joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800018a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180001915
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180001915
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x180001905
nop
cmp rbx, rcx
jae 0x180001915
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1800018f0
cmp rbx, rcx
jae 0x180001915
cmp word [rbx], 0
je 0x180001915
mov rax, rbx
jmp 0x180001917
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180001980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, edx
xor r9d, r9d
shr eax, 4
mov ebx, edx
inc ax
mov rdi, rcx
movzx r8d, ax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x1800019b8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800018a0

Function at 0x18000ea9c
Capabilities:
Create thread
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.18000f8d4
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x18000eaef
test rbx, rbx
je 0x18000eae0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x18000eaef
mov edi, 4
jmp 0x18000eb98
call fcn.18000f6dc
test al, al
jne 0x18000eb0c
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x18000eb98
test bpl, bpl
je 0x18000eb6f
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x18000ea74]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000eb98
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x18000eb69
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000eb98
mov edi, dword [rsp + 0x44]
jmp 0x18000eb61
call fcn.18000f800
test al, al
jne 0x18000eb80
bts esi, 0x15
xor ecx, ecx
jmp 0x18000eb88
call fcn.18000f738
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.18000f654
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x180028e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov word [rsp + 0x2b], 0x79
mov rbx, rcx
mov word [rsp + 0x28], 0x6575
mov word [rsp + 0x25], 0x6c61
mov dword [rsp + 0x20], 0x74726956
mov byte [rsp + 0x2a], 0x72
mov byte [rsp + 0x27], 0x51
mov byte [rsp + 0x24], 0x75
call fcn.180029ba0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180028ef1
mov r8d, 0x30
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180028f10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov word [rsp + 0x2f], 0x64
mov dword [rsp + 0x26], 0x746e6572
mov word [rsp + 0x20], 0x6547
mov word [rsp + 0x23], 0x7543
mov dword [rsp + 0x2a], 0x65726854
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x25], 0x72
mov byte [rsp + 0x2e], 0x61
call fcn.180029ba0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180028f83
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x48
ret

Function at 0x180029030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edi, edx
mov dword [rsp + 0x25], 0x64616572
mov rbx, rcx
mov word [rsp + 0x2d], 0x6972
mov word [rsp + 0x30], 0x79
mov word [rsp + 0x2a], 0x6972
mov byte [rsp + 0x2f], 0x74
mov byte [rsp + 0x29], 0x50
mov dword [rsp + 0x20], 0x54746553
mov byte [rsp + 0x2c], 0x6f
mov byte [rsp + 0x24], 0x68
call fcn.180029ba0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800290a6
mov edx, edi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800025d0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1800290d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov dword [rsp + 0x25], 0x6d657473
mov word [rsp + 0x23], 0x7953
mov word [rsp + 0x20], 0x6547
mov word [rsp + 0x2c], 0x6f
mov word [rsp + 0x29], 0x6e49
mov byte [rsp + 0x2b], 0x66
mov byte [rsp + 0x22], 0x74
call fcn.180029ba0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180029133
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x40
pop rbx
ret
Function at 0x180029150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, r8d
mov word [rsp + 0x25], 0x7268
mov word [rsp + 0x28], 0x6461
mov dword [rsp + 0x20], 0x6e65704f
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x24], 0x54
mov byte [rsp + 0x27], 0x65
call fcn.180029ba0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800291c4
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x40
pop rbx
ret

