joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140046590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
movsxd rax, edx
mov rdi, rcx
dec rax
mov qword [r11 + 0x20], rsi
mov rsi, r9
xor r9d, r9d
lea rax, [rcx + rax*2]
mov qword [rsp], rax
cmp rcx, rax
jae 0x1400467a7
mov qword [r11 + 0x18], rbp
lea rbp, [0x140000000]
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
nop
test rsi, rsi
je 0x1400465ee
cmp r8, rsi
jae 0x140046784
movzx edx, byte [r8]
test dl, dl
je 0x140046784
xor ebx, ebx
mov eax, edx
shr rax, 3
mov rcx, rsi
movsx r9, byte [rax + rbp + 0x8b1e0]
test r9d, r9d
sete bl
add ebx, r9d
test rsi, rsi
jne 0x140046622
movsxd rcx, ebx
add rcx, r8
xor r14d, r14d
lea rax, [r8 + 1]
cmp r8, rcx
cmovb r14d, edx
cmp rax, rcx
jae 0x14004663b
movzx r13d, byte [rax]
jmp 0x14004663e
xor r13b, r13b
lea rax, [r8 + 2]
cmp rax, rcx
jae 0x14004664d
movzx r12d, byte [rax]
jmp 0x140046650
xor r12b, r12b
lea rax, [r8 + 3]
cmp rax, rcx
jae 0x14004665f
movzx r15d, byte [rax]
jmp 0x140046662
xor r15b, r15b
lea r10, [r9*4]
movzx eax, r14b
mov ebp, dword [r10 + rbp + 0x8b200]
and ebp, eax
movzx r9d, r13b
shl ebp, 6
mov eax, r9d
and eax, 0x3f
movzx edx, r12b
or ebp, eax
movzx r11d, r15b
shl ebp, 6
and r9d, 0xc0
mov eax, edx
and edx, 0xc0
and eax, 0x3f
or ebp, eax
mov eax, r11d
shr r11d, 2
and eax, 0x3f
or r11d, edx
shl ebp, 6
or ebp, eax
shr r11d, 2
or r11d, r9d
lea rax, [0x140000000]
mov ecx, dword [r10 + rax + 0x8b230]
shr r11d, 2
shr ebp, cl
mov ecx, 0x100
cmp ebp, dword [r10 + rax + 0x8b218]
sbb eax, eax
xor r9d, r9d
and eax, 0x40
mov edx, r9d
or r11d, eax
mov eax, ebp
and eax, 0xfffff800
cmp eax, 0xd800
mov eax, 0x80
cmove edx, eax
mov eax, r9d
or r11d, edx
cmp ebp, 0xffff
cmova eax, ecx
lea rcx, [0x140000000]
mov ecx, dword [r10 + rcx + 0x8b248]
or r11d, eax
xor r11d, 0x2a
sar r11d, cl
test r11d, r11d
je 0x140046766
test r15b, r15b
mov eax, r9d
mov ecx, r9d
mov ebp, 0xfffd
setne cl
test r12b, r12b
setne al
add ecx, eax
mov eax, r9d
test r13b, r13b
setne al
add ecx, eax
mov eax, r9d
test r14b, r14b
setne al
add ecx, eax
cmp ebx, ecx
cmovl ecx, ebx
mov ebx, ecx
mov word [rdi], bp
add rdi, 2
movsxd rax, ebx
lea rbp, [0x140000000]
add r8, rax
cmp rdi, qword [rsp]
jb 0x1400465e0
mov rcx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x10]
mov r14, qword [rsp + 0x18]
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov word [rdi], r9w
test rax, rax
je 0x1400467bd
mov qword [rax], r8
sub rdi, rcx
sar rdi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1400489c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6008], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x140048a43
xor edx, edx
add rcx, 0x6010
call fcn.140058120
mov r8, rsi
lea rcx, [rbx + 0x6010]
mov rdx, rbp
call fcn.140057740
mov eax, dword [rbx + 0x6010]
xor edx, edx
mov r9, qword [rbx + 0x6008]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x6018]
cmove ecx, edx
test rax, rax
movsxd r8, ecx
mov edx, 1
lea rcx, [0x14009e2c0]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x140048a4f
add rcx, 0x6010
call fcn.140057740
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140051560
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x14009e2b8]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x5f64], ecx
test rbx, rbx
je 0x1400515cf
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.1400515e0
lea rdx, [0x14008c26c]
mov rcx, rbx
mov rdi, rax
call fcn.140045250
mov rbx, rax
test rax, rax
je 0x1400515ca
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x14006a650
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
call fcn.140044220
test rax, rax
je 0x14006a66e
call fcn.140044600
mov rbx, qword [rax + 0x88]
jmp 0x14006a670
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x14006a69b
mov dword [rbx + 0x2c], eax
add rsp, 0x20
pop rbx
ret

Function at 0x140082670
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 7
syscall
ret

Function at 0x14008277c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400827b6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400827bb
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140082804
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400911f0]
cmp byte [rcx + rax], 0
je 0x140082804
dec r8
sub rdx, 1
jne 0x1400827ea
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140083bc8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140083c12
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140083c12
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140083c12
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140083c12
cmp dword [rcx + 0x84], 0xe
jbe 0x140083c12
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140083c14
xor al, al
add rsp, 0x28
ret
Function at 0x140028a5c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001bef8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001bef8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140028bac
cmp rax, 0xffffffffffffffff
je 0x140028bac
xor edi, edi
test rbp, rbp
jle 0x140028b57
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001eb84
mov rbx, rax
test rax, rax
jne 0x140028ae4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140028b4d
mov edx, 0x8000
mov ecx, r14d
call fcn.1400197a0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001cbe0
cmp eax, 0xffffffff
je 0x140028b2d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140028af4
mov edx, r15d
mov ecx, r14d
call fcn.1400197a0
jmp 0x140028b4d
cmp byte [rsi + 0x38], dil
je 0x140028b44
cmp dword [rsi + 0x34], 5
jne 0x140028b44
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140028b4d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001a0e4
jmp 0x140028bc0
jns 0x140028bc0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001bef8
cmp rax, 0xffffffffffffffff
jne 0x140028b78
cmp byte [rsi + 0x30], dil
je 0x140028bc0
mov edi, dword [rsi + 0x2c]
jmp 0x140028bc0
mov ecx, r14d
call fcn.1400182d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140028bc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140028bc0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140028bb9
mov eax, dword [rsi + 0x2c]
jmp 0x140028bbe
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001bef8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140029cb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140029cd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140029cd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x100411cd0
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword cs:[rbx + 0x2e]
adc ah, byte cs:[rdi]
add ch, byte [rax - 3]
pop rsi
Function at 0x140005b30
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140005b99
movzx eax, word [rsp + 0x20]
cmp al, 1
jne 0x140005b93
shr ax, 8
cmp al, 1
jne 0x140005b93
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140007800
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140007800
add rsp, 0x1d8
ret

Function at 0x140005be0
Capabilities:
Resolve dns

Disassembly:
push rbx
push r14
sub rsp, 0x58
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, rcx
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x140005c25
cmp word [rax + 0x10], 2
jne 0x140005c25
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
mov dword [r14], eax
xor eax, eax
jmp 0x140005cd9
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x50], rsi
xor esi, esi
mov qword [rsp + 0x48], rdi
mov ebp, esi
mov qword [rsp + 0x40], r15
mov edi, esi
mov dword [rsp + 0x28], 0
lea r15d, [rsi + 0x2e]
nop
lea rdx, [rbx + 1]
mov qword [rsp + 0x20], rdx
cmp byte [rbx], 0x30
je 0x140005c93
mov r8d, 0xa
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
cmp eax, 0xff
ja 0x140005cbb
mov rdx, qword [rsp + 0x20]
cmp rdx, rbx
je 0x140005cbb
mov rcx, rdx
sub rcx, rbx
cmp rcx, 3
jg 0x140005cbb
mov byte [rsp + rdi + 0x28], al
movsx eax, byte [rdx]
cmp ebp, 3
mov ecx, esi
cmovl ecx, r15d
cmp eax, ecx
jne 0x140005cbb
inc ebp
lea rbx, [rdx + 1]
inc rdi
cmp rdi, 4
jl 0x140005c50
mov eax, dword [rsp + 0x28]
mov dword [r14], eax
jmp 0x140005cc0
mov esi, 0xffffffff
mov r15, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140007800
add rsp, 0x58
pop r14
pop rbx
ret
Function at 0x1400064f0
Capabilities:
Execute command

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rdx, [rsp + 0x20]
call fcn.140005780
test eax, eax
jle 0x140006620
mov qword [rsp + 0x50], rbx
nop dword [rax]
mov ecx, dword [rsp + 0x20]
sub ecx, 2
je 0x140006541
cmp ecx, 1
jne 0x1400065d0
mov rcx, qword [rsp + 0x38]
call fcn.140005ee0
jmp 0x1400065d0
lea rcx, [0x1400094e8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140009538]
call fcn.140005dc0
lea rcx, str._______________________________________________n
call fcn.140005dc0
lea rcx, str.______________________________________________n
call fcn.140005dc0
lea rcx, str._________________________________________________n
call fcn.140005dc0
lea rcx, str.____________________________________________n_n
call fcn.140005dc0
lea r8, str.22:53:06
lea rdx, str.Jun_14_2024
lea rcx, str._OnlineCTR_Client__press_CTRL__C_to_quit__n_Build__s___s__n_n
call fcn.140005dc0
lea rdx, [0x14000c7a0]
lea rcx, str._Welcome_to_OnlineCTR__s__n
call fcn.140005dc0
lea rcx, str._nClient:_Connection_Dropped__Server_Full_or_Server_Offline_...
call fcn.140005dc0
mov rax, qword [0x14000c810]
mov dword [rax], 0xffffffff
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140006606
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x1400065e8
mov rcx, rbx
call rax
test byte [rbx + 8], 4
jne 0x1400065fd
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400065fd
call qword [0x14000c0c8]
mov rcx, rbx
call qword [0x14000c0c8]
xor r8d, r8d
lea rdx, [rsp + 0x20]
call fcn.140005780
test eax, eax
jg 0x140006520
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140007800
add rsp, 0x58
ret
Function at 0x14000828c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400082d6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400082d6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400082d6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400082d6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400082d6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400082d8
xor al, al
add rsp, 0x28
ret
Function at 0x18000e4a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180027430]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x6e72654b
mov dword [rsp + 0x25], 0x2e32336c
mov dword [rsp + 0x29], 0x6c6c64
mov byte [rsp + 0x24], 0x65
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180010610
add rsp, 0x48
ret

Function at 0x18000e4f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180027430]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ebx, edx
mov dword [rbp - 0x1d], 0x6f687370
mov dword [rbp - 0x21], 0x616e5332
mov dword [rbp - 0x2b], 0x6f6f5465
mov dword [rbp - 0x30], 0x61657243
mov dword [rbp - 0x26], 0x706c6568
mov word [rbp - 0x19], 0x74
mov byte [rbp - 0x27], 0x6c
mov byte [rbp - 0x2c], 0x74
mov byte [rbp - 0x22], 0x33
call fcn.18000e4a0
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000e564
mov edx, ebx
mov ecx, 4
call rax
jmp 0x18000e568
or rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180010610
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x18000e580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180027430]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x2a], 0x747372
mov word [rsp + 0x23], 0x6165
mov word [rsp + 0x20], 0x6854
mov word [rsp + 0x28], 0x6946
mov word [rsp + 0x25], 0x3364
mov byte [rsp + 0x27], 0x32
mov byte [rsp + 0x22], 0x72
call fcn.18000e4a0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000e5ed
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180010610
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x18000e610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180027430]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x21], 0x61657268
mov dword [rsp + 0x26], 0x654e3233
mov word [rsp + 0x2a], 0x7478
mov byte [rsp + 0x20], 0x54
mov byte [rsp + 0x25], 0x64
mov byte [rsp + 0x2c], 0
call fcn.18000e4a0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000e675
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180010610
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18000e690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180027430]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x26], 0x7274736e
mov dword [rsp + 0x21], 0x6873756c
mov dword [rsp + 0x2f], 0x6361436e
mov dword [rsp + 0x2a], 0x69746375
mov byte [rsp + 0x20], 0x46
mov byte [rsp + 0x25], 0x49
mov word [rsp + 0x33], 0x6568
mov byte [rsp + 0x2e], 0x6f
mov byte [rsp + 0x35], 0
call fcn.18000e4a0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000e70e
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180010610
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x18000e730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180027430]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov dword [rsp + 0x27], 0x6946656c
mov dword [rsp + 0x20], 0x4d746547
mov word [rsp + 0x2f], 0x656d
mov word [rsp + 0x2c], 0x4e65
mov word [rsp + 0x31], 0x41
mov word [rsp + 0x25], 0x7564
mov byte [rsp + 0x24], 0x6f
mov byte [rsp + 0x2e], 0x61
mov byte [rsp + 0x2b], 0x6c
call fcn.18000e4a0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000e7bb
mov r8d, 0x104
mov rdx, rbx
xor ecx, ecx
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180010610
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180010610
add rsp, 0x40
pop rbx
ret

Function at 0x18000e7d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180027430]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov word [rsp + 0x20], 0x6547
mov dword [rsp + 0x27], 0x54746e65
mov dword [rsp + 0x23], 0x72727543
mov dword [rsp + 0x2d], 0x646165
mov word [rsp + 0x2b], 0x7268
mov byte [rsp + 0x22], 0x74
call fcn.18000e4a0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000e83a
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180010610
add rsp, 0x48
ret
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180010610
add rsp, 0x48
ret

Function at 0x18000e850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180027430]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov dword [rsp + 0x28], 0x636f6c6c
mov dword [rsp + 0x24], 0x416c6175
mov dword [rsp + 0x20], 0x74726956
mov byte [rsp + 0x2c], 0
call fcn.18000e4a0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000e8c4
mov edx, 0x78
mov r8d, 0x3000
mov rcx, rbx
lea r9d, [rdx - 0x58]
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180010610
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180010610
add rsp, 0x40
pop rbx
ret
Function at 0x18000e8e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x180027430]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
mov ebp, r9d
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x31], 0x75747269
mov dword [rsp + 0x3c], 0x78457463
mov dword [rsp + 0x38], 0x65746f72
mov byte [rsp + 0x40], 0
mov word [rsp + 0x35], 0x6c61
mov byte [rsp + 0x37], 0x50
mov byte [rsp + 0x30], 0x56
call fcn.18000e4a0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000e967
mov r9d, ebp
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], r14
call rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180010610
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x18000e980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180027430]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov dword [rsp + 0x22], 0x694c6461
mov word [rsp + 0x29], 0x7972
mov word [rsp + 0x26], 0x7262
mov byte [rsp + 0x28], 0x61
mov word [rsp + 0x2b], 0x41
mov word [rsp + 0x20], 0x6f4c
call fcn.18000e4a0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000e9f1
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180010610
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180010610
add rsp, 0x40
pop rbx
ret

Function at 0x18000ea10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180027430]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov dword [rsp + 0x21], 0x75747269
mov word [rsp + 0x29], 0x6565
mov word [rsp + 0x26], 0x466c
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x20], 0x56
mov byte [rsp + 0x25], 0x61
mov byte [rsp + 0x28], 0x72
call fcn.18000e4a0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000ea8a
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180010610
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180010610
add rsp, 0x40
pop rbx
ret

Function at 0x18000eaa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180027430]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x23], 0x33697061
mov dword [rsp + 0x27], 0x6c642e32
mov word [rsp + 0x21], 0x7664
mov byte [rsp + 0x20], 0x41
mov word [rsp + 0x2b], 0x6c
call fcn.18000e980
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180010610
add rsp, 0x48
ret
Function at 0x18000eb00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x180027430]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xa8]
mov rbp, rdx
mov rsi, rcx
mov ebx, 1
call fcn.18000eaa0
mov rdi, rax
test rax, rax
je 0x18000ebab
lea rdx, [rsp + 0x30]
mov rcx, rax
mov word [rsp + 0x35], 0x7265
mov dword [rsp + 0x31], 0x75516765
mov dword [rsp + 0x3d], 0x417845
mov dword [rsp + 0x38], 0x756c6156
mov byte [rsp + 0x30], 0x52
mov byte [rsp + 0x3c], 0x65
mov byte [rsp + 0x37], 0x79
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000eba2
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180010610
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000ebd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180027430]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x80]
mov rsi, rdx
mov ebx, 1
call fcn.18000eaa0
mov rdi, rax
test rax, rax
je 0x18000ec70
lea rdx, [rsp + 0x30]
mov rcx, rax
mov word [rsp + 0x37], 0x654b
mov dword [rsp + 0x39], 0x41784579
mov dword [rsp + 0x32], 0x65704f67
mov word [rsp + 0x30], 0x6552
mov byte [rsp + 0x3d], 0
mov byte [rsp + 0x36], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000ec67
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rbp
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180010610
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x18000ee40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180027430]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x25], 0x642e6970
mov dword [rsp + 0x21], 0x61776c68
mov word [rsp + 0x29], 0x6c6c
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x20], 0x53
call fcn.18000e980
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180010610
add rsp, 0x48
ret