joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180030370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0xb8
movzx eax, word [0x180146340]
mov qword [rsp + 0x60], rax
mov byte [rsp], 0x18
mov rax, qword [0x180146330]
mov word [rsp + 0xc], ax
movzx eax, byte [0x180146308]
mov byte [rsp + 1], al
mov dword [rsp + 0x34], 0xf5112c5d
movzx eax, byte [0x1801461ce]
mov byte [rsp + 2], al
mov byte [rsp + 3], 0x36
movzx eax, byte [0x18014630c]
mov byte [rsp + 4], al
mov dword [rsp + 0x38], 0xa42c
mov dword [rsp + 0x3c], 0x34
movzx eax, word [0x180146344]
mov qword [rsp + 0x68], rax
mov eax, 0x158f
mov word [rsp + 0x10], ax
mov rax, qword [0x1801462c0]
mov qword [rsp + 0x70], rax
movzx eax, word [0x18014632c]
mov word [rsp + 0x14], ax
movzx eax, byte [str.EThe_server_respons]
movsx ax, al
mov word [rsp + 0x18], ax
mov eax, 0xccf4
mov word [rsp + 0x1c], ax
mov dword [rsp + 0x40], 0x18c4
mov byte [rsp + 5], 0x24
movzx eax, word [0x180146310]
mov word [rsp + 0x20], ax
movsxd rax, dword [0x18014632c]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 0x7ff0
mov dword [rsp + 0x44], 0x951c
mov byte [rsp + 6], 0x6b
mov dword [rsp + 0x48], 0x5d
mov dword [rsp + 0x4c], 0x76
mov rax, qword [0x1801462f0]
mov word [rsp + 0x24], ax
movzx eax, word [0x180146344]
mov qword [rsp + 0x88], rax
mov byte [rsp + 7], 0x6b
movzx eax, word [0x1801462d4]
movzx eax, ax
mov qword [rsp + 0x90], rax
mov eax, 0xffff8c7c
mov word [rsp + 0x28], ax
mov dword [rsp + 0x50], 0x88
mov dword [rsp + 0x54], 0xb230
movzx eax, word [0x180146324]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x58], 0x91
mov eax, dword [0x180146320]
mov word [rsp + 0x2c], ax
mov dword [rsp + 0x5c], 0x45
movzx eax, byte [0x180146344]
mov byte [rsp + 8], al
mov eax, 0x495b
mov word [rsp + 0x30], ax
movzx eax, word [0x1801462e4]
movsx rax, ax
mov qword [rsp + 0xa0], rax
mov eax, dword [0x180146328]
movabs rcx, 0xce7705a2975c
imul rax, rcx
mov word [0x1801462d4], ax
mov eax, dword [rsp + 0x34]
mov eax, eax
mov rcx, qword [0x1801462c8]
imul rcx, rax
mov rax, rcx
mov qword [0x1801462c8], rax
mov eax, dword [rsp + 0x60]
add rsp, 0xb8
ret
Function at 0x180030890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0xa8
mov eax, 0x59a8
mov word [rsp + 0xc], ax
mov rax, qword [0x1801462d8]
mov qword [rsp + 0x68], rax
movzx eax, word [0x180146324]
mov qword [rsp + 0x70], rax
movzx eax, byte [0x18014619a]
mov byte [rsp + 1], al
mov rax, qword [0x1801462b8]
mov word [rsp + 0x10], ax
movzx eax, byte [0x180146199]
movzx eax, al
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], 0xb1
movzx eax, word [0x180146344]
mov word [rsp + 0x14], ax
mov eax, 0xc5
mov word [rsp + 0x18], ax
movzx eax, word [0x18014628c]
mov word [rsp + 0x1c], ax
mov byte [rsp + 2], 0xd0
movzx eax, byte [0x1801461b3]
movzx eax, al
mov dword [rsp + 0x48], eax
movzx eax, byte [0x1801461f6]
movsx rax, al
mov qword [rsp + 0x78], rax
mov eax, 0x65
mov word [rsp + 0x20], ax
movzx eax, word [0x18014631c]
mov word [rsp + 0x24], ax
mov dword [rsp + 0x54], 0x91be
mov eax, dword [0x18014631c]
mov dword [rsp + 0x58], eax
mov byte [rsp], 0xb1
movzx eax, word [0x180146308]
mov word [rsp + 0x28], ax
mov qword [rsp + 0x80], 0x69
mov eax, 0x227d
mov word [rsp + 0x2c], ax
movzx eax, word [0x1801462f8]
mov word [rsp + 0x30], ax
movzx eax, byte [0x1801461f6]
movsx ax, al
mov word [rsp + 0x34], ax
mov qword [rsp + 0x88], 0xe0b6
mov eax, dword [0x1801462e8]
mov word [rsp + 0x38], ax
movzx eax, byte [0x1801461ce]
mov byte [rsp + 3], al
mov eax, dword [0x18014633c]
mov dword [rsp + 0x5c], eax
movzx eax, byte [0x1801461b7]
movsx ax, al
mov word [rsp + 0x3c], ax
movzx eax, byte [0x1801462d0]
mov byte [rsp + 4], al
mov qword [rsp + 0x90], 0x10
mov byte [rsp + 5], 0xca
movzx eax, byte [0x1801461cc]
mov byte [rsp + 6], al
mov eax, 0x7fef
mov word [rsp + 0x40], ax
movzx eax, byte [0x180146199]
movzx eax, al
mov word [rsp + 8], ax
movzx eax, byte [0x1801461b3]
mov byte [rsp + 7], al
mov qword [rsp + 0x98], 0x163f4618
mov dword [rsp + 0x60], 0x49acc9ff
mov rax, qword [0x1801462c8]
mov word [rsp + 0x44], ax
movzx eax, byte [0x18014619a]
mov dword [rsp + 0x64], eax
movzx eax, word [0x180146340]
shl eax, 5
mov word [0x1801461cc], ax
mov byte [rsp], 0x40
movzx eax, word [0x180146310]
add eax, 0xad10
mov byte [0x1801461b3], al
movzx eax, word [0x18041ecc0]
mov word [0x1801461cc], ax
mov dword [rsp + 0x48], 8
mov eax, dword [rsp + 0x4c]
xor eax, 0x35
mov eax, eax
mov qword [0x1801462c0], rax
movzx eax, word [rsp + 8]
cwde
add rsp, 0xa8
ret
Function at 0x1800413f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0xd8
mov rax, qword [0x180146498]
mov qword [rsp + 0x98], rax
mov rax, qword [str._buAG]
mov word [rsp + 0x30], ax
movzx eax, word [0x1801463d4]
mov word [rsp + 0x34], ax
movzx eax, byte [0x1801463bf]
movzx eax, al
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x50], 0xf
mov eax, 0xffff89af
mov word [rsp + 0x2c], ax
mov eax, 0xffffe9e0
mov word [rsp + 0x38], ax
movzx eax, byte [0x180146494]
mov byte [rsp + 0x24], al
mov eax, 0xa0dd
mov word [rsp + 0x20], ax
movzx eax, byte [0x1801463f6]
mov word [rsp + 0x3c], ax
mov qword [rsp + 0xb0], 0x9da0
mov eax, 0x2d4c
mov word [rsp + 0x40], ax
mov eax, dword [0x180146490]
cdqe
mov qword [rsp + 0xb8], rax
mov eax, dword [0x180146464]
mov dword [rsp + 0x54], eax
mov rax, qword [0x1801464a0]
mov dword [rsp + 0x58], eax
mov rax, qword [0x1801464e8]
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], 0xebb8
movzx eax, byte [0x18014636a]
movzx eax, al
mov dword [rsp + 0x64], eax
movzx eax, byte [0x1801463f6]
mov byte [rsp + 0x25], al
movzx eax, word [0x1801464fc]
mov qword [rsp + 0xc0], rax
movzx eax, word [0x1801463d4]
mov byte [rsp + 0x26], al
mov eax, dword [0x180146498]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], 0x1060c70
movsx ax, byte [0x18014636b]
mov word [rsp + 0x44], ax
mov qword [rsp + 0xc8], 0x5b89863e
movzx eax, word [0x1801464e0]
cwde
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], 0xe22b06f2
mov dword [rsp + 0x78], 0xc3
mov dword [rsp + 0x7c], 0x81
mov byte [rsp + 0x27], 0x25
mov eax, 0xe8
mov word [rsp + 0x48], ax
mov byte [rsp + 0x28], 0xab
mov dword [rsp + 0x80], 0xf9a4
movzx eax, word [0x1801463d4]
cwde
mov dword [rsp + 0x84], eax
mov byte [rsp + 0x29], 0x96
mov eax, 0x47d
mov word [rsp + 0x4c], ax
mov byte [rsp + 0x2a], 3
movsx eax, word [0x180146478]
mov dword [rsp + 0x88], eax
movzx eax, byte [0x18014636f]
mov byte [rsp + 0x2b], al
movzx eax, byte [0x180146369]
movzx eax, al
cmp rax, qword [0x1801464f0]
jg 0x1800415f0
lea rax, [rsp + 0xa0]
lea rcx, str.swprintf_s
mov rdi, rax
mov rsi, rcx
mov ecx, 0xb
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov word [0x1801464e0], ax
movzx eax, word [0x1801464d0]
cwde
test eax, eax
je 0x180041626
mov rax, qword [0x180146470]
movabs rcx, 0x3562f038af02b
sub rax, rcx
mov qword [0x1801464f0], rax
mov eax, dword [0x18064fd50]
mov qword [0x1801464a0], rax
jmp 0x180041643
movabs rax, 0xd668a718bdb51
xor ecx, ecx
cmp rcx, rax
je 0x180041643
mov eax, 0x79
mov word [0x1801464d0], ax
mov rax, qword [0x180146470]
mov ecx, 0xa7fa54fa
sub rax, rcx
mov dword [0x1801464d4], eax
movzx eax, word [rsp + 0x20]
movzx ecx, word [rsp + 0x2c]
movsx ecx, cx
sub eax, ecx
movzx ecx, word [rsp + 0x20]
add ecx, eax
mov eax, ecx
mov word [rsp + 0x20], ax
movsxd rax, dword [0x18014647c]
sub rax, qword [rsp + 0x90]
mov dword [0x18014647c], eax
mov rax, qword [rsp + 0x98]
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x1800419e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0xb8
mov dword [rsp + 0x40], 0xff4f9948
movzx eax, word [0x180146480]
mov word [rsp + 0x10], ax
mov eax, 0x81
mov word [rsp + 0xc], ax
movzx eax, byte [0x1801463d3]
mov qword [rsp + 0x58], rax
movzx eax, byte [0x18014636a]
mov byte [rsp + 2], al
mov eax, 0xffffa2d1
mov word [rsp + 0x14], ax
mov rax, qword [0x180146488]
mov byte [rsp], al
mov qword [rsp + 0x60], 0x27de
mov rax, qword [0x1801464b0]
mov qword [rsp + 0x68], rax
movzx eax, word [0x180146404]
mov word [rsp + 0x18], ax
mov dword [rsp + 0x44], 0x8fb24759
mov rax, qword [0x1801464b0]
mov qword [rsp + 0x70], rax
movzx eax, word [0x1801464d0]
mov byte [rsp + 3], al
mov dword [rsp + 0x3c], 0xd783
mov byte [rsp + 1], 0x96
mov qword [rsp + 0x78], 0x3a17
mov dword [rsp + 0x38], 0x40b75c1
mov qword [rsp + 0x80], 0x5aaec5e9
mov rax, qword [0x180146488]
mov dword [rsp + 0x48], eax
mov byte [rsp + 4], 0xb
mov byte [rsp + 5], 0xfd
mov byte [rsp + 6], 0xe1
mov dword [rsp + 0x4c], 0x42
mov eax, dword [0x1801464f0]
mov dword [rsp + 0x50], eax
movsxd rax, dword [0x18014647c]
mov qword [rsp + 0x88], rax
mov rax, qword [0x1801464a8]
mov byte [rsp + 7], al
mov eax, 0xe147
mov word [rsp + 0x1c], ax
mov rax, qword [0x1801464e8]
mov qword [rsp + 0x90], rax
mov byte [rsp + 8], 0x21
mov rax, qword [0x1801464b0]
mov qword [rsp + 0x98], rax
mov eax, 0x38fa
mov word [rsp + 0x20], ax
mov eax, 0xffffaa4d
mov word [rsp + 0x24], ax
mov dword [rsp + 0x54], 0x38b21c93
movzx eax, byte [0x1801463d7]
mov word [rsp + 0x28], ax
mov qword [rsp + 0xa0], 0x6e5cc5ce
movzx eax, word [0x1801464c8]
mov word [rsp + 0x2c], ax
mov qword [rsp + 0xa8], 0xb2
mov eax, 0xffff9ffa
mov word [rsp + 0x30], ax
mov eax, 0xf3c9
mov word [rsp + 0x34], ax
mov eax, dword [rsp + 0x38]
movzx ecx, word [rsp + 0xc]
movzx ecx, cx
cmp eax, ecx
ja 0x180041bab
mov eax, dword [rsp + 0x3c]
shl eax, 2
mov byte [rsp], al
mov rax, qword [0x1801464f0]
shl rax, 2
mov word [0x180146478], ax
mov qword [0x180146468], 8
movsx eax, byte [rsp + 1]
add rsp, 0xb8
ret
Function at 0x18004b9e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [rsp + 0x20], r9w
mov word [rsp + 0x18], r8w
mov word [rsp + 0x10], dx
mov word [rsp + 8], cx
sub rsp, 0xa8
movzx eax, word [0x18014667c]
mov word [rsp + 0x3c], ax
mov rax, qword [0x1801466c8]
mov qword [rsp + 0x78], rax
movzx eax, byte [0x180146664]
mov byte [rsp + 1], al
mov dword [rsp + 0x58], 0xc803
mov dword [rsp + 0xc], 0x547e3aa7
movzx eax, byte [0x180146553]
mov byte [rsp], al
mov eax, dword [0x1801466c4]
mov eax, eax
mov qword [rsp + 0x80], rax
mov byte [rsp + 2], 0xb3
mov qword [rsp + 0x88], 0x49dee2b7
mov eax, 0xffff8292
mov word [rsp + 0x40], ax
mov rax, qword [0x180146620]
mov qword [rsp + 0x90], rax
mov byte [rsp + 3], 0xf3
movsx eax, word [0x180146634]
mov dword [rsp + 0x54], eax
mov byte [rsp + 4], 0xa
movzx eax, byte [0x18014653a]
movzx eax, al
mov word [rsp + 0x44], ax
mov eax, dword [0x18014668c]
mov dword [rsp + 0x50], eax
mov eax, 0x3919
mov word [rsp + 0x48], ax
mov eax, 0x4082
mov word [rsp + 0x4c], ax
movzx eax, byte [0x180146553]
mov byte [rsp + 5], al
mov qword [rsp + 0x98], 0x2d6a
movsx eax, word [0x180146634]
mov dword [rsp + 0x5c], eax
mov rax, qword [0x180146668]
mov dword [rsp + 0x18], eax
mov eax, dword [0x18014662c]
mov dword [rsp + 0x1c], eax
movsx eax, word [0x1801466c0]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], 0x184f
movzx eax, byte [0x18014653f]
mov byte [rsp + 6], al
movzx eax, word [0x180146638]
mov word [rsp + 0x20], ax
mov eax, 0x22ac
mov word [rsp + 0x24], ax
movsx eax, word [0x180146698]
mov dword [rsp + 0x68], eax
mov byte [rsp + 7], 0x2c
mov eax, 0x18e
mov word [rsp + 0x28], ax
mov rax, qword [0x180146650]
mov byte [rsp + 8], al
movzx eax, word [0x1801466b8]
mov word [rsp + 0x2c], ax
movzx eax, byte [str.EIapi_ms_win_core_st]
mov byte [rsp + 9], al
mov eax, dword [0x180146620]
mov dword [rsp + 0x6c], eax
movsx eax, word [0x180146634]
mov dword [rsp + 0x70], eax
mov eax, 0xffffd0f5
mov word [rsp + 0x30], ax
mov eax, 0x33c7
mov word [rsp + 0x34], ax
movzx eax, word [0x1801466b0]
mov word [rsp + 0x38], ax
movzx eax, byte [0x180146526]
movsx eax, al
cmp dword [rsp + 0xc], eax
jl 0x18004bbac
mov dword [rsp + 0x14], 1
jmp 0x18004bbb4
mov dword [rsp + 0x14], 0
cmp dword [rsp + 0xc], 0x27
jl 0x18004bbc5
mov dword [rsp + 0x10], 1
jmp 0x18004bbcd
mov dword [rsp + 0x10], 0
mov eax, dword [rsp + 0x10]
cmp dword [rsp + 0x14], eax
jne 0x18004bbe7
mov rax, qword [0x180146650]
mov qword [0x180146670], rax
jmp 0x18004bc06
movzx eax, byte [rsp]
movzx eax, al
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
cdqe
imul rax, qword [0x180146690]
mov dword [0x180146554], eax
movsx eax, byte [0x18014653b]
add eax, 0x9782
mov dword [rsp + 0x1c], eax
imul eax, dword [rsp + 0x54], 0x7e3a
cdqe
mov rcx, qword [0x180146670]
sub rcx, rax
mov rax, rcx
mov qword [0x180146670], rax
movzx eax, word [0x18014669c]
cwde
shl eax, 8
mov byte [0x180146553], al
mov dword [rsp + 0x18], 2
mov eax, 4
imul rax, rax, 0x725b
lea rcx, [0x1807c66e0]
mov eax, dword [rcx + rax]
mov dword [rsp + 0x18], eax
movzx eax, word [rsp + 0x1c]
add rsp, 0xa8
ret
Function at 0x18004c1d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0xf
mov byte [rsp + 0x30], 0x66
mov byte [rsp + 0x31], 0xc6
mov byte [rsp + 0x32], 0xdf
mov byte [rsp + 0x33], 0x5b
mov byte [rsp + 0x34], 0x53
mov byte [rsp + 0x35], 0xcc
mov byte [rsp + 0x36], 0x48
mov byte [rsp + 0x37], 0x42
mov byte [rsp + 0x38], 0x45
mov byte [rsp + 0x39], 0x66
mov byte [rsp + 0x3a], 0x53
mov byte [rsp + 0x3b], 0xe6
mov byte [rsp + 0x3c], 0x52
mov byte [rsp + 0x3d], 0xd0
mov byte [rsp + 0x3e], 0xab
mov eax, 0x658
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x18004c2ca
mov eax, 0x658
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x181b8e144]
mov rcx, qword gs:[0x58]
mov edx, 0x658
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x648
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180028f40
lea rcx, [0x18010e4d0]
call fcn.1800f9df4
nop
mov eax, 0x648
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x48
ret
Function at 0x18004dde0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [rsp + 0x10], dx
mov word [rsp + 8], cx
sub rsp, 0xb8
movzx eax, byte [0x180146724]
mov byte [rsp + 8], al
mov byte [rsp + 9], 0xcd
mov byte [rsp + 0xa], 0x64
mov eax, 0xe8
mov word [rsp + 0x44], ax
movabs rax, 0xd2bca93caecd8
mov qword [rsp + 0x78], rax
movabs rax, 0x70e768abdb0e2
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x50], 0x86
movzx eax, byte [0x1801466f3]
mov byte [rsp + 0xb], al
movzx eax, word [0x180146858]
mov word [rsp + 0x48], ax
mov rax, qword [0x180146850]
mov word [rsp + 0x1c], ax
movsx ax, byte [0x18014670b]
mov word [rsp + 0x20], ax
mov eax, dword [0x18014684c]
mov dword [rsp + 0x4c], eax
movzx eax, byte [0x180146722]
movsx eax, al
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], 0xc9927a5f
mov eax, 0x8f7d
mov word [rsp + 4], ax
mov rax, qword [0x180146828]
mov byte [rsp + 0xc], al
movsx ax, byte [0x180146727]
mov word [rsp + 0x24], ax
movzx eax, word [0x18014685c]
cwde
mov dword [rsp + 0x14], eax
mov rax, qword [0x1801467e0]
mov word [rsp + 0x28], ax
mov dword [rsp + 0x5c], 0x9c5a8e90
movzx eax, byte [0x180146763]
movzx eax, al
mov word [rsp + 0x2c], ax
mov eax, 0x5d58
mov word [rsp + 0x30], ax
mov byte [rsp], 0xd0
mov rax, qword [0x180146850]
mov qword [rsp + 0x80], rax
mov byte [rsp + 0xd], 0x5d
movzx eax, word [0x180146848]
mov byte [rsp + 0xe], al
mov dword [rsp + 0x60], 0xe0
mov eax, 0xa41
mov word [rsp + 0x34], ax
mov eax, 0xce7b709e
mov qword [rsp + 0x88], rax
mov eax, dword [0x1801467cc]
mov eax, eax
mov qword [rsp + 0x90], rax
movzx eax, word [0x1801467b4]
movzx eax, ax
mov qword [rsp + 0x98], rax
movzx eax, byte [0x180146723]
mov byte [rsp + 0xf], al
mov eax, dword [0x18014684c]
mov dword [rsp + 0x64], eax
movsx rax, byte [0x18014670b]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x68], 0x9e146799
mov rax, qword [0x1801467f8]
mov word [rsp + 0x38], ax
movzx eax, byte [0x180146763]
movzx eax, al
mov word [rsp + 0x3c], ax
mov byte [rsp + 0x10], 0xb0
movzx eax, byte [0x180146723]
movzx eax, al
mov word [rsp + 0x40], ax
mov dword [rsp + 0x14], 1
mov eax, dword [rsp + 0x4c]
sub eax, 0x45f
mov byte [0x1801466df], al
mov eax, 4
imul rax, rax, 0x17e
lea rcx, [0x180a712a0]
movzx eax, byte [rcx + rax]
mov byte [0x1801466df], al
mov eax, dword [rsp + 0x14]
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0
je 0x18004dfed
cmp dword [rsp + 0x18], 1
je 0x18004e00a
jmp 0x18004e016
mov rax, qword [0x180146850]
movabs rcx, 0xd952cd46aef5f
sub rax, rcx
mov qword [0x1801467e0], rax
jmp 0x18004e016
movzx eax, word [rsp + 4]
add eax, 0x43
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x14]
add eax, 0x74
mov word [rsp + 4], ax
movzx eax, byte [rsp]
movsx eax, al
add eax, 0xe13efb31
mov ecx, dword [0x1801467cc]
add ecx, eax
mov eax, ecx
mov dword [0x1801467cc], eax
movzx eax, word [rsp + 0x70]
add rsp, 0xb8
ret
Function at 0x18006c2a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x28], 0x1b
mov byte [rsp + 0x30], 0xfc
mov byte [rsp + 0x31], 0x62
mov byte [rsp + 0x32], 0xef
mov byte [rsp + 0x33], 0xec
mov byte [rsp + 0x34], 0xe6
mov byte [rsp + 0x35], 0xdf
mov byte [rsp + 0x36], 0xf8
mov byte [rsp + 0x37], 0xa9
mov byte [rsp + 0x38], 0x6b
mov byte [rsp + 0x39], 0x6b
mov byte [rsp + 0x3a], 0x6e
mov byte [rsp + 0x3b], 0x6c
mov byte [rsp + 0x3c], 0xce
mov byte [rsp + 0x3d], 0x7f
mov byte [rsp + 0x3e], 0xf3
mov byte [rsp + 0x3f], 0xe1
mov byte [rsp + 0x40], 0xea
mov byte [rsp + 0x41], 0xdb
mov byte [rsp + 0x42], 0xab
mov byte [rsp + 0x43], 0xda
mov byte [rsp + 0x44], 0x4c
mov byte [rsp + 0x45], 0x70
mov byte [rsp + 0x46], 0x77
mov byte [rsp + 0x47], 0x68
mov byte [rsp + 0x48], 0xc8
mov byte [rsp + 0x49], 0x6e
mov byte [rsp + 0x4a], 0x81
mov eax, 0x8a4
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x18006c3d6
mov eax, 0x8a4
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x181b8e144]
mov rcx, qword gs:[0x58]
mov edx, 0x8a4
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x888
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.18006c640
lea rcx, [0x18010e6b0]
call fcn.1800f9df4
nop
mov eax, 0x888
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x58
ret
Function at 0x18006c400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x28], 0x1b
mov byte [rsp + 0x30], 0x5c
mov byte [rsp + 0x31], 0x68
mov byte [rsp + 0x32], 0x6f
mov byte [rsp + 0x33], 0xc5
mov byte [rsp + 0x34], 0xc4
mov byte [rsp + 0x35], 0xfd
mov byte [rsp + 0x36], 0xfa
mov byte [rsp + 0x37], 0xa9
mov byte [rsp + 0x38], 0xcb
mov byte [rsp + 0x39], 0x61
mov byte [rsp + 0x3a], 0xce
mov byte [rsp + 0x3b], 0xc6
mov byte [rsp + 0x3c], 0x6e
mov byte [rsp + 0x3d], 0x75
mov byte [rsp + 0x3e], 0x73
mov byte [rsp + 0x3f], 0xc8
mov byte [rsp + 0x40], 0xc8
mov byte [rsp + 0x41], 0xf9
mov byte [rsp + 0x42], 0xa9
mov byte [rsp + 0x43], 0xda
mov byte [rsp + 0x44], 0xec
mov byte [rsp + 0x45], 0x7a
mov byte [rsp + 0x46], 0xd7
mov byte [rsp + 0x47], 0xc2
mov byte [rsp + 0x48], 0x68
mov byte [rsp + 0x49], 0x64
mov byte [rsp + 0x4a], 1
mov eax, 0x8c4
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x18006c536
mov eax, 0x8c4
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x181b8e144]
mov rcx, qword gs:[0x58]
mov edx, 0x8c4
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x8a8
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.18006c640
lea rcx, [0x18010e860]
call fcn.1800f9df4
nop
mov eax, 0x8a8
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x58
ret

Function at 0x18006ca30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0xd
mov byte [rsp + 0x30], 0xee
mov byte [rsp + 0x31], 0x7a
mov byte [rsp + 0x32], 0xc4
mov byte [rsp + 0x33], 0x64
mov byte [rsp + 0x34], 0x72
mov byte [rsp + 0x35], 0x66
mov byte [rsp + 0x36], 0x53
mov byte [rsp + 0x37], 0x54
mov byte [rsp + 0x38], 0xca
mov byte [rsp + 0x39], 0x49
mov byte [rsp + 0x3a], 0x66
mov byte [rsp + 0x3b], 0x60
mov byte [rsp + 0x3c], 0xa1
mov eax, 0x718
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x18006cb20
mov eax, 0x718
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x181b8e144]
mov rcx, qword gs:[0x58]
mov edx, 0x718
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x708
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180028e60
lea rcx, [0x18010e530]
call fcn.1800f9df4
nop
mov eax, 0x708
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x48
ret
Function at 0x18006cc60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x28], 0x15
mov byte [rsp + 0x30], 0xd8
mov byte [rsp + 0x31], 0x5c
mov byte [rsp + 0x32], 0xe6
mov byte [rsp + 0x33], 0x5b
mov byte [rsp + 0x34], 0x7a
mov byte [rsp + 0x35], 0xd2
mov byte [rsp + 0x36], 0x4c
mov byte [rsp + 0x37], 0xf1
mov byte [rsp + 0x38], 0xff
mov byte [rsp + 0x39], 0x60
mov byte [rsp + 0x3a], 0x42
mov byte [rsp + 0x3b], 0x46
mov byte [rsp + 0x3c], 0xda
mov byte [rsp + 0x3d], 0x5d
mov byte [rsp + 0x3e], 0xe2
mov byte [rsp + 0x3f], 0x5d
mov byte [rsp + 0x40], 0x76
mov byte [rsp + 0x41], 0xf2
mov byte [rsp + 0x42], 0x6c
mov byte [rsp + 0x43], 0xfb
mov byte [rsp + 0x44], 0x89
mov eax, 0x818
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x18006cd78
mov eax, 0x818
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x181b8e144]
mov rcx, qword gs:[0x58]
mov edx, 0x818
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x800
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180028b50
lea rcx, [0x18010e590]
call fcn.1800f9df4
nop
mov eax, 0x800
mov eax, eax
mov ecx, dword [0x181b8e144]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x58
ret