add byte [rbp - 0x48], ah
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x12
mov byte [rsp + rax + 0x170], 0x5c
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x170], 0x57
mov eax, 1

Function at 0x18005678a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
imul rax, rax, 0xe
mov byte [rsp + rax + 0x170], 0x73
mov eax, 1
imul rax, rax, 0x3a
mov byte [rsp + rax + 0x170], 0x73
mov eax, 1
imul rax, rax, 0x24
mov byte [rsp + rax + 0x170], 0x72
mov eax, 1
imul rax, rax, 0x26
mov byte [rsp + rax + 0x170], 0x69
mov eax, 1
imul rax, rax, 0x2a
mov byte [rsp + rax + 0x170], 0x49
mov eax, 1
imul rax, rax, 0x2d
mov byte [rsp + rax + 0x170], 0x65
mov eax, 1
imul rax, rax, 0x34
mov byte [rsp + rax + 0x170], 0x65
add byte [rax], al
mov eax, 1
add byte [rax], al
invalid
imul rax, rax, 0x37
mov byte [rsp + rax + 0x170], 0x69
mov eax, 1
imul rax, rax, 0x16
mov byte [rsp + rax + 0x170], 0x64
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x170], 0x6f
mov eax, 1
imul rax, rax, 0x17
mov byte [rsp + rax + 0x170], 0x6f
mov eax, 1

Function at 0x1800567fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [rax], al
add byte [rax + 0x6b], cl
sal byte [rdi], 0xc6
test byte [rax + rsi*2], al
add dword [rax], eax
add byte [rcx - 0x48], ch
add dword [rax], eax
add byte [rax], al
Function at 0x180056845
Capabilities:
Contain obfuscated stackstrings

Disassembly:
imul rax, rax, 0x32
mov byte [rsp + rax + 0x170], 0x20
mov eax, 1
imul rax, rax, 0x1d
mov byte [rsp + rax + 0x170], 0x72
mov eax, 1
imul rax, rax, 0x21
mov byte [rsp + rax + 0x170], 0x74
mov eax, 1
imul rax, rax, 0x2f
mov byte [rsp + rax + 0x170], 0x6e
mov eax, 1
imul rax, rax, 0x25
mov byte [rsp + rax + 0x170], 0x73
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x170], 0x6f
mov eax, 1
imul rax, rax, 0x38
mov byte [rsp + rax + 0x170], 0x6e
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x170], 0x6f
mov eax, 1
imul rax, rax, 0x28
mov byte [rsp + rax + 0x170], 0x6e
mov eax, 1
imul rax, rax, 0x1c
mov byte [rsp + rax + 0x170], 0x75
test byte [rax + rsi*2], al
add dword [rax], eax
add byte [rbp - 0x48], dh
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x10
mov byte [rsp + rax + 0x170], 0x66
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x170], 0x4d
mov eax, 1
imul rax, rax, 0xa
imul eax, eax, 0xa
mov byte [rsp + rax + 0x170], 0x69
mov eax, 1
imul rax, rax, 0x2b
mov byte [rsp + rax + 0x170], 0x6e
add dword [rax], eax
add byte [rsi - 0x48], ch
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x14
mov byte [rsp + rax + 0x170], 0x69
mov eax, 1
imul rax, rax, 0x3b
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0x3c
jae 0x180056957
jmp 0x18005695c
call 0x1800883b8
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x170], 0
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x170], 0x72
test byte [rax + rsi*2], al
add dword [rax], eax
add byte [rdx - 0x48], dh
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0xb
mov byte [rsp + rax + 0x170], 0x63
mov eax, 1
imul rax, rax, 0x1a
mov byte [rsp + rax + 0x170], 0x5c
mov eax, 1
imul rax, rax, 0x30
mov byte [rsp + rax + 0x170], 0x65
add dword [rax], eax
add byte [rbp - 0x48], ah
add dword [rax], eax
add byte [rax], al
invalid
imul rax, rax, 7
mov byte [rsp + rax + 0x170], 0x65
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x150], 0x6f
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x150], 0x50
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x150], 0x6e

Function at 0x1800569f1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x150], 0x6c
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x150], 0x79
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x150], 0x65
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x150], 0x78
mov eax, 1
Function at 0x18005779c
Capabilities:
Check http status code
Contain obfuscated stackstrings

Disassembly:
mov eax, 1
imul rax, rax, 0x23
mov byte [rsp + rax + 0x1b0], 0x6d
mov eax, 1
imul rax, rax, 0x28
mov byte [rsp + rax + 0x1b0], 0x65
mov eax, 1
imul rax, rax, 0x2a
mov byte [rsp + rax + 0x1b0], 0x63
add byte [rbx - 0x48], ah
add dword [rax], eax
add byte [rax], al
imul rax, rax, 9
mov byte [rsp + rax + 0x1b0], 0x79
mov eax, 1
imul rax, rax, 0x18
mov byte [rsp + rax + 0x1b0], 0x6e
mov eax, 1
imul rax, rax, 0x20
imul eax, eax, 0x20
mov byte [rsp + rax + 0x1b0], 0x66
mov eax, 1
imul rax, rax, 0x1d
mov byte [rsp + rax + 0x1b0], 0x77
mov eax, 1
imul rax, rax, 0x1f
mov byte [rsp + rax + 0x1b0], 0x2d
mov eax, 1
imul rax, rax, 0x29

Function at 0x1800577cd
Capabilities:
Check http status code
Contain obfuscated stackstrings

Disassembly:
mov eax, 1
imul rax, rax, 0x23
mov byte [rsp + rax + 0x1b0], 0x6d
mov eax, 1
imul rax, rax, 0x28
mov byte [rsp + rax + 0x1b0], 0x65
mov eax, 1
imul rax, rax, 0x2a
mov byte [rsp + rax + 0x1b0], 0x63
add byte [rbx - 0x48], ah
add dword [rax], eax
add byte [rax], al
imul rax, rax, 9
mov byte [rsp + rax + 0x1b0], 0x79
mov eax, 1
imul rax, rax, 0x18
mov byte [rsp + rax + 0x1b0], 0x6e
mov eax, 1
imul rax, rax, 0x20
imul eax, eax, 0x20
mov byte [rsp + rax + 0x1b0], 0x66
mov eax, 1
imul rax, rax, 0x1d
mov byte [rsp + rax + 0x1b0], 0x77
mov eax, 1
imul rax, rax, 0x1f
mov byte [rsp + rax + 0x1b0], 0x2d
mov eax, 1
imul rax, rax, 0x29