joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], 0xd
mov byte [rsp + 0x30], 0x4a
mov byte [rsp + 0x31], 0x64
mov byte [rsp + 0x32], 0x71
mov byte [rsp + 0x33], 0x6d
mov byte [rsp + 0x34], 0x64
mov byte [rsp + 0x35], 0x6b
mov byte [rsp + 0x36], 0x32
mov byte [rsp + 0x37], 0x31
mov byte [rsp + 0x38], 0x2d
mov byte [rsp + 0x39], 0x63
mov byte [rsp + 0x3a], 0x6b
mov byte [rsp + 0x3b], 0x6b
mov byte [rsp + 0x3c], 0xff
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14007ccd8], eax
jle 0x140003215
lea rcx, [0x14007ccd8]
call fcn.1400074ac
cmp dword [0x14007ccd8], 0xffffffff
jne 0x140003215
lea rax, [0x14007ccc8]
mov byte [rax + 0xd], 1
mov qword [rsp + 0x20], 0
jmp 0x1400031cc
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xd
jae 0x1400031fd
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x14007ccc8]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x1400031bf
lea rcx, [0x140008ae0]
call fcn.140007a34
lea rcx, [0x14007ccd8]
call fcn.140007440
lea rax, [0x14007ccc8]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140007420
add rsp, 0x58
ret

Function at 0x140003230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], 0xd
mov byte [rsp + 0x30], 0x55
mov byte [rsp + 0x31], 0x68
mov byte [rsp + 0x32], 0x71
mov byte [rsp + 0x33], 0x73
mov byte [rsp + 0x34], 0x74
mov byte [rsp + 0x35], 0x60
mov byte [rsp + 0x36], 0x6b
mov byte [rsp + 0x37], 0x40
mov byte [rsp + 0x38], 0x6b
mov byte [rsp + 0x39], 0x6b
mov byte [rsp + 0x3a], 0x6e
mov byte [rsp + 0x3b], 0x62
mov byte [rsp + 0x3c], 0xff
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14007cd94], eax
jle 0x140003335
lea rcx, [0x14007cd94]
call fcn.1400074ac
cmp dword [0x14007cd94], 0xffffffff
jne 0x140003335
lea rax, [0x14007cd20]
mov byte [rax + 0xd], 1
mov qword [rsp + 0x20], 0
jmp 0x1400032ec
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xd
jae 0x14000331d
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x14007cd20]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x1400032df
lea rcx, [0x140008aa0]
call fcn.140007a34
lea rcx, [0x14007cd94]
call fcn.140007440
lea rax, [0x14007cd20]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140007420
add rsp, 0x58
ret
Function at 0x140003350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], 0xd
mov byte [rsp + 0x30], 0x50
mov byte [rsp + 0x31], 0x6a
mov byte [rsp + 0x32], 0x77
mov byte [rsp + 0x33], 0x73
mov byte [rsp + 0x34], 0x6a
mov byte [rsp + 0x35], 0x71
mov byte [rsp + 0x36], 0x38
mov byte [rsp + 0x37], 0x37
mov byte [rsp + 0x38], 0x33
mov byte [rsp + 0x39], 0x69
mov byte [rsp + 0x3a], 0x71
mov byte [rsp + 0x3b], 0x71
mov byte [rsp + 0x3c], 5
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14007cdb0], eax
jle 0x140003455
lea rcx, [0x14007cdb0]
call fcn.1400074ac
cmp dword [0x14007cdb0], 0xffffffff
jne 0x140003455
lea rax, [0x14007cdb8]
mov byte [rax + 0xd], 1
mov qword [rsp + 0x20], 0
jmp 0x14000340c
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xd
jae 0x14000343d
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x14007cdb8]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x1400033ff
lea rcx, [0x140008a60]
call fcn.140007a34
lea rcx, [0x14007cdb0]
call fcn.140007440
lea rax, [0x14007cdb8]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140007420
add rsp, 0x58
ret

Function at 0x140003470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], 0xd
mov byte [rsp + 0x30], 0x51
mov byte [rsp + 0x31], 0x74
mov byte [rsp + 0x32], 0x66
mov byte [rsp + 0x33], 0x69
mov byte [rsp + 0x34], 0x51
mov byte [rsp + 0x35], 0x6e
mov byte [rsp + 0x36], 0x67
mov byte [rsp + 0x37], 0x77
mov byte [rsp + 0x38], 0x66
mov byte [rsp + 0x39], 0x77
mov byte [rsp + 0x3a], 0x7e
mov byte [rsp + 0x3b], 0x46
mov byte [rsp + 0x3c], 5
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14007cd98], eax
jle 0x140003575
lea rcx, [0x14007cd98]
call fcn.1400074ac
cmp dword [0x14007cd98], 0xffffffff
jne 0x140003575
lea rax, [0x14007ccb8]
mov byte [rax + 0xd], 1
mov qword [rsp + 0x20], 0
jmp 0x14000352c
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xd
jae 0x14000355d
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x14007ccb8]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x14000351f
lea rcx, [0x140008a20]
call fcn.140007a34
lea rcx, [0x14007cd98]
call fcn.140007440
lea rax, [0x14007ccb8]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140007420
add rsp, 0x58
ret
Function at 0x1400037e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], 0xa
mov byte [rsp + 0x30], 0x73
mov byte [rsp + 0x31], 0x79
mov byte [rsp + 0x32], 0x69
mov byte [rsp + 0x33], 0x71
mov byte [rsp + 0x34], 0x71
mov byte [rsp + 0x35], 0x33
mov byte [rsp + 0x36], 0x69
mov byte [rsp + 0x37], 0x71
mov byte [rsp + 0x38], 0x71
mov byte [rsp + 0x39], 5
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14007ccb0], eax
jle 0x1400038d6
lea rcx, [0x14007ccb0]
call fcn.1400074ac
cmp dword [0x14007ccb0], 0xffffffff
jne 0x1400038d6
lea rax, [0x14007cce8]
mov byte [rax + 0xa], 1
mov qword [rsp + 0x20], 0
jmp 0x14000388d
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xa
jae 0x1400038be
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x14007cce8]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x140003880
lea rcx, [0x140008960]
call fcn.140007a34
lea rcx, [0x14007ccb0]
call fcn.140007440
lea rax, [0x14007cce8]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140007420
add rsp, 0x58
ret

Function at 0x1400038f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], 0x14
mov byte [rsp + 0x30], 0x57
mov byte [rsp + 0x31], 0x79
mov byte [rsp + 0x32], 0x71
mov byte [rsp + 0x33], 0x46
mov byte [rsp + 0x34], 0x69
mov byte [rsp + 0x35], 0x69
mov byte [rsp + 0x36], 0x4b
mov byte [rsp + 0x37], 0x7a
mov byte [rsp + 0x38], 0x73
mov byte [rsp + 0x39], 0x68
mov byte [rsp + 0x3a], 0x79
mov byte [rsp + 0x3b], 0x6e
mov byte [rsp + 0x3c], 0x74
mov byte [rsp + 0x3d], 0x73
mov byte [rsp + 0x3e], 0x59
mov byte [rsp + 0x3f], 0x66
mov byte [rsp + 0x40], 0x67
mov byte [rsp + 0x41], 0x71
mov byte [rsp + 0x42], 0x6a
mov byte [rsp + 0x43], 5
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14007ccdc], eax
jle 0x140003a18
lea rcx, [0x14007ccdc]
call fcn.1400074ac
cmp dword [0x14007ccdc], 0xffffffff
jne 0x140003a18
lea rax, [0x14007cc98]
mov byte [rax + 0x14], 1
mov qword [rsp + 0x20], 0
jmp 0x1400039cf
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x14
jae 0x140003a00
mov eax, 1
imul rax, rax, 0
lea rax, [rsp + rax + 0x30]
lea rcx, [0x14007cc98]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
movzx eax, byte [rax + r8]
mov byte [rcx + rdx], al
jmp 0x1400039c2
lea rcx, [0x140008920]
call fcn.140007a34
lea rcx, [0x14007ccdc]
call fcn.140007440
lea rax, [0x14007cc98]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140007420
add rsp, 0x58
ret
Function at 0x140003b20
Capabilities:
Execute command
Log keystrokes via polling

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, 0x68
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
jne 0x140003b4b
call fcn.140003a90
lea rdx, str.Enter_your_name:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f50
lea rcx, [rsp + 0x28]
call fcn.140004690
nop
lea rdx, [rsp + 0x28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400053d0
lea rdx, str.Welcome_to_my_program_mr
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004f50
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.140005760
lea rdx, [0x14000950c]
mov rcx, rax
call fcn.140004f50
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x28]
call fcn.1400048a0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140007420
add rsp, 0x58
ret
Function at 0x140008054
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000809e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000809e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000809e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000809e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000809e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400080a0
xor al, al
add rsp, 0x28
ret
Function at 0x180032770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x180271460]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [str.qrstuvwxyz:.___0123456789__]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x180271420]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1802713f0]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x1802713d0]
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rbp], 0x7e235f2d
mov dword [rbp + 4], 0x5b29285c
mov dword [rbp + 8], 0x247d7b5d
mov word [rbp + 0xc], 0x2260
mov byte [rbp + 0xe], 0x3b
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
xor r8d, r8d
lea rdx, [0x1802074d5]
call fcn.18003bfd0
mov dword [rsp + 0x20], 1
