joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18016b558
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0d40]
mov rbx, rdx
test rax, rax
jne 0x18016b5fb
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18016b5b0
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0d40], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0d40]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18016b624
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18016b650
cmp dword [rbp - 0x10], 0x10000
je 0x18016b650
cmp qword [rbp - 0x18], 0x1000
jb 0x18016b650
cmp dword [rbp - 8], 0x1000000
je 0x18016b64c
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18016b652
mov al, 1
jmp 0x18016b652
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18016d51c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0d78]
mov rbx, rdx
test rax, rax
jne 0x18016d5bf
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18016d574
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0d78], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0d78]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18016d5e8
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18016d614
cmp dword [rbp - 0x10], 0x10000
je 0x18016d614
cmp qword [rbp - 0x18], 0x1000
jb 0x18016d614
cmp dword [rbp - 8], 0x1000000
je 0x18016d610
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18016d616
mov al, 1
jmp 0x18016d616
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18016f4e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0d58]
mov rbx, rdx
test rax, rax
jne 0x18016f583
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18016f538
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0d58], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0d58]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18016f5ac
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18016f5d8
cmp dword [rbp - 0x10], 0x10000
je 0x18016f5d8
cmp qword [rbp - 0x18], 0x1000
jb 0x18016f5d8
cmp dword [rbp - 8], 0x1000000
je 0x18016f5d4
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18016f5da
mov al, 1
jmp 0x18016f5da
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180180558
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x12
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x180180565
mov byte [rcx + 0x16], r10b
ret
Function at 0x180182f98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0e90]
mov rbx, rdx
test rax, rax
jne 0x18018303b
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180182ff0
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0e90], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0e90]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180183064
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180183090
cmp dword [rbp - 0x10], 0x10000
je 0x180183090
cmp qword [rbp - 0x18], 0x1000
jb 0x180183090
cmp dword [rbp - 8], 0x1000000
je 0x18018308c
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180183092
mov al, 1
jmp 0x180183092
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180183674
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0f28]
mov rbx, rdx
test rax, rax
jne 0x180183717
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801836cc
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0f28], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0f28]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180183740
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18018376c
cmp dword [rbp - 0x10], 0x10000
je 0x18018376c
cmp qword [rbp - 0x18], 0x1000
jb 0x18018376c
cmp dword [rbp - 8], 0x1000000
je 0x180183768
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18018376e
mov al, 1
jmp 0x18018376e
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180183d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0e98]
mov rbx, rdx
test rax, rax
jne 0x180183df3
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180183da8
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0e98], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0e98]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180183e1c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180183e48
cmp dword [rbp - 0x10], 0x10000
je 0x180183e48
cmp qword [rbp - 0x18], 0x1000
jb 0x180183e48
cmp dword [rbp - 8], 0x1000000
je 0x180183e44
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180183e4a
mov al, 1
jmp 0x180183e4a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18018442c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0e60]
mov rbx, rdx
test rax, rax
jne 0x1801844cf
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180184484
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0e60], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0e60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801844f8
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180184524
cmp dword [rbp - 0x10], 0x10000
je 0x180184524
cmp qword [rbp - 0x18], 0x1000
jb 0x180184524
cmp dword [rbp - 8], 0x1000000
je 0x180184520
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180184526
mov al, 1
jmp 0x180184526
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180184b08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0de8]
mov rbx, rdx
test rax, rax
jne 0x180184bab
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180184b60
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0de8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0de8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180184bd4
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180184c00
cmp dword [rbp - 0x10], 0x10000
je 0x180184c00
cmp qword [rbp - 0x18], 0x1000
jb 0x180184c00
cmp dword [rbp - 8], 0x1000000
je 0x180184bfc
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180184c02
mov al, 1
jmp 0x180184c02
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801851e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0f60]
mov rbx, rdx
test rax, rax
jne 0x180185287
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18018523c
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0f60], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0f60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1801852b0
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801852dc
cmp dword [rbp - 0x10], 0x10000
je 0x1801852dc
cmp qword [rbp - 0x18], 0x1000
jb 0x1801852dc
cmp dword [rbp - 8], 0x1000000
je 0x1801852d8
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801852de
mov al, 1
jmp 0x1801852de
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1801858c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0f30]
mov rbx, rdx
test rax, rax
jne 0x180185963
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180185918
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0f30], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0f30]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18018598c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801859b8
cmp dword [rbp - 0x10], 0x10000
je 0x1801859b8
cmp qword [rbp - 0x18], 0x1000
jb 0x1801859b8
cmp dword [rbp - 8], 0x1000000
je 0x1801859b4
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1801859ba
mov al, 1
jmp 0x1801859ba
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180185f9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0f70]
mov rbx, rdx
test rax, rax
jne 0x18018603f
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180185ff4
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0f70], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0f70]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180186068
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180186094
cmp dword [rbp - 0x10], 0x10000
je 0x180186094
cmp qword [rbp - 0x18], 0x1000
jb 0x180186094
cmp dword [rbp - 8], 0x1000000
je 0x180186090
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180186096
mov al, 1
jmp 0x180186096
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180186678
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0e08]
mov rbx, rdx
test rax, rax
jne 0x18018671b
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1801866d0
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0e08], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0e08]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180186744
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180186770
cmp dword [rbp - 0x10], 0x10000
je 0x180186770
cmp qword [rbp - 0x18], 0x1000
jb 0x180186770
cmp dword [rbp - 8], 0x1000000
je 0x18018676c
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180186772
mov al, 1
jmp 0x180186772
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180186d54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0f10]
mov rbx, rdx
test rax, rax
jne 0x180186df7
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x180186dac
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0f10], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0f10]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x180186e20
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180186e4c
cmp dword [rbp - 0x10], 0x10000
je 0x180186e4c
cmp qword [rbp - 0x18], 0x1000
jb 0x180186e4c
cmp dword [rbp - 8], 0x1000000
je 0x180186e48
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x180186e4e
mov al, 1
jmp 0x180186e4e
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18018e5a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov edx, ecx
lea rcx, [rbp + 0xf]
call fcn.18018e434
nop
lea rdx, [rbp + 0xf]
lea rcx, [rbp + 0x2f]
call fcn.18007a534
mov r8, rax
mov dword [rbp - 0x49], 0x67
mov eax, 0x3c
mov word [rbp - 0x45], ax
mov eax, 0x49
mov word [rbp - 0x43], ax
mov eax, 0x3a
mov word [rbp - 0x41], ax
lea r11d, [rax + 0xd]
mov word [rbp - 0x3f], r11w
lea eax, [r11 - 0x10]
mov word [rbp - 0x3d], ax
lea ecx, [rax - 0x31]
mov word [rbp - 0x3b], cx
xor ebx, ebx
mov word [rbp - 0x39], bx
lea r10d, [r11 - 0x45]
mov word [rbp - 0x37], r10w
mov word [rbp - 0x35], r11w
lea eax, [rcx + 0x11]
mov word [rbp - 0x33], ax
lea eax, [rcx + 0xf]
mov word [rbp - 0x31], ax
lea r9d, [r11 - 0x3f]
mov word [rbp - 0x2f], r9w
lea edx, [rcx + 0xd]
mov word [rbp - 0x2d], dx
mov word [rbp - 0x2b], r10w
lea eax, [rcx - 2]
mov word [rbp - 0x29], ax
mov word [rbp - 0x27], dx
lea eax, [rcx + 8]
mov word [rbp - 0x25], ax
mov word [rbp - 0x23], r9w
lea eax, [rcx + 3]
mov word [rbp - 0x21], ax
mov word [rbp - 0x1f], r11w
lea edi, [rcx - 5]
mov word [rbp - 0x1d], di
lea eax, [rcx + 5]
mov word [rbp - 0x1b], ax
mov word [rbp - 0x19], cx
mov word [rbp - 0x17], bx
lea ecx, [rbx + 0x14]
mov word [rbp - 0x15], cx
mov word [rbp - 0x13], r11w
mov word [rbp - 0x11], dx
mov word [rbp - 0xf], r9w
mov word [rbp - 0xd], r11w
lea eax, [rbx + 0x12]
mov word [rbp - 0xb], ax
mov word [rbp - 9], cx
mov word [rbp - 7], r10w
lea eax, [rbx + 0x5d]
mov word [rbp - 5], ax
mov word [rbp - 3], r11w
xor eax, eax
mov word [rbp - 1], ax
movzx eax, word [rbp - 0x45]
mov edx, ebx
movzx eax, word [rbp + rdx*2 - 0x45]
mov ecx, dword [rbp - 0x49]
xor cx, ax
mov word [rbp + rdx*2 - 0x45], cx
add rdx, rdi
cmp rdx, 0x22
jb 0x18018e6c7
mov word [rbp - 1], bx
mov rdx, r8
lea rcx, [rbp - 0x45]
call fcn.180136a78
nop
xor edx, edx
lea r8d, [rdx + 0x46]
lea rcx, [rbp - 0x45]
call qword [sym.imp.VCRUNTIME140.dll_memset]
nop
lea rcx, [rbp + 0xf]
call fcn.18007a444
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1801a93d4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r11, qword [rcx]
mov rdi, rdx
mov r10, r11
mov rbx, rcx
neg r10
mov r9, r11
test r9, r9
je 0x1801a942e
mov eax, 0x5a4d
cmp word [r9], ax
je 0x1801a940b
mov eax, 0x4d5a
cmp word [r9], ax
jne 0x1801a942e
movsxd rdx, dword [r9 + 0x3c]
add rdx, r10
add rdx, r9
add rdx, r11
je 0x1801a942e
mov rcx, qword [rbx + 0x18]
add rcx, r11
cmp rdx, rcx
jae 0x1801a942e
cmp dword [rdx], 0x4550
je 0x1801a943f
inc r9
lea rax, [r10 + r9]
cmp rax, 0x100
jae 0x1801a944c
jmp 0x1801a93f0
mov ecx, dword [rdx + 0x50]
mov al, 1
mov qword [r8], rcx
mov qword [rdi], r9
jmp 0x1801a944e
xor al, al
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret