joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b2d6
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, qword [rcx]
mov word [rsp + 0x2c], 0x43b3
mov word [rsp + 0x2e], 0x43c4
mov word [rsp + 0x30], 0x43da
mov word [rsp + 0x32], 0x43dd
mov word [rsp + 0x34], 0x43db
mov word [rsp + 0x36], 0x43c7
mov word [rsp + 0x38], 0x43c7
mov word [rsp + 0x3a], 0x43c3
mov word [rsp + 0x3c], 0x439d
mov word [rsp + 0x3e], 0x43d7
mov word [rsp + 0x40], 0x43df
mov word [rsp + 0x42], 0x43df
mov word [rsp + 0x44], 0
mov ecx, 0x18
call fcn.1400018f0
mov rsi, rax
mov eax, 1
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x2c]
xor cx, word [rsp + 0x2c]
mov word [rsi + rax*2 - 2], cx
inc rax
cmp rax, 0xc
jne 0x14000b260
mov word [rsi + 0x16], 0
mov word [rsp + 0x46], 0x6e
mov word [rsp + 0x48], 0x68
mov word [rsp + 0x4a], 0x75
mov word [rsp + 0x4c], 0x71
mov word [rsp + 0x4e], 0x68
mov word [rsp + 0x50], 0x6f
mov word [rsp + 0x52], 0x36
mov word [rsp + 0x54], 0x35
mov word [rsp + 0x56], 0x31
mov word [rsp + 0x58], 0x67
mov word [rsp + 0x5a], 0x6f
mov word [rsp + 0x5c], 0x6f
mov word [rsp + 0x5e], 0
mov ecx, 0x1a
call fcn.1400018f0
xor ecx, ecx
nop word cs:[rax + rax]
movzx edx, word [rsp + rcx*2 + 0x46]
add edx, 0xfffffffd
mov word [rax + rcx*2], dx
inc rcx
cmp rcx, 0xc
or al, 0x75
invalid
mov word [rax + 0x18], 0
mov byte [rsp + 0x2b], 0x69
movzx ecx, byte [rsp + 0x2b]
add cl, 0xf7
movzx ecx, cl
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
jmp 0x14000b336
cmp r9w, r10w
je 0x14000b383
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [rax + r8]
lea ebx, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp bx, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x14000b330
add r8, 2
cmp r9w, r10w
je 0x14000b340
jmp 0x14000b330
mov rdx, qword [rcx + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov r8d, 0x12337fde
call fcn.140004690
mov rcx, rsi
call rax
mov word [rsp + 0x2c], 0x6b02
movzx eax, word [rsp + 0x2c]
xor eax, 0x77
mov word [rsp + 0x2e], ax
movzx eax, word [rsp + 0x2c]
inc eax
xor eax, 0x69
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x2c]
add eax, 2
xor eax, 0x6e
mov word [rsp + 0x32], ax
movzx eax, word [rsp + 0x2c]
add eax, 3
xor eax, 0x68
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x2c]
add eax, 4
xor eax, 0x74
mov word [rsp + 0x36], ax
movzx eax, word [rsp + 0x2c]
add eax, 5
xor eax, 0x74
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x2c]
add eax, 6
xor eax, 0x70
mov word [rsp + 0x3a], ax
movzx eax, word [rsp + 0x2c]
add eax, 7
xor eax, 0x2e
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x2c]
add eax, 8
xor eax, 0x64
mov word [rsp + 0x3e], ax
movzx eax, word [rsp + 0x2c]
add eax, 9
xor eax, 0x6c
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x2c]
add eax, 0xa
xor eax, 0x6c
mov word [rsp + 0x42], ax
mov word [rsp + 0x44], 0
mov ecx, 0x18
call fcn.1400018f0
xor ecx, ecx
nop word cs:[rax + rax]
movzx edx, word [rsp + rcx*2 + 0x2e]
movzx r8d, word [rsp + 0x2c]
add r8d, ecx
xor r8w, dx
mov word [rax + rcx*2], r8w
inc rcx
cmp rcx, 0xb
jne 0x14000b470
invalid
invalid
Function at 0x14000db30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov word [rsp + 0x76], ax
movzx eax, word [rsp + 0x26]
add eax, 0x28
xor eax, 0x6c
mov word [rsp + 0x78], ax
movzx eax, word [rsp + 0x26]
add eax, 0x29
xor eax, 0x65
mov word [rsp + 0x7a], ax
movzx eax, word [rsp + 0x26]
add eax, 0x2a
xor eax, 0x72
mov word [rsp + 0x7c], ax
mov word [rsp + 0x7e], 0
mov ecx, 0x58
call fcn.1400018f0
xor ecx, ecx
nop word [rax + rax]
movzx edx, word [rsp + rcx*2 + 0x28]
movzx r8d, word [rsp + 0x26]
add r8d, ecx
xor r8w, dx
mov word [rax + rcx*2], r8w
inc rcx
cmp rcx, 0x2b
jne 0x1400039c0
mov rcx, qword [rsi + 8]
xor edx, edx
nop word cs:[rax + rax]
mov r8, qword [rax + rdx*8]
mov qword [rcx + rdx*8], r8
inc rdx
cmp rdx, 0xb
jne 0x1400039f0
mov rax, rsi
add rsp, 0x80
pop rsi
ret
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov rcx, rdx
mov rdx, r8
call fcn.140009cce
mov r8, qword [rsi + 0x10]
sub r8, rdi
cmp r8, rbx
cmovae r8, rbx
cmp qword [rsi + 0x18], 0x10
jb 0x14000db68
mov rsi, qword [rsi]
add rsi, rdi
mov rcx, r14
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x140003972

Function at 0x14000e77c
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov r15, rdx
mov rdi, rcx
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000e848
lea r14, str.bytes_read___static_cast_DWORD___1_
lea r12, [rsp + 0x34]
lea rsi, [rsp + 0x38]
mov r13, qword [sym.imp.KERNEL32.dll_GetFileType]
mov rbp, qword [sym.imp.KERNEL32.dll_ReadFile]
or dword [rsp + 0x38], 0xffffffff
mov rcx, r12
mov rdx, rsi
mov r8, r14
call fcn.14000e76f
test rax, rax
je 0x14000e81d
mov qword [rsp + 0x20], rax
mov rcx, rsi
lea rdx, str.crashpad::FileOperationResult___cdecl_crashpad::ReadFile_crashpad::FileHandle__void___size_t_
lea r8, str..._.._.._third_party_crashpad_util_file_file_io_win.cc
mov r9d, 0x7e
call fcn.14004b9a2
mov rcx, rsi
call fcn.14004ba62
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x14000e861
mov rcx, rdi
call r13
cmp eax, 3
jne 0x14000e85d
and qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, r15
mov r8d, ebx
mov r9, r12
call rbp
test eax, eax
jne 0x14000e7dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
setne al
neg rax
jmp 0x14000e863
mov eax, dword [rsp + 0x34]
mov eax, eax
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000ef47
Capabilities:
Clear file content

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x140
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov rdi, rcx
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.14000ee7c
test rax, rax
jne 0x14000efd8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x14000efd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingTruncateFile_crashpad::FileHandle_
lea r8, str..._.._.._third_party_crashpad_util_file_file_io_win.cc
lea rdi, [rbp - 0x50]
mov rcx, rdi
mov r9d, 0xfb
call fcn.14004b54e
mov dword [rdi + 0x100], esi
lea rdx, [0x14009746e]
mov rcx, rdi
call fcn.140002bc9
lea rcx, [rbp - 0x50]
call fcn.14004bba4
xor esi, esi
mov eax, esi
add rsp, 0x140
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000f63c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe0], 0xfffffffffffffffe
mov ebx, edx
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14000f669
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000f691
test bl, bl
jne 0x14000f686
mov ecx, eax
and ecx, 0x400
jne 0x14000f728
and eax, 0x10
shr eax, 4
jmp 0x14000f72a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::IsDirectory_const_base::FilePath___bool_
lea r8, str..._.._.._third_party_crashpad_util_file_filesystem_win.cc
lea rbx, [rbp - 0x58]
mov rcx, rbx
mov r9d, 0x82
call fcn.14004b54e
mov dword [rbx + 0x100], edi
lea rdx, str.GetFileAttributes
mov rcx, rbx
call fcn.140002bc9
mov rdi, rax
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x14000f6e6
mov rax, qword [rsi]
lea rdx, [rbp + 0xb0]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rcx, [rbp + 0xc0]
call fcn.14004c790
lea rdx, [rbp + 0xc0]
mov rcx, rdi
call fcn.140003113
lea rcx, [rbp + 0xc0]
call fcn.1400049ea
lea rcx, [rbp - 0x58]
call fcn.14004bba4
xor eax, eax
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018521
Capabilities:
Check os version
Create pipe

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
test dl, dl
je 0x14001856e
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
mov edi, 0x80003
cmp eax, 6
jb 0x140018573
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
mov dword [rbx], 0x18
xor ecx, ecx
call fcn.1400185b6
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
jmp 0x140018575
mov edi, 3
xor ebx, ebx
cmp qword [rsi + 0x18], 8
jb 0x14001857f
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
and dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x14001b65e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call fcn.14000ee7c
test rax, rax
jne 0x14001b69f
mov rcx, rdi
call fcn.14000ef47
test al, al
je 0x14001b69f
mov r8d, 0x28
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14000ad1a
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x14001bdde
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe0], 0xfffffffffffffffe
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001be09
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, eax
mov al, 1
test ecx, ecx
jne 0x14001bed6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14001be3d
mov rcx, rsi
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop rbp
jmp fcn.14001bf33
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::CreateDirectoryIfNecessary_const_base::FilePath__
lea r8, str..._.._.._third_party_crashpad_client_crash_report_database_win.cc
lea rbx, [rbp - 0x58]
mov rcx, rbx
mov r9d, 0x266
call fcn.14004b54e
mov dword [rbx + 0x100], edi
lea rdx, str.CreateDirectory
mov rcx, rbx
call fcn.140002bc9
mov rdi, rax
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x14001be92
mov rax, qword [rsi]
lea rdx, [rbp + 0xb0]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rcx, [rbp + 0xc0]
call fcn.14004c790
lea rdx, [rbp + 0xc0]
mov rcx, rdi
call fcn.140003113
lea rcx, [rbp + 0xc0]
call fcn.1400049ea
lea rcx, [rbp - 0x58]
call fcn.14004bba4
xor eax, eax
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001f8d8
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x28], 8
jb 0x14001f8e9
mov rcx, qword [rcx + 0x10]
jmp 0x14001f8ed
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
add rsp, 0x28
ret

Function at 0x14001f90c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [rcx + 0x78]
cmp eax, edx
je fcn.14001f8d8
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [rcx + rcx*2]
inc eax
ret
Function at 0x14002302c
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rcx]
test rcx, rcx
jne fcn.140004984
ret

Function at 0x140024c72
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov dword [rcx + 0x78], 0x1003f
mov eax, dword [rdx + 0x234]
mov dword [rcx + 0x7c], eax
mov eax, dword [rdx + 0x238]
mov dword [rcx + 0x80], eax
mov eax, dword [rdx + 0x23c]
mov dword [rcx + 0x84], eax
mov eax, dword [rdx + 0x240]
mov dword [rcx + 0x88], eax
mov eax, dword [rdx + 0x24c]
mov dword [rcx + 0x8c], eax
mov eax, dword [rdx + 0x250]
mov dword [rcx + 0x90], eax
lea rdx, [rcx + 0x94]
lea rbx, [rdi + 0x34]
mov rcx, rbx
call fcn.140051c74
movzx eax, word [rdi + 0x30]
mov dword [rsi + 0x104], eax
movzx eax, word [rdi + 0x2e]
mov dword [rsi + 0x108], eax
movzx eax, word [rdi + 0x2c]
mov dword [rsi + 0x10c], eax
movzx eax, word [rdi + 0x2a]
mov dword [rsi + 0x110], eax
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x114], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x118], eax
mov eax, dword [rdi + 4]
mov dword [rsi + 0x11c], eax
mov eax, dword [rdi + 0xc]
mov dword [rsi + 0x120], eax
mov eax, dword [rdi + 8]
mov dword [rsi + 0x124], eax
mov eax, dword [rdi]
mov dword [rsi + 0x128], eax
mov eax, dword [rdi + 0x18]
mov dword [rsi + 0x12c], eax
mov eax, dword [rdi + 0x20]
mov dword [rsi + 0x130], eax
movzx eax, word [rdi + 0x28]
mov dword [rsi + 0x134], eax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x138], eax
mov eax, dword [rdi + 0x1c]
mov dword [rsi + 0x13c], eax
movzx eax, word [rdi + 0x32]
mov dword [rsi + 0x140], eax
add rsi, 0x144
mov r8d, 0x200
mov rcx, rsi
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14006f9f0

Function at 0x140028c30
Capabilities:
Encode data using xor

Disassembly:
cmp qword [rdx + 0x18], 0x10
mov r8, rdx
jb 0x140028c3d
mov r8, qword [rdx]
mov r9, qword [rdx + 0x10]
mov rdx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x140028c4f
mov rcx, qword [rcx]
jmp 0x1400046e4

Function at 0x140028f56
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140028f70
add rcx, 0x20
call fcn.1400049ea
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140006732
Function at 0x140045b80
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
lea rax, [rsp + 0x40]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x44]
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete al
jne 0x140045bc6
mov ecx, dword [rsp + 0x3c]
mov dword [rsi], ecx
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140045ca0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe0], 0xfffffffffffffffe
lea rsi, [rbp + 0xb0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsi + 0x20]
cmp ecx, 0x100
jb 0x140045d1d
mov dword [rsp + 0x20], 1
lea rdx, str.virtual_uint8_t___cdecl_crashpad::internal::SystemSnapshotWin::CPUCount_void__const
lea r8, str..._.._.._third_party_crashpad_snapshot_win_system_snapshot_win.cc
lea rsi, [rbp - 0x50]
mov rcx, rsi
mov r9d, 0x10a
call fcn.14004b54e
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov rcx, rsi
call fcn.140002bc9
lea rcx, [rbp - 0x50]
call fcn.14004ba62
mov ecx, dword [rbp + 0xd0]
cmp ecx, 0x100
mov eax, 0xff
cmovb eax, ecx
add rsp, 0x168
pop rsi
pop rbp
ret

Function at 0x140047e42
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rcx, rdx
call fcn.140047e5a
mov rcx, rax
add rsp, 0x28
jmp fcn.14000358a

Function at 0x14004bd28
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb0], 0xfffffffffffffffe
test rdx, rdx
je 0x14004bdd9
mov rsi, rdx
mov rdi, rcx
mov r12d, 0xffffffff
lea rbx, [rbp - 0x50]
lea r13, str.Check_failed:_success
lea r14, [0x14009fc16]
cmp rsi, r12
mov r15d, 0xffffffff
cmovb r15, rsi
mov rcx, rdi
mov edx, r15d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x14004bdd1
mov dword [rsp + 0x20], 4
mov rcx, rbx
lea rdx, str.void___cdecl_base::RandBytes_void___size_t_
lea r8, str..._.._.._third_party_crashpad_third_party_mini_chromium_base_rand_util.cc
push 0x7d
pop r9
call fcn.14004b54e
mov rcx, rbx
mov rdx, r13
call fcn.140002bc9
mov rcx, rax
mov rdx, r14
call fcn.140002bc9
mov rcx, rbx
call fcn.14004ba62
add rdi, r15
sub rsi, r15
jne 0x14004bd75
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x18000ff00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov r9, rdx
mov word [rbp - 0x1f], 0x73
mov byte [rbp - 0x20], 0x65
mov word [rbp - 0x28], 0x7363
mov byte [rbp - 0x26], 0
mov word [rbp - 0x1c], 0x7373
mov byte [rbp - 0x1a], 0
mov word [rbp - 0x30], 0x7364
mov byte [rbp - 0x2e], 0
mov word [rbp - 0x2b], 0x73
mov byte [rbp - 0x2c], 0x66
mov word [rbp - 0x23], 0x73
mov byte [rbp - 0x24], 0x67
mov word [rbp - 0x15], 0x524f
mov word [rbp - 0x18], 0x5245
mov byte [rbp - 0x16], 0x52
mov byte [rbp - 0x13], 0
mov dword [rbp - 0xe], 0x524f52
mov word [rbp - 0x10], 0x5245
cmp ecx, 7
ja case.default.0x18000ff90
movsxd rax, ecx
lea rcx, [0x180000000]
mov edx, dword [rcx + rax*4 + 0xffe0]
add rdx, rcx
jmp rdx
lea r8, [rbp - 0x20]
jmp 0x18000ffc0
lea r8, [rbp - 0x28]
jmp 0x18000ffc0
lea r8, [rbp - 0x1c]
jmp 0x18000ffc0
lea r8, [rbp - 0x30]
jmp 0x18000ffc0
lea r8, [rbp - 0x2c]
jmp 0x18000ffc0
lea r8, [rbp - 0x24]
jmp 0x18000ffc0
lea r8, [rbp - 0x18]
jmp 0x18000ffc0
lea r8, [rbp - 0x10]
mov edx, 0x104
mov rcx, r9
call fcn.180014ca8
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180014280
add rsp, 0x50
pop rbp
ret
Function at 0x180010010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov r9, rdx
mov word [rbp - 0x43], 0x7274
mov dword [rbp - 0x48], 0x20657479
mov byte [rbp - 0x41], 0
mov byte [rbp - 0x49], 0x62
mov byte [rbp - 0x44], 0x70
mov word [rbp - 0x36], 0x2064
mov word [rbp - 0x33], 0x7274
mov byte [rbp - 0x34], 0x70
mov byte [rbp - 0x31], 0
mov word [rbp - 0x38], 0x726f
mov byte [rbp - 0x39], 0x77
mov dword [rbp - 7], 0x2064726f
mov word [rbp - 2], 0x7274
mov byte [rbp], 0
mov word [rbp - 9], 0x7764
mov byte [rbp - 3], 0x70
mov dword [rbp + 0xe], 0x727470
mov word [rbp + 0xb], 0x6574
mov word [rbp + 8], 0x625f
mov byte [rbp + 0xd], 0x20
mov byte [rbp + 7], 0x36
mov byte [rbp + 0xa], 0x79
mov word [rbp - 0x13], 0x7470
mov word [rbp - 0x16], 0x6472
mov word [rbp - 0x19], 0x7771
mov word [rbp - 0x11], 0x72
mov byte [rbp - 0x14], 0x20
mov byte [rbp - 0x17], 0x6f
mov dword [rbp + 0x2a], 0x65747962
mov dword [rbp + 0x2e], 0x72747020
mov word [rbp + 0x28], 0x5f30
mov byte [rbp + 0x32], 0
mov byte [rbp + 0x27], 0x31
mov word [rbp + 0x1d], 0x2044
mov dword [rbp + 0x17], 0x41564e49
mov word [rbp + 0x20], 0x5254
mov byte [rbp + 0x22], 0
mov word [rbp + 0x1b], 0x494c
mov byte [rbp + 0x1f], 0x50
mov dword [rbp + 0x3d], 0x54502044
mov dword [rbp + 0x37], 0x41564e49
mov word [rbp + 0x3b], 0x494c
mov word [rbp + 0x41], 0x52
mov dword [rbp - 0x23], 0x727470
mov word [rbp - 0x28], 0x6f77
mov word [rbp - 0x25], 0x2064
mov byte [rbp - 0x29], 0x6f
mov byte [rbp - 0x26], 0x72
cmp ecx, 8
ja case.default.0x18001014b
movsxd rax, ecx
lea rcx, [0x180000000]
mov edx, dword [rcx + rax*4 + 0x101a4]
add rdx, rcx
jmp rdx
lea r8, [rbp - 0x49]
jmp 0x180010181
lea r8, [rbp - 0x39]
jmp 0x180010181
lea r8, [rbp - 9]
jmp 0x180010181
lea r8, [rbp + 7]
jmp 0x180010181
lea r8, [rbp - 0x19]
jmp 0x180010181
lea r8, [rbp + 0x27]
jmp 0x180010181
lea r8, [rbp + 0x17]
jmp 0x180010181
lea r8, [rbp + 0x37]
jmp 0x180010181
lea r8, [rbp - 0x29]
mov edx, 0x104
mov rcx, r9
call fcn.180014ca8
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180014280
add rsp, 0xc0
pop rbp
ret

Function at 0x1800101d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x30]
mov word [rbp - 0x14], 0x536c
mov dword [rbp - 0x19], 0x63697469
mov dword [rbp - 0x11], 0x6f697463
mov dword [rbp - 0x1e], 0x43726574
mov word [rbp - 0xd], 0x6e
mov byte [rbp - 0x12], 0x65
mov word [rbp - 0x20], 0x6e45
mov byte [rbp - 0x15], 0x61
mov byte [rbp - 0x1a], 0x72
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001025d
lea rcx, [0x18005ca38]
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180014280
add rsp, 0x50
pop rbp
ret
Function at 0x180010280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov rdi, rdx
mov word [rbp - 0x14], 0x79
mov word [rbp - 0x1f], 0x6c74
mov word [rbp - 0x1a], 0x4d6f
mov word [rbp - 0x17], 0x6f6d
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0x15], 0x72
mov word [rbp - 0x1c], 0x7265
mov byte [rbp - 0x1d], 0x5a
mov byte [rbp - 0x18], 0x65
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010316
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x180010340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x28]
mov dword [rsp + 0x22], 0x706565
mov word [rsp + 0x20], 0x6c53
mov dword [rsp + 0x2f], 0x6c642e32
mov word [rsp + 0x33], 0x6c
mov dword [rsp + 0x29], 0x656e7265
mov word [rsp + 0x2d], 0x336c
mov byte [rsp + 0x28], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800103aa
mov ecx, 0x64
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180014280
add rsp, 0x48
ret

Function at 0x1800103d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x30]
mov dword [rbp - 0xf], 0x6e6f69
mov word [rbp - 0x15], 0x6c61
mov word [rbp - 0x1a], 0x6972
mov word [rbp - 0x1d], 0x6576
mov word [rbp - 0x20], 0x654c
mov word [rbp - 0x18], 0x6974
mov byte [rbp - 0x1b], 0x43
mov dword [rbp - 0x13], 0x74636553
mov byte [rbp - 0x1e], 0x61
mov byte [rbp - 0x16], 0x63
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010462
lea rcx, [0x18005ca38]
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180014280
add rsp, 0x50
pop rbp
ret