movdqa xmm0, xmmword [0x180270dc0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180270df0]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x180270de0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x180270e00]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x180270e10]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x180271340]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x1802710e0]
movdqa xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x4b
mov dword [rbp - 0x5c], 7
lea rsi, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, dword [rsi]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
test ecx, ecx
jne 0x18003291e
cmp rax, rdx
jae 0x1800328e0
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x1800328d8
mov rcx, qword [rbx]
mov word [rcx + rax], 0x20
jmp 0x1800328eb
mov r9b, 0x20
mov rcx, rbx
call fcn.18003bca0
inc edi
add rsi, 4
cmp edi, 0x1e
jb 0x1800328b0
mov rax, rbx
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movzx r9d, byte [rbp + rcx - 0x51]
cmp rax, rdx
jae 0x1800328e3
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18003293d
mov rcx, qword [rbx]
mov byte [rcx + rax], r9b
mov byte [rcx + rax + 1], 0
jmp 0x1800328eb
Function at 0x180032950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x180271460]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [str.qrstuvwxyz:.___0123456789__]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [0x180271420]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x1802713f0]
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmm0, xmmword [0x1802713d0]
movdqa xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], 0x7e235f2d
mov dword [rbp + 0x64], 0x5b29285c
mov dword [rbp + 0x68], 0x247d7b5d
mov word [rbp + 0x6c], 0x2260
mov byte [rbp + 0x6e], 0x3b
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
xor r8d, r8d
lea rdx, [0x1802074d5]
call fcn.18003bfd0
mov dword [rsp + 0x20], 1
movdqa xmm0, xmmword [0x180270ff0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180271210]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x180271170]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x180270f00]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x180270d40]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1802712a0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x180271230]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x180271310]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x180271330]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x180271290]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x180271120]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x180270e90]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x180271010]
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rbp], 8
mov dword [rbp + 4], 0x10
lea rsi, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movsxd rcx, dword [rsi]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
test ecx, ecx
jne 0x180032b4e
cmp rax, rdx
jae 0x180032b10
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x180032b08
mov rcx, qword [rbx]
mov word [rcx + rax], 0x20
jmp 0x180032b1b
mov r9b, 0x20
mov rcx, rbx
call fcn.18003bca0
inc edi
add rsi, 4
cmp edi, 0x36
jb 0x180032ae0
mov rax, rbx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movzx r9d, byte [rbp + rcx + 0xf]
cmp rax, rdx
jae 0x180032b13
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x180032b6d
mov rcx, qword [rbx]
mov byte [rcx + rax], r9b
mov byte [rcx + rax + 1], 0
jmp 0x180032b1b
Function at 0x180032e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x180271460]
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [str.qrstuvwxyz:.___0123456789__]
movdqa xmmword [rbp + 0x60], xmm1
movdqa xmm0, xmmword [0x180271420]
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmm1, xmmword [0x1802713f0]
movdqa xmmword [rbp + 0x80], xmm1
movdqa xmm0, xmmword [0x1802713d0]
movdqa xmmword [rbp + 0x90], xmm0
mov dword [rbp + 0xa0], 0x7e235f2d
mov dword [rbp + 0xa4], 0x5b29285c
mov dword [rbp + 0xa8], 0x247d7b5d
mov word [rbp + 0xac], 0x2260
mov byte [rbp + 0xae], 0x3b
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
xor r8d, r8d
lea rdx, [0x1802074d5]
call fcn.18003bfd0
mov dword [rsp + 0x20], 1
movdqa xmm0, xmmword [0x180270ff0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180271210]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x180271170]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x180270f00]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x180270d40]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1802712a0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x180271230]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x180271310]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x180271330]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x180271290]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x180270f60]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x180270d80]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x180270f40]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1802711f0]
movdqa xmmword [rbp], xmm1
movdqa xmm0, xmmword [0x180270f10]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x180271190]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [0x180270f90]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x180270fe0]
movdqa xmmword [rbp + 0x40], xmm1
lea rsi, [rsp + 0x30]
movsxd rcx, dword [rsi]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
test ecx, ecx
jne 0x180033041
cmp rax, rdx
jae 0x180033000
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x180032ff8
mov rcx, qword [rbx]
mov word [rcx + rax], 0x20
jmp 0x18003300b
mov r9b, 0x20
mov rcx, rbx
call fcn.18003bca0
inc edi
add rsi, 4
cmp edi, 0x48
jb 0x180032fd0
mov rax, rbx
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movzx r9d, byte [rbp + rcx + 0x4f]
cmp rax, rdx
jae 0x180033003
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x180033060
mov rcx, qword [rbx]
mov byte [rcx + rax], r9b
mov byte [rcx + rax + 1], 0
jmp 0x18003300b
Function at 0x18003c770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1802953c0]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x180271460]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [str.qrstuvwxyz:.___0123456789__]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm0, xmmword [0x180271420]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x1802713f0]
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmm0, xmmword [0x1802713d0]
movdqa xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], 0x7e235f2d
mov dword [rbp + 0x64], 0x5b29285c
mov dword [rbp + 0x68], 0x247d7b5d
mov word [rbp + 0x6c], 0x2260
mov byte [rbp + 0x6e], 0x3b
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
xor r8d, r8d
lea rdx, [0x1802074d5]
call fcn.18003bfd0
mov dword [rsp + 0x20], 1
movdqa xmm0, xmmword [0x180270ff0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180271210]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x180271170]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x180270f00]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x180270d40]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1802712a0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x180271230]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x180271310]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x180271330]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x180271290]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x180271130]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x180270d20]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x180270e30]
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rbp], 0x10
lea rsi, [rsp + 0x30]
nop dword [rax + rax]
movsxd rcx, dword [rsi]
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
test ecx, ecx
jne 0x18003c95e
cmp rax, rdx
jae 0x18003c920
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18003c918
mov rcx, qword [rbx]
mov word [rcx + rax], 0x20
jmp 0x18003c92b
mov r9b, 0x20
mov rcx, rbx
call fcn.18003bca0
inc edi
add rsi, 4
cmp edi, 0x35
jb 0x18003c8f0
mov rax, rbx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1801e6af0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movzx r9d, byte [rbp + rcx + 0xf]
cmp rax, rdx
jae 0x18003c923
lea rcx, [rax + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp rdx, 0x10
jb 0x18003c97d
mov rcx, qword [rbx]
mov byte [rcx + rax], r9b
mov byte [rcx + rax + 1], 0
jmp 0x18003c92b
Function at 0x18003d400
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x18003d437
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x18003d458
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18003d45a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18003d4b3
test ecx, ecx
jle 0x18003d493
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x18003d4b3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18003d4b3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret