joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c0e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c12e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c12e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c12e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c12e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c12e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000c130
xor al, al
add rsp, 0x28
ret

Function at 0x14000fe58
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fcc3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fcc3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fcc3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fcc3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fcc3
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fcc3
cmp dword [rcx + 0xf8], 0
je 0x14000fcc3
mov ecx, ebx
call fcn.14000fd74
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000fb50
nop
cmp dword [rbp + 0x20], 0
je 0x14000fd11
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000fd1c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fc54
Function at 0x140019268
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400192ef
mov rsi, rbx
cmp word [rax], bp
je 0x1400192ae
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140019298
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140019294
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016a98
mov rdi, rax
test rax, rax
je 0x1400192dc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001fe80
mov rbp, rdi
xor ecx, ecx
call fcn.140015ba8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001b45c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001b472
mov al, 1
jmp 0x14001b4d2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001b483
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001b4d0
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400195b0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b4d0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b4d0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001b4d0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001b4d2
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001f6f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f718
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f718
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140003744
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000378e
mov ecx, GetCurrentProcess
cmp word [rax], cx
jne 0x14000378e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000378e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000378e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000378e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003790
xor al, al
add rsp, 0x28
ret

Function at 0x13bf214
Capabilities:
Encode data using xor

Disassembly:
jmp 0x13bf21e
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x13bf247
pop rbp
sub rbp, 0x33
sub rbp, 0xfbf214
sub rsp, 0x20
jmp 0x13bf266
mov rax, 0xfbf214
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff9ff30969
lahf
xor byte [rax], dl
inc rax
dec rcx
jne 0x13bf285
jmp 0x13bf29c
and eax, esp
and dl, 0xe0
push rbp
imul ebp, dword [rcx + 0x69], 0x61a8e821
push 0x68216969
and byte [rcx], 0xae
test eax, 0x69696965
and dword [rsi + 0x696941ab], ebp
imul esp, dword [rcx], 0x68218b9e
test al, 0xe2
call 0x6aa55c2e
and dword [rax - 0x7f], ebp
cmp dword [rcx], edi
imul esp, dword [rcx], 0x39398168
and ecx, edx
cmc
mov dword [rbp + 0x69], eax
imul ebp, dword [rcx + 0x69], 0x11d02169
js 0x13bf283
imul ebp, dword [rcx + 0x69], 0x68216969
and byte [rcx], 0xd3
push rbp
test dh, dh
add dword [rcx + 0x69], ebp
imul ebp, dword [rcx - 0x7f], 0x6969696c
cmp byte [rdi + 0x69], 0x69
imul ebp, dword [rax + 0x78586b81], 0x6da8e821
imul ebp, dword [rcx + 0x69], 0x66a19621
in al, dx
xchg dword [rsi + 0x31aa9696], edx
xor edi, dword [rbx]
cmp dword [rcx], esp
sal ebp, 1
mov dword [rbp + 0x69], eax
imul ebp, dword [rcx + 0x69], 0x11d02169
js 0x13bf2c8
imul ebp, dword [rcx + 0x69], 0x68216969
add byte [rcx + 0x6969696c], 0x80
in al, 0x6b
imul ebp, dword [rcx + 0x3b], 0x69691481
imul esi, dword [rbx], 0xbee0213e
and dword [rax - 0x60], ebx
and dword [rax - 0x45], ebx
invalid
Function at 0x180001060
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x470
mov rax, qword gs:[0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
add rax, 0x20
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x260]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
jmp 0x1800010e2
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x20], rax
je 0x18000117e
mov rax, qword [rsp + 0x20]
sub rax, 0x10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x260]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x30]
mov r8, qword [rax + 0x50]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.180014998
mov r8, qword [rsp + 0x480]
mov edx, 0x104
lea rcx, [rsp + 0x260]
call fcn.180014998
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x260]
call fcn.180001000
test eax, eax
je 0x180001179
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
jmp 0x180001180
jmp 0x1800010d5
xor eax, eax
add rsp, 0x470
pop rdi
ret
Function at 0x180001190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x18], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x18]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov dword [rsp], 0
jmp 0x18000123f
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x18]
cmp dword [rsp], eax
jae 0x1800012a9
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x18000127d
inc rcx
test dl, dl
jne 0x18000126a
xor eax, eax
jmp 0x180001282
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1800012a7
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
jmp 0x1800012ab
jmp 0x180001237
xor eax, eax
add rsp, 0x48
ret

Function at 0x1800012b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x1800012d8
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp], rax
jae 0x180001335
xor edx, edx
mov rax, qword [rsp]
mov ecx, 8
div rcx
mov rax, rdx
shl rax, 3
movzx ecx, al
mov rax, qword [rsp + 0x30]
shr rax, cl
and rax, 0xff
movsx eax, al
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x20]
add rdx, rcx
mov rcx, rdx
movsx ecx, byte [rcx]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x20]
add rdx, rcx
mov rcx, rdx
mov byte [rcx], al
jmp 0x1800012cd
add rsp, 0x18
ret
Function at 0x180001910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x20], 0x15
mov byte [rsp + 0x28], 0x70
mov byte [rsp + 0x29], 0x77
mov byte [rsp + 0x2a], 0x32
mov byte [rsp + 0x2b], 0xf7
mov byte [rsp + 0x2c], 0x55
mov byte [rsp + 0x2d], 0x48
mov byte [rsp + 0x2e], 0x64
mov byte [rsp + 0x2f], 0x40
mov byte [rsp + 0x30], 0x46
mov byte [rsp + 0x31], 0x6c
mov byte [rsp + 0x32], 0x39
mov byte [rsp + 0x33], 0xe2
mov byte [rsp + 0x34], 0x62
mov byte [rsp + 0x35], 0x66
mov byte [rsp + 0x36], 0x69
mov byte [rsp + 0x37], 0x45
mov byte [rsp + 0x38], 0x56
mov byte [rsp + 0x39], 0x7d
mov byte [rsp + 0x3a], 0x3f
mov byte [rsp + 0x3b], 0xd0
mov byte [rsp + 0x3c], 0x21
mov eax, 0x28
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x180001a23
mov eax, 0x28
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov r8d, 0x28
mov r8d, r8d
mov rcx, qword [rdx + rcx*8]
mov dword [r8 + rcx], eax
mov eax, 0x10
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.180001490
lea rcx, [0x180025800]
call fcn.18000f178
nop
mov eax, 0x10
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x48
ret
Function at 0x180002b10
Capabilities:
Encrypt data using tea

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax]
mov dword [rsp], eax
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax]
mov dword [rsp + 4], eax
mov dword [rsp + 8], 0xe3779b90
mov dword [rsp + 0x10], 0x9e3779b9
mov dword [rsp + 0xc], 0
jmp 0x180002b6b
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
cmp dword [rsp + 0xc], 0x10
jae 0x180002c20
mov eax, dword [rsp]
shl eax, 4
mov ecx, 4
imul rcx, rcx, 2
mov rdx, qword [rsp + 0x38]
add eax, dword [rdx + rcx]
mov ecx, dword [rsp + 8]
mov edx, dword [rsp]
add edx, ecx
mov ecx, edx
xor eax, ecx
mov ecx, dword [rsp]
shr ecx, 5
mov edx, 4
imul rdx, rdx, 3
mov r8, qword [rsp + 0x38]
add ecx, dword [r8 + rdx]
xor eax, ecx
mov ecx, dword [rsp + 4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shl eax, 4
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x38]
add eax, dword [rdx + rcx]
mov ecx, dword [rsp + 8]
mov edx, dword [rsp + 4]
add edx, ecx
mov ecx, edx
xor eax, ecx
mov ecx, dword [rsp + 4]
shr ecx, 5
mov edx, 4
imul rdx, rdx, 1
mov r8, qword [rsp + 0x38]
add ecx, dword [r8 + rdx]
xor eax, ecx
mov ecx, dword [rsp]
sub ecx, eax
mov eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp + 0x10]
mov ecx, dword [rsp + 8]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
jmp 0x180002b61
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov edx, dword [rsp]
mov dword [rcx + rax], edx
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x30]
mov edx, dword [rsp + 4]
mov dword [rcx + rax], edx
add rsp, 0x28
ret

Function at 0x1800038c0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x18000391d
mov eax, 0xffffffff
jmp 0x1800039ac
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x40]
inc eax
mov eax, eax
mov ecx, eax
call fcn.18001516c
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x40]
inc eax
mov eax, eax
mov qword [rsp + 0x58], rax
mov rdi, qword [rsp + 0x50]
xor eax, eax
mov rcx, qword [rsp + 0x58]
rep stosb byte [rdi], al
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180003995
mov eax, 0xffffffff
jmp 0x1800039ac
mov r8d, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x78]
call fcn.180003d80
nop
xor eax, eax
add rsp, 0x60
pop rdi
ret
Function at 0x180004e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x20], 0xe
mov byte [rsp + 0x28], 0x5f
mov byte [rsp + 0x29], 0xa7
mov byte [rsp + 0x2a], 0x25
mov byte [rsp + 0x2b], 0x62
mov byte [rsp + 0x2c], 0x20
mov byte [rsp + 0x2d], 7
mov byte [rsp + 0x2e], 0x37
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x30], 0x7f
mov byte [rsp + 0x31], 0xa0
mov byte [rsp + 0x32], 0x20
mov byte [rsp + 0x33], 0x4a
mov byte [rsp + 0x34], 0x2b
mov byte [rsp + 0x35], 0x73
mov eax, 0xf0
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x180004f70
mov eax, 0xf0
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov r8d, 0xf0
mov r8d, r8d
mov rcx, qword [rdx + rcx*8]
mov dword [r8 + rcx], eax
mov eax, 0xe0
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.180001570
lea rcx, [0x180025980]
call fcn.18000f178
nop
mov eax, 0xe0
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x48
ret

Function at 0x1800053f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x20], 0x11
mov byte [rsp + 0x28], 0x6f
mov byte [rsp + 0x29], 0xe1
mov byte [rsp + 0x2a], 0xef
mov byte [rsp + 0x2b], 0x27
mov byte [rsp + 0x2c], 0x88
mov byte [rsp + 0x2d], 9
mov byte [rsp + 0x2e], 0x68
mov byte [rsp + 0x2f], 0x61
mov byte [rsp + 0x30], 0x75
mov byte [rsp + 0x31], 0xf0
mov byte [rsp + 0x32], 0xea
mov byte [rsp + 0x33], 0x22
mov byte [rsp + 0x34], 0xa2
mov byte [rsp + 0x35], 0xa
mov byte [rsp + 0x36], 0x79
mov byte [rsp + 0x37], 0x4e
mov byte [rsp + 0x38], 0x27
mov eax, 0x204
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x1800054ef
mov eax, 0x204
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov r8d, 0x204
mov r8d, r8d
mov rcx, qword [rdx + rcx*8]
mov dword [r8 + rcx], eax
mov eax, 0x1f0
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.1800013b0
lea rcx, [0x180025a70]
call fcn.18000f178
nop
mov eax, 0x1f0
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x48
ret
Function at 0x180005f70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x20], 0x11
mov byte [rsp + 0x28], 0x2e
mov byte [rsp + 0x29], 0x1b
mov byte [rsp + 0x2a], 0xb
mov byte [rsp + 0x2b], 0x6a
mov byte [rsp + 0x2c], 0x99
mov byte [rsp + 0x2d], 0xcf
mov byte [rsp + 0x2e], 0x64
mov byte [rsp + 0x2f], 0x6d
mov byte [rsp + 0x30], 0x35
mov byte [rsp + 0x31], 0x10
mov byte [rsp + 0x32], 0x1e
mov byte [rsp + 0x33], 0x6b
mov byte [rsp + 0x34], 0xad
mov byte [rsp + 0x35], 0xc8
mov byte [rsp + 0x36], 0x6d
mov byte [rsp + 0x37], 0x7c
mov byte [rsp + 0x38], 0x67
mov eax, 0x284
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x18000606f
mov eax, 0x284
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov r8d, 0x284
mov r8d, r8d
mov rcx, qword [rdx + rcx*8]
mov dword [r8 + rcx], eax
mov eax, 0x270
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.1800013b0
lea rcx, [0x180025c50]
call fcn.18000f178
nop
mov eax, 0x270
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x48
ret
Function at 0x1800090f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov dword [rsp], 0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov qword [rsp + 8], 0
mov rax, qword [rsp + 0x10]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18000912b
jmp 0x180009180
mov rax, qword [rsp + 0x10]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x180009155
jmp 0x180009180
mov rax, qword [rsp + 8]
movzx eax, word [rax + 4]
cmp eax, 0x8664
jne 0x180009179
mov rax, qword [rsp + 8]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x180009179
jmp 0x180009180
mov dword [rsp], 1
mov eax, dword [rsp]
add rsp, 0x28
ret
Function at 0x18000bcd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x20], 0x15
mov byte [rsp + 0x28], 0x82
mov byte [rsp + 0x29], 0xbd
mov byte [rsp + 0x2a], 6
mov byte [rsp + 0x2b], 0x6b
mov byte [rsp + 0x2c], 4
mov byte [rsp + 0x2d], 9
mov byte [rsp + 0x2e], 0x44
mov byte [rsp + 0x2f], 0x1a
mov byte [rsp + 0x30], 0xa8
mov byte [rsp + 0x31], 0xbe
mov byte [rsp + 0x32], 0x1b
mov byte [rsp + 0x33], 0x70
mov byte [rsp + 0x34], 0x36
mov byte [rsp + 0x35], 0x11
mov byte [rsp + 0x36], 0x68
mov byte [rsp + 0x37], 0xb
mov byte [rsp + 0x38], 0xb0
mov byte [rsp + 0x39], 0xa2
mov byte [rsp + 0x3a], 0x2c
mov byte [rsp + 0x3b], 0x71
mov byte [rsp + 0x3c], 0x65
mov eax, 0x420
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x18000bde3
mov eax, 0x420
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov r8d, 0x420
mov r8d, r8d
mov rcx, qword [rdx + rcx*8]
mov dword [r8 + rcx], eax
mov eax, 0x408
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.180001490
lea rcx, [0x180025e90]
call fcn.18000f178
nop
mov eax, 0x408
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x48
ret

Function at 0x18000be10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x20], 0x15
mov byte [rsp + 0x28], 0x9e
mov byte [rsp + 0x29], 0x3c
mov byte [rsp + 0x2a], 0x37
mov byte [rsp + 0x2b], 0xfa
mov byte [rsp + 0x2c], 0x11
mov byte [rsp + 0x2d], 0x3d
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0xc6
mov byte [rsp + 0x30], 0xa8
mov byte [rsp + 0x31], 0x2d
mov byte [rsp + 0x32], 0
mov byte [rsp + 0x33], 0xe3
mov byte [rsp + 0x34], 0
mov byte [rsp + 0x35], 0xa
mov byte [rsp + 0x36], 0x7a
mov byte [rsp + 0x37], 0xc5
mov byte [rsp + 0x38], 0xa8
mov byte [rsp + 0x39], 0x2f
mov byte [rsp + 0x3a], 0x30
mov byte [rsp + 0x3b], 0xd8
mov byte [rsp + 0x3c], 0x61
mov eax, 0x358
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x18000bf23
mov eax, 0x358
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov r8d, 0x358
mov r8d, r8d
mov rcx, qword [rdx + rcx*8]
mov dword [r8 + rcx], eax
mov eax, 0x340
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.180001490
lea rcx, [0x180025ec0]
call fcn.18000f178
nop
mov eax, 0x340
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x48
ret
Function at 0x18000bf50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x20], 0x16
mov byte [rsp + 0x28], 0x46
mov byte [rsp + 0x29], 0xb2
mov byte [rsp + 0x2a], 0xef
mov byte [rsp + 0x2b], 0x70
mov byte [rsp + 0x2c], 0xb5
mov byte [rsp + 0x2d], 0xe1
mov byte [rsp + 0x2e], 0x56
mov byte [rsp + 0x2f], 0x64
mov byte [rsp + 0x30], 0x7b
mov byte [rsp + 0x31], 0xa2
mov byte [rsp + 0x32], 0xf6
mov byte [rsp + 0x33], 0x41
mov byte [rsp + 0x34], 0xa0
mov byte [rsp + 0x35], 0xd3
mov byte [rsp + 0x36], 0x56
mov byte [rsp + 0x37], 0x42
mov byte [rsp + 0x38], 0x70
mov byte [rsp + 0x39], 0x9e
mov byte [rsp + 0x3a], 0xf5
mov byte [rsp + 0x3b], 0x63
mov byte [rsp + 0x3c], 0xaa
mov byte [rsp + 0x3d], 0xa5
mov eax, 0x378
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x18000c068
mov eax, 0x378
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
mov r8d, 0x378
mov r8d, r8d
mov rcx, qword [rdx + rcx*8]
mov dword [r8 + rcx], eax
mov eax, 0x360
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.18000b670
lea rcx, [0x180025ef0]
call fcn.18000f178
nop
mov eax, 0x360
mov eax, eax
mov ecx, dword [0x180038fd8]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x48
ret