Function at 0x1800291e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov dword [rsp + 0x23], 0x65726854
mov rbx, rcx
mov dword [rsp + 0x2d], 0x747865
mov word [rsp + 0x20], 0x6547
mov dword [rsp + 0x28], 0x6e6f4364
mov byte [rsp + 0x2c], 0x74
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x27], 0x61
call fcn.180029ba0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002924d
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800025d0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180029270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
mov ebp, r9d
mov rsi, r8
mov dword [rsp + 0x32], 0x61757472
mov rdi, rdx
mov dword [rsp + 0x3d], 0x784574
mov rbx, rcx
mov dword [rsp + 0x37], 0x746f7250
mov word [rsp + 0x30], 0x6956
mov word [rsp + 0x3b], 0x6365
mov byte [rsp + 0x36], 0x6c
call fcn.180029ba0
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800292f4
mov r9d, ebp
mov qword [rsp + 0x20], r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180029320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov word [rsp + 0x2b], 0x64
mov dword [rsp + 0x22], 0x656d7573
mov dword [rsp + 0x26], 0x65726854
mov word [rsp + 0x20], 0x6552
mov byte [rsp + 0x2a], 0x61
call fcn.180029ba0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002938b
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x40
pop rbx
ret
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x40
pop rbx
ret
Function at 0x1800293b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x20], 0x65536c61
mov dword [rbp - 0x1a], 0x6e6f69
mov dword [rbp - 0x2a], 0x657a696c
mov dword [rbp - 0x2e], 0x61697469
mov word [rbp - 0x1c], 0x7463
mov word [rbp - 0x25], 0x6972
mov word [rbp - 0x30], 0x6e49
mov word [rbp - 0x22], 0x6369
mov byte [rbp - 0x26], 0x43
mov byte [rbp - 0x23], 0x74
call fcn.180029ba0
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180029423
lea rcx, [0x180067ad0]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x50
pop rbp
ret

Function at 0x1800294f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x80]
mov rsi, rdx
mov ebx, 1
call fcn.180029b40
mov rdi, rax
test rax, rax
je 0x180029590
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x3a], 0x417845
mov rcx, rax
mov word [rsp + 0x30], 0x6552
mov dword [rsp + 0x33], 0x6e65704f
mov word [rsp + 0x37], 0x654b
mov byte [rsp + 0x32], 0x67
mov byte [rsp + 0x39], 0x79
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180029587
mov r9d, 0x20019
mov qword [rsp + 0x20], rbp
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000001
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800025d0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x1800295c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov word [rsp + 0x29], 0x6946
mov dword [rsp + 0x24], 0x6c75646f
mov dword [rsp + 0x20], 0x4d746547
mov word [rsp + 0x2e], 0x6d61
mov byte [rsp + 0x28], 0x65
mov word [rsp + 0x31], 0x41
mov word [rsp + 0x2c], 0x4e65
mov byte [rsp + 0x2b], 0x6c
mov byte [rsp + 0x30], 0x65
call fcn.180029ba0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002964b
mov r8d, 0x104
mov rdx, rbx
xor ecx, ecx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x40
pop rbx
ret
Function at 0x180029720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, r8
mov word [rsp + 0x2e], 0x6e6f
mov rdi, rdx
mov dword [rsp + 0x29], 0x74637572
mov rbx, rcx
mov word [rsp + 0x31], 0x6361
mov word [rsp + 0x26], 0x736e
mov word [rsp + 0x34], 0x65
mov byte [rsp + 0x30], 0x43
mov dword [rsp + 0x21], 0x6873756c
mov byte [rsp + 0x28], 0x74
mov byte [rsp + 0x20], 0x46
mov byte [rsp + 0x33], 0x68
mov byte [rsp + 0x25], 0x49
mov byte [rsp + 0x2d], 0x69
call fcn.180029ba0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800297ad
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800297d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
mov rbp, rdx
mov r15, qword [rsp + 0xa8]
mov rsi, rcx
mov ebx, 1
call fcn.180029b40
mov rdi, rax
test rax, rax
je 0x180029881
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x3c], 0x41784565
mov rcx, rax
mov dword [rsp + 0x38], 0x756c6156
mov word [rsp + 0x33], 0x7551
mov word [rsp + 0x30], 0x6552
mov word [rsp + 0x35], 0x7265
mov byte [rsp + 0x37], 0x79
mov byte [rsp + 0x32], 0x67
mov byte [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180029878
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, rbp
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800025d0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800298b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov word [rsp + 0x27], 0x4e32
mov rbx, rcx
mov word [rsp + 0x24], 0x6461
mov dword [rsp + 0x29], 0x747865
mov byte [rsp + 0x26], 0x33
mov word [rsp + 0x21], 0x7268
mov byte [rsp + 0x23], 0x65
mov byte [rsp + 0x20], 0x54
call fcn.180029ba0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002991b
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180029940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov dword [rsp + 0x23], 0x33646165
mov rbx, rcx
mov word [rsp + 0x29], 0x7269
mov word [rsp + 0x2c], 0x74
mov word [rsp + 0x27], 0x4632
mov word [rsp + 0x21], 0x7268
mov byte [rsp + 0x20], 0x54
mov byte [rsp + 0x2b], 0x73
call fcn.180029ba0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800299ad
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1800299d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ebx, edx
mov dword [rbp - 0x1c], 0x746f6873
mov dword [rbp - 0x2e], 0x65746165
mov word [rbp - 0x22], 0x3233
mov word [rbp - 0x28], 0x6c6f
mov word [rbp - 0x30], 0x7243
mov word [rbp - 0x25], 0x6c65
mov word [rbp - 0x1f], 0x616e
mov word [rbp - 0x2a], 0x6f54
mov byte [rbp - 0x26], 0x68
mov byte [rbp - 0x1d], 0x70
mov byte [rbp - 0x18], 0
mov byte [rbp - 0x23], 0x70
mov byte [rbp - 0x20], 0x53
call fcn.180029ba0
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180029a55
mov edx, ebx
mov ecx, 4
call rax
jmp 0x180029a5c
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800025d0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x180029a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x776c6853
mov dword [rsp + 0x24], 0x2e697061
mov word [rsp + 0x29], 0x6c6c
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x28], 0x64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x48
ret

Function at 0x180029ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x24], 0x3233
mov dword [rsp + 0x26], 0x6c6c642e
mov word [rsp + 0x21], 0x6573
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x20], 0x55
mov byte [rsp + 0x23], 0x72
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x48
ret

Function at 0x180029b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x29], 0x6c6c64
mov dword [rsp + 0x25], 0x2e323369
mov word [rsp + 0x23], 0x7061
mov word [rsp + 0x20], 0x6441
mov byte [rsp + 0x22], 0x76
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x48
ret
Function at 0x180029ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x27], 0x6c642e32
mov word [rsp + 0x2b], 0x6c
mov dword [rsp + 0x21], 0x656e7265
mov word [rsp + 0x25], 0x336c
mov byte [rsp + 0x20], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x48
ret

Function at 0x180029c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, r9
mov rbp, r8
mov esi, edx
xor ebx, ebx
call fcn.180029ae0
mov rdi, rax
test rax, rax
je 0x1800296f8
lea rdx, [rsp + 0x20]
mov word [rsp + 0x2c], 0x7845
mov rcx, rax
mov byte [rsp + 0x2e], bl
mov dword [rsp + 0x27], 0x6f6f4874
mov dword [rsp + 0x23], 0x78654e6c
mov word [rsp + 0x21], 0x6c61
mov byte [rsp + 0x2b], 0x6b
mov byte [rsp + 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800296ef
mov r9, r14
mov r8, rbp
mov edx, esi
xor ecx, ecx
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r9, r8
mov r8, rdx
mov edx, ecx
jmp 0x180029670

Function at 0x180029c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x158
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp edx, 1
jne 0x180029cf1
lea rdx, [rsp + 0x30]
call fcn.1800295c0
lea rcx, [rsp + 0x30]
call fcn.180002480
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x26], 0x75732074
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x2c], 0x74726f
mov dword [rsp + 0x21], 0x6174736e
mov word [rsp + 0x2a], 0x7070
mov byte [rsp + 0x20], 0x69
mov byte [rsp + 0x25], 0x6e
call fcn.180028de0
test rax, rax
jne 0x180029d25
lea rdx, [sym.gphelper.dll_HookSetWindowPos]
lea rcx, [0x1800678b8]
call fcn.18002b0e0
test eax, eax
je 0x180029d25
lea rdx, [sym.gphelper.dll_HookSetForegroundWindow]
lea rcx, [0x1800678a0]
call fcn.18002b0e0
test eax, eax
je 0x180029d25
lea rdx, [sym.gphelper.dll_HookSetActiveWindow]
lea rcx, [0x1800678b0]
call fcn.18002b0e0
test eax, eax
je 0x180029d25
lea rdx, [sym.gphelper.dll_HookBringWindowToTop]
lea rcx, [0x1800678a8]
call fcn.18002b0e0
jmp 0x180029d25
test edx, edx
jne 0x180029d25
lea rcx, [0x1800678b8]
call fcn.18002b370
lea rcx, [0x1800678a0]
call fcn.18002b370
lea rcx, [0x1800678b0]
call fcn.18002b370
lea rcx, [0x1800678a8]
call fcn.18002b370
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800025d0
add rsp, 0x158
ret
Function at 0x180029d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, rcx
mov word [rsp + 0x58], 0x4f53
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x5d], 0x5c455241
mov byte [rsp + 0x61], 0
mov word [rsp + 0x5b], 0x5754
mov byte [rsp + 0x5a], 0x46
call fcn.180001bf0
mov r8, rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.180001aa0
mov rcx, rax
call fcn.180001c70
mov rdx, rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.1800294f0
lea rcx, [rsp + 0x40]
movsxd rbx, eax
call fcn.180001be0
lea rcx, [rsp + 0x38]
call fcn.180001be0
test rbx, rbx
jne 0x180029efd
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x104
call fcn.1800043a0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x58]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x5a], 0x736c61
mov qword [rsp + 0x20], rax
mov word [rsp + 0x58], 0x7668
call fcn.1800297d0
test eax, eax
jne 0x180029ef3
cmp dword [rsp + 0x48], eax
jbe 0x180029ef3
lea rcx, [rsp + 0x40]
call fcn.180001c40
mov r8, rdi
mov word [rsp + 0x30], 0x6425
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x32], bl
lea rcx, [rsp + 0x40]
call fcn.180002450
lea rcx, [rsp + 0x38]
call fcn.180001c40
lea r8, [rsp + 0x70]
lea rdx, [0x18003660c]
lea rcx, [rsp + 0x38]
call fcn.180002450
lea rcx, [rsp + 0x40]
call fcn.180001c70
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.180001b60
test eax, eax
js 0x180029edf
mov rcx, qword [rsp + 0x50]
call fcn.180029440
lea rcx, [rsp + 0x38]
call fcn.180001be0
lea rcx, [rsp + 0x40]
call fcn.180001be0
lea eax, [rbx + 1]
jmp 0x180029f06
lea rcx, [rsp + 0x38]
call fcn.180001be0
lea rcx, [rsp + 0x40]
call fcn.180001be0
mov rcx, qword [rsp + 0x50]
call fcn.180029440
mov rcx, rdi
call qword [0x1800678a8]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1800025d0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18002a100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x18003c010]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, rcx
mov dword [rsp + 0x59], 0x5754464f
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x5d], 0x5c455241
mov byte [rsp + 0x58], 0x53
mov byte [rsp + 0x61], 0
call fcn.180001bf0
mov r8, rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.180001aa0
mov rcx, rax
call fcn.180001c70
mov rdx, rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.1800294f0
lea rcx, [rsp + 0x40]
movsxd rbx, eax
call fcn.180001be0
lea rcx, [rsp + 0x38]
call fcn.180001be0
test rbx, rbx
jne 0x18002a2a0
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x104
call fcn.1800043a0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x58]
lea rax, [rsp + 0x70]
mov word [rsp + 0x5b], 0x736c
mov qword [rsp + 0x20], rax
mov word [rsp + 0x58], 0x7668
mov byte [rsp + 0x5d], bl
mov byte [rsp + 0x5a], 0x61
call fcn.1800297d0
test eax, eax
jne 0x18002a296
cmp dword [rsp + 0x48], eax
jbe 0x18002a296
lea rcx, [rsp + 0x40]
call fcn.180001c40
mov r8, rdi
mov word [rsp + 0x31], 0x64
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x30], 0x25
lea rcx, [rsp + 0x40]
call fcn.180002450
lea rcx, [rsp + 0x38]
call fcn.180001c40
lea r8, [rsp + 0x70]
lea rdx, [0x18003660c]
lea rcx, [rsp + 0x38]
call fcn.180002450
lea rcx, [rsp + 0x40]
call fcn.180001c70
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.180001b60
test eax, eax
js 0x18002a282
mov rcx, qword [rsp + 0x50]
call fcn.180029440
lea rcx, [rsp + 0x38]
call fcn.180001be0
lea rcx, [rsp + 0x40]
call fcn.180001be0
lea eax, [rbx + 1]
jmp 0x18002a2a9
lea rcx, [rsp + 0x38]
call fcn.180001be0
lea rcx, [rsp + 0x40]
call fcn.180001be0
mov rcx, qword [rsp + 0x50]
call fcn.180029440
mov rcx, rdi
call qword [0x1800678a0]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1800025d0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret