joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180070b64
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199970]
mov rbx, rdx
test rax, rax
jne 0x180070c15
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180070bc3
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199970], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199970]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180070c3e
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180070c6a
cmp dword [rbp - 0x18], 0x10000
je 0x180070c6a
cmp qword [rbp - 0x20], 0x1000
jb 0x180070c6a
cmp dword [rbp - 0x10], 0x1000000
je 0x180070c66
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180070c6c
mov al, 1
jmp 0x180070c6c
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180071dcc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199cb0]
mov rbx, rdx
test rax, rax
jne 0x180071e7d
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180071e2b
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199cb0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199cb0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180071ea6
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180071ed2
cmp dword [rbp - 0x18], 0x10000
je 0x180071ed2
cmp qword [rbp - 0x20], 0x1000
jb 0x180071ed2
cmp dword [rbp - 0x10], 0x1000000
je 0x180071ece
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180071ed4
mov al, 1
jmp 0x180071ed4
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180073678
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1801998c8]
mov rbx, rdx
test rax, rax
jne 0x180073729
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1800736d7
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1801998c8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1801998c8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180073752
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18007377e
cmp dword [rbp - 0x18], 0x10000
je 0x18007377e
cmp qword [rbp - 0x20], 0x1000
jb 0x18007377e
cmp dword [rbp - 0x10], 0x1000000
je 0x18007377a
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180073780
mov al, 1
jmp 0x180073780
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180073db8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199ac8]
mov rbx, rdx
test rax, rax
jne 0x180073e69
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180073e17
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199ac8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199ac8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180073e92
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180073ebe
cmp dword [rbp - 0x18], 0x10000
je 0x180073ebe
cmp qword [rbp - 0x20], 0x1000
jb 0x180073ebe
cmp dword [rbp - 0x10], 0x1000000
je 0x180073eba
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180073ec0
mov al, 1
jmp 0x180073ec0
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180075664
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199990]
mov rbx, rdx
test rax, rax
jne 0x180075715
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1800756c3
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199990], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199990]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18007573e
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18007576a
cmp dword [rbp - 0x18], 0x10000
je 0x18007576a
cmp qword [rbp - 0x20], 0x1000
jb 0x18007576a
cmp dword [rbp - 0x10], 0x1000000
je 0x180075766
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18007576c
mov al, 1
jmp 0x18007576c
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180076f10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199bf0]
mov rbx, rdx
test rax, rax
jne 0x180076fc1
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180076f6f
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199bf0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199bf0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180076fea
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180077016
cmp dword [rbp - 0x18], 0x10000
je 0x180077016
cmp qword [rbp - 0x20], 0x1000
jb 0x180077016
cmp dword [rbp - 0x10], 0x1000000
je 0x180077012
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180077018
mov al, 1
jmp 0x180077018
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1800787bc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199b50]
mov rbx, rdx
test rax, rax
jne 0x18007886d
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18007881b
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199b50], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199b50]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180078896
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800788c2
cmp dword [rbp - 0x18], 0x10000
je 0x1800788c2
cmp qword [rbp - 0x20], 0x1000
jb 0x1800788c2
cmp dword [rbp - 0x10], 0x1000000
je 0x1800788be
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x1800788c4
mov al, 1
jmp 0x1800788c4
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18007a068
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199a30]
mov rbx, rdx
test rax, rax
jne 0x18007a119
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18007a0c7
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199a30], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199a30]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18007a142
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18007a16e
cmp dword [rbp - 0x18], 0x10000
je 0x18007a16e
cmp qword [rbp - 0x20], 0x1000
jb 0x18007a16e
cmp dword [rbp - 0x10], 0x1000000
je 0x18007a16a
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18007a170
mov al, 1
jmp 0x18007a170
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18007a7a8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199a38]
mov rbx, rdx
test rax, rax
jne 0x18007a859
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18007a807
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199a38], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199a38]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18007a882
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18007a8ae
cmp dword [rbp - 0x18], 0x10000
je 0x18007a8ae
cmp qword [rbp - 0x20], 0x1000
jb 0x18007a8ae
cmp dword [rbp - 0x10], 0x1000000
je 0x18007a8aa
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18007a8b0
mov al, 1
jmp 0x18007a8b0
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18007c054
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199948]
mov rbx, rdx
test rax, rax
jne 0x18007c105
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18007c0b3
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199948], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199948]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18007c12e
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18007c15a
cmp dword [rbp - 0x18], 0x10000
je 0x18007c15a
cmp qword [rbp - 0x20], 0x1000
jb 0x18007c15a
cmp dword [rbp - 0x10], 0x1000000
je 0x18007c156
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18007c15c
mov al, 1
jmp 0x18007c15c
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18007c794
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1801999d0]
mov rbx, rdx
test rax, rax
jne 0x18007c845
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18007c7f3
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1801999d0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1801999d0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18007c86e
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18007c89a
cmp dword [rbp - 0x18], 0x10000
je 0x18007c89a
cmp qword [rbp - 0x20], 0x1000
jb 0x18007c89a
cmp dword [rbp - 0x10], 0x1000000
je 0x18007c896
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18007c89c
mov al, 1
jmp 0x18007c89c
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18007e040
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199958]
mov rbx, rdx
test rax, rax
jne 0x18007e0f1
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18007e09f
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199958], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199958]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18007e11a
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18007e146
cmp dword [rbp - 0x18], 0x10000
je 0x18007e146
cmp qword [rbp - 0x20], 0x1000
jb 0x18007e146
cmp dword [rbp - 0x10], 0x1000000
je 0x18007e142
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18007e148
mov al, 1
jmp 0x18007e148
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18007f8ec
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199be0]
mov rbx, rdx
test rax, rax
jne 0x18007f99d
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18007f94b
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199be0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199be0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18007f9c6
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18007f9f2
cmp dword [rbp - 0x18], 0x10000
je 0x18007f9f2
cmp qword [rbp - 0x20], 0x1000
jb 0x18007f9f2
cmp dword [rbp - 0x10], 0x1000000
je 0x18007f9ee
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18007f9f4
mov al, 1
jmp 0x18007f9f4
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18008002c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199b18]
mov rbx, rdx
test rax, rax
jne 0x1800800dd
mov dword [rbp - 0x50], 0x30
xor edx, edx
mov byte [rbp - 0x4c], 0x66
mov byte [rbp - 0x4b], 0x59
mov byte [rbp - 0x4a], 0x42
mov byte [rbp - 0x49], 0x44
mov byte [rbp - 0x48], 0x45
mov byte [rbp - 0x47], 0x51
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x45
mov byte [rbp - 0x43], 0x55
mov byte [rbp - 0x42], 0x42
mov byte [rbp - 0x41], 0x49
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18008008b
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199b18], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199b18]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180080106
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180080132
cmp dword [rbp - 0x18], 0x10000
je 0x180080132
cmp qword [rbp - 0x20], 0x1000
jb 0x180080132
cmp dword [rbp - 0x10], 0x1000000
je 0x18008012e
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180080134
mov al, 1
jmp 0x180080134
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret