joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180049050
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800a1030]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1800a1d34]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1800a6f68], ecx
jle 0x180049174
lea rcx, [0x1800a6f68]
call fcn.180069b20
cmp dword [0x1800a6f68], 0xffffffff
jne 0x180049174
mov dword [rbp - 0x20], 0x50
mov byte [rbp - 0x1c], 0x28
mov byte [rbp - 0x1b], 0x6f
mov byte [rbp - 0x1a], 0x6f
mov byte [rbp - 0x19], 0x6f
mov byte [rbp - 0x18], 0x6f
mov byte [rbp - 0x17], 0x28
mov byte [rbp - 0x16], 0x28
mov byte [rbp - 0x15], 0x28
mov byte [rbp - 0x14], 0x28
mov byte [rbp - 0x13], 0x28
mov byte [rbp - 0x12], 0x28
xor eax, eax
mov byte [rbp - 0x11], al
movzx eax, byte [rbp - 0x1c]
xor edx, edx
mov r8d, edx
nop dword [rax + rax]
movzx eax, byte [rbp + r8 - 0x1c]
mov ecx, dword [rbp - 0x20]
xor cl, al
mov byte [rbp + r8 - 0x1c], cl
inc r8
cmp r8, 0xb
jb 0x1800490f0
mov byte [rbp - 0x11], dl
mov byte [rbp - 0x30], 0xec
mov byte [rbp - 0x2f], 4
mov byte [rbp - 0x2e], 4
mov byte [rbp - 0x2d], 4
mov byte [rbp - 0x2c], 4
mov byte [rbp - 0x2b], 0x13
mov byte [rbp - 0x2a], 0xba
mov byte [rbp - 0x29], 0xec
mov byte [rbp - 0x28], 0x49
mov byte [rbp - 0x27], 0x89
mov byte [rbp - 0x26], 0xfa
mov byte [rbp - 0x25], dl
movzx eax, byte [rbp - 0x30]
nop
movzx eax, byte [rbp + rdx - 0x30]
sub al, 4
mov byte [rbp + rdx - 0x30], al
inc rdx
cmp rdx, 0xb
jb 0x180049140
lea rdx, [rbp - 0x1c]
lea rcx, [rbp - 0x30]
call fcn.18004a300
mov qword [0x1800a7068], rax
lea rcx, [0x1800a6f68]
call fcn.180069ac0
mov rax, qword [0x1800a7068]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180069970
add rsp, 0x50
pop rbp
ret
Function at 0x180049190
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800a1030]
xor rax, rsp
mov qword [rbp - 8], rax
mov ecx, dword [0x1800a1d34]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1800a7078], ecx
jle 0x180049321
lea rcx, [0x1800a7078]
call fcn.180069b20
cmp dword [0x1800a7078], 0xffffffff
jne 0x180049321
mov byte [rbp - 0x18], 0x7d
mov byte [rbp - 0x17], 0x44
mov byte [rbp - 0x16], 0x44
mov byte [rbp - 0x15], 0x44
mov byte [rbp - 0x14], 0x44
mov byte [rbp - 0x13], 0x7d
mov byte [rbp - 0x12], 0x7d
mov byte [rbp - 0x11], 0x7d
mov byte [rbp - 0x10], 0x7d
mov byte [rbp - 0xf], 0x44
mov byte [rbp - 0xe], 0x7d
mov byte [rbp - 0xd], 0x7d
mov byte [rbp - 0xc], 0
movzx eax, byte [rbp - 0x18]
xor eax, eax
mov edx, eax
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp + rdx - 0x18]
sub cl, 5
mov byte [rbp + rdx - 0x18], cl
inc rdx
cmp rdx, 0xc
jb 0x180049230
mov dword [rbp - 0x30], 0x1b
mov ecx, dword [rbp - 0x30]
xor cl, 0xe8
mov byte [rbp - 0x2c], cl
mov ecx, dword [rbp - 0x30]
inc cl
mov byte [rbp - 0x2b], cl
mov ecx, dword [rbp - 0x30]
add cl, 2
mov byte [rbp - 0x2a], cl
mov ecx, dword [rbp - 0x30]
add cl, 3
mov byte [rbp - 0x29], cl
mov ecx, dword [rbp - 0x30]
add cl, 4
mov byte [rbp - 0x28], cl
mov ecx, dword [rbp - 0x30]
add cl, 5
xor cl, 0x4c
mov byte [rbp - 0x27], cl
mov ecx, dword [rbp - 0x30]
add cl, 6
xor cl, 0x8b
mov byte [rbp - 0x26], cl
mov ecx, dword [rbp - 0x30]
add cl, 7
xor cl, 0x7c
mov byte [rbp - 0x25], cl
mov ecx, dword [rbp - 0x30]
add cl, 8
xor cl, 0x24
mov byte [rbp - 0x24], cl
mov ecx, dword [rbp - 0x30]
add cl, 9
mov byte [rbp - 0x23], cl
mov ecx, dword [rbp - 0x30]
add cl, 0xa
xor cl, 0x8b
mov byte [rbp - 0x22], cl
mov ecx, dword [rbp - 0x30]
add cl, 0xb
xor cl, 0xd8
mov byte [rbp - 0x21], cl
xor ecx, ecx
mov byte [rbp - 0x20], cl
movzx ecx, byte [rbp - 0x2c]
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rbp + rax - 0x2c]
mov r8d, dword [rbp - 0x30]
add r8b, al
xor r8b, dl
mov byte [rbp + rax - 0x2c], r8b
inc rax
cmp rax, 0xc
jb 0x1800492e0
mov byte [rbp - 0x20], 0
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x2c]
call fcn.18004a300
mov qword [0x1800a6f50], rax
lea rcx, [0x1800a7078]
call fcn.180069ac0
mov rax, qword [0x1800a6f50]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180069970
add rsp, 0x50
pop rbp
ret
Function at 0x180049340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1800a1030]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1800a1d34]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1800a70b0], ecx
jle 0x180049484
lea rcx, [0x1800a70b0]
call fcn.180069b20
cmp dword [0x1800a70b0], 0xffffffff
jne 0x180049484
mov byte [rbp - 0x40], 0x7c
mov byte [rbp - 0x3f], 0x43
mov byte [rbp - 0x3e], 0x43
mov byte [rbp - 0x3d], 0x43
mov byte [rbp - 0x3c], 0x43
mov byte [rbp - 0x3b], 0x7c
mov byte [rbp - 0x3a], 0x7c
mov byte [rbp - 0x39], 0x7c
mov byte [rbp - 0x38], 0x7c
mov byte [rbp - 0x37], 0x7c
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x7c
mov byte [rbp - 0x34], 0x7c
mov byte [rbp - 0x33], 0x7c
mov byte [rbp - 0x32], 0x7c
mov byte [rbp - 0x31], 0x43
mov byte [rbp - 0x30], 0x7c
mov byte [rbp - 0x2f], 0
movzx eax, byte [rbp - 0x40]
xor edx, edx
mov ecx, edx
nop word [rax + rax]
movzx eax, byte [rbp + rcx - 0x40]
sub al, 4
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x11
jb 0x1800493f0
mov byte [rbp - 0x28], 0xf1
mov byte [rbp - 0x27], 9
mov byte [rbp - 0x26], 9
mov byte [rbp - 0x25], 9
mov byte [rbp - 0x24], 9
mov byte [rbp - 0x23], 0x51
mov byte [rbp - 0x22], 0x8c
mov byte [rbp - 0x21], 0xcd
mov byte [rbp - 0x20], 0x41
mov byte [rbp - 0x1f], 0xcc
mov byte [rbp - 0x1e], 0xd5
mov byte [rbp - 0x1d], 0x51
mov byte [rbp - 0x1c], 0x92
mov byte [rbp - 0x1b], 0x65
mov byte [rbp - 0x1a], 0x2d
mov byte [rbp - 0x19], 9
mov byte [rbp - 0x18], 0x5f
mov byte [rbp - 0x17], dl
movzx eax, byte [rbp - 0x28]
nop
movzx eax, byte [rbp + rdx - 0x28]
sub al, 9
mov byte [rbp + rdx - 0x28], al
inc rdx
cmp rdx, 0x11
jb 0x180049450
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x28]
call fcn.18004a300
mov qword [0x1800a7088], rax
lea rcx, [0x1800a70b0]
call fcn.180069ac0
mov rax, qword [0x1800a7088]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180069970
add rsp, 0x60
pop rbp
ret
Function at 0x180049b10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800a1030]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov ecx, dword [0x1800a1d34]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1800a6fa0], ecx
jle 0x180049cbd
lea rcx, [0x1800a6fa0]
call fcn.180069b20
cmp dword [0x1800a6fa0], 0xffffffff
jne 0x180049cbd
mov byte [rbp - 0x18], 0x7a
mov byte [rbp - 0x17], 0x41
mov byte [rbp - 0x16], 0x41
mov byte [rbp - 0x15], 0x41
mov byte [rbp - 0x14], 0x41
mov byte [rbp - 0x13], 0x7a
mov byte [rbp - 0x12], 0x7a
mov byte [rbp - 0x11], 0x7a
mov byte [rbp - 0x10], 0x7a
mov byte [rbp - 0xf], 0x7a
mov byte [rbp - 0xe], 0x7a
mov byte [rbp - 0xd], 0x7a
mov byte [rbp - 0xc], 0x7a
mov byte [rbp - 0xb], 0x41
mov byte [rbp - 0xa], 0
movzx eax, byte [rbp - 0x18]
xor eax, eax
mov edx, eax
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp + rdx - 0x18]
sub cl, 2
mov byte [rbp + rdx - 0x18], cl
inc rdx
cmp rdx, 0xe
jb 0x180049bc0
mov dword [rbp - 0x30], 0x40
mov ecx, dword [rbp - 0x30]
xor cl, 0xe8
mov byte [rbp - 0x2c], cl
mov ecx, dword [rbp - 0x30]
inc cl
mov byte [rbp - 0x2b], cl
mov ecx, dword [rbp - 0x30]
add cl, 2
mov byte [rbp - 0x2a], cl
mov ecx, dword [rbp - 0x30]
add cl, 3
mov byte [rbp - 0x29], cl
mov ecx, dword [rbp - 0x30]
add cl, 4
mov byte [rbp - 0x28], cl
mov ecx, dword [rbp - 0x30]
add cl, 5
xor cl, 0x44
mov byte [rbp - 0x27], cl
mov ecx, dword [rbp - 0x30]
add cl, 6
xor cl, 0xf
mov byte [rbp - 0x26], cl
mov ecx, dword [rbp - 0x30]
add cl, 7
xor cl, 0xb6
mov byte [rbp - 0x25], cl
mov ecx, dword [rbp - 0x30]
add cl, 8
xor cl, 0xc0
mov byte [rbp - 0x24], cl
mov ecx, dword [rbp - 0x30]
add cl, 9
xor cl, 0x48
mov byte [rbp - 0x23], cl
mov ecx, dword [rbp - 0x30]
add cl, 0xa
xor cl, 0x8d
mov byte [rbp - 0x22], cl
mov ecx, dword [rbp - 0x30]
add cl, 0xb
xor cl, 0x54
mov byte [rbp - 0x21], cl
mov ecx, dword [rbp - 0x30]
add cl, 0xc
xor cl, 0x24
mov byte [rbp - 0x20], cl
mov ecx, dword [rbp - 0x30]
add cl, 0xd
mov byte [rbp - 0x1f], cl
xor ecx, ecx
mov byte [rbp - 0x1e], cl
movzx ecx, byte [rbp - 0x2c]
nop word [rax + rax]
movzx ecx, byte [rbp + rax - 0x2c]
mov edx, dword [rbp - 0x30]
add dl, al
xor dl, cl
mov byte [rbp + rax - 0x2c], dl
inc rax
cmp rax, 0xe
jb 0x180049c80
mov byte [rbp - 0x1e], 0
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x2c]
call fcn.18004a300
mov qword [0x1800a7050], rax
lea rcx, [0x1800a6fa0]
call fcn.180069ac0
mov rcx, rbx
call qword [0x1800a7050]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180069970
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x18004a020
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1800a1030]
xor rax, rsp
mov qword [rsp + 0xa0], rax
cmp qword [rcx + 0x10], 0
mov rdi, rcx
jne 0x18004a04d
xor ecx, ecx
jmp 0x18004a057
cmp qword [rcx + 0x18], 0x10
jb 0x18004a057
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8, rdi
mov qword [rsp + 0xd0], rbp
lea rdx, [rsp + 0x20]
mov rsi, rax
call fcn.180039880
mov rcx, qword [rax]
mov qword [rcx + 0x30], rsi
test rsi, rsi
je 0x18004a20e
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x18004a20e
movsxd rbp, dword [rsi + 0x3c]
add rbp, rsi
je 0x18004a20e
cmp dword [rbp], 0x4550
jne 0x18004a20e
mov qword [rsp + 0xc8], rbx
lea rdx, [rsp + 0x20]
mov ebx, dword [rbp + 0x2c]
mov r8, rdi
add rbx, rsi
call fcn.180039880
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, qword [rax]
mov qword [rcx + 0x38], rbx
mov ebx, dword [rbp + 0x1c]
call fcn.180039880
mov r8, rdi
lea rdx, [rsp + 0x70]
mov rcx, qword [rax]
mov qword [rcx + 0x40], rbx
call fcn.180039880
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x38]
call fcn.180039880
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rbx, qword [rax]
call fcn.180039880
mov rcx, qword [rax]
mov rax, qword [rbx + 0x38]
add rax, qword [rcx + 0x40]
cmp rsi, rax
jae 0x18004a202
nop dword [rax + rax]
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
mov r8d, 0x30
mov rcx, rsi
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18004a202
mov ecx, dword [rsp + 0x54]
and ecx, 0xee
test dword [rsp + 0x54], 0x101
jne 0x18004a1cc
test ecx, ecx
je 0x18004a1cc
mov r8, rdi
lea rdx, [rsp + 0x80]
call fcn.180039880
mov rcx, qword [rax]
mov rax, qword [rsp + 0x48]
add rcx, 0x48
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rax
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x18004a1bf
movups xmm0, xmmword [rsp + 0x90]
movups xmmword [rdx], xmm0
add qword [rcx + 8], 0x10
jmp 0x18004a1cc
lea r8, [rsp + 0x90]
call fcn.180039660
add rsi, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov r8, rdi
call fcn.180039880
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rbx, qword [rax]
call fcn.180039880
mov rcx, qword [rax]
mov rax, qword [rbx + 0x38]
add rax, qword [rcx + 0x40]
cmp rsi, rax
jb 0x18004a130
mov rbx, qword [rsp + 0xc8]
mov al, 1
jmp 0x18004a210
xor al, al
mov rbp, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180069970
mov rsi, qword [rsp + 0xd8]
add rsp, 0xb0
pop rdi
ret
Function at 0x18004ad40
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
mov eax, edx
mov ebx, edx
cdq
mov r11, rcx
and edx, 3
lea r10d, [rdx + rax]
sar r10d, 2
test rcx, rcx
jne 0x18004ad65
xor eax, eax
mov rbx, qword [rsp + 8]
ret
test r10d, r10d
jle 0x18004add1
lea rdx, [rcx + 2]
mov r9, r10
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx - 2]
lea rdx, [rdx + 4]
mov byte [rsp + 0x10], al
movzx eax, byte [rdx - 5]
mov byte [rsp + 0x11], al
movzx eax, byte [rdx - 4]
mov byte [rsp + 0x12], al
movzx eax, byte [rdx - 3]
mov byte [rsp + 0x13], al
imul eax, dword [rsp + 0x10], 0xcc9e2d51
rol eax, 0xf
imul ecx, eax, 0x1b873593
xor r8d, ecx
mov dword [rsp + 0x10], ecx
rol r8d, 0xd
add r8d, 0xfaddaf14
lea r8d, [r8 + r8*4]
sub r9, 1
jne 0x18004ad80
mov ecx, ebx
lea eax, [r10*4]
and ecx, 3
movsxd r9, eax
xor edx, edx
sub ecx, 1
je 0x18004ae06
sub ecx, 1
je 0x18004adfb
cmp ecx, 1
jne 0x18004ae1f
movzx edx, byte [r9 + r11 + 2]
shl edx, 0x10
movzx eax, byte [r9 + r11 + 1]
shl eax, 8
xor edx, eax
movzx eax, byte [r9 + r11]
xor eax, edx
imul ecx, eax, 0xcc9e2d51
rol ecx, 0xf
imul eax, ecx, 0x1b873593
xor r8d, eax
xor r8d, ebx
mov rbx, qword [rsp + 8]
mov eax, r8d
shr eax, 0x10
xor eax, r8d
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
Function at 0x180068530
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1800a1030]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1800a1d34]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1800a7160], ecx
jle 0x18006872c
lea rcx, [0x1800a7160]
call fcn.180069b20
cmp dword [0x1800a7160], 0xffffffff
jne 0x18006872c
mov dword [rbp - 0x48], 0x60
mov byte [rbp - 0x44], 0x18
mov byte [rbp - 0x43], 0x18
mov byte [rbp - 0x42], 0x18
mov byte [rbp - 0x41], 0x5f
mov byte [rbp - 0x40], 0x5f
mov byte [rbp - 0x3f], 0x5f
mov byte [rbp - 0x3e], 0x5f
mov byte [rbp - 0x3d], 0x18
mov byte [rbp - 0x3c], 0x5f
mov byte [rbp - 0x3b], 0x5f
mov byte [rbp - 0x3a], 0x5f
mov byte [rbp - 0x39], 0x5f
mov byte [rbp - 0x38], 0x18
mov byte [rbp - 0x37], 0x18
mov byte [rbp - 0x36], 0x18
mov byte [rbp - 0x35], 0x18
mov byte [rbp - 0x34], 0x5f
mov byte [rbp - 0x33], 0x18
mov byte [rbp - 0x32], 0x18
xor eax, eax
mov byte [rbp - 0x31], al
movzx eax, byte [rbp - 0x44]
xor edi, edi
mov edx, edi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rdx - 0x44]
mov ecx, dword [rbp - 0x48]
xor cl, al
mov byte [rbp + rdx - 0x44], cl
inc rdx
cmp rdx, 0x13
jb 0x180068600
mov byte [rbp - 0x31], dil
mov byte [rbp - 0x60], 0x50
mov byte [rbp - 0x5f], 0x93
mov byte [rbp - 0x5e], 0x15
mov byte [rbp - 0x5d], 8
mov byte [rbp - 0x5c], 8
mov byte [rbp - 0x5b], 8
mov byte [rbp - 0x5a], 8
mov byte [rbp - 0x59], 0xf0
mov byte [rbp - 0x58], 8
mov byte [rbp - 0x57], 8
mov byte [rbp - 0x56], 8
mov byte [rbp - 0x55], 8
mov byte [rbp - 0x54], 0x50
mov byte [rbp - 0x53], 0x93
mov byte [rbp - 0x52], 0x64
mov byte [rbp - 0x51], 0x2c
mov byte [rbp - 0x50], 8
mov byte [rbp - 0x4f], 0xb8
mov byte [rbp - 0x4e], 9
mov byte [rbp - 0x4d], dil
movzx eax, byte [rbp - 0x60]
mov rcx, rdi
movzx eax, byte [rbp + rcx - 0x60]
sub al, 8
mov byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x13
jb 0x180068672
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], dil
lea r8, [rbp - 0x44]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x30]
call fcn.180037e10
mov rcx, rax
test rax, rax
jne 0x1800686c0
mov rbx, rdi
jmp 0x1800686cb
movsxd rax, dword [rax + 3]
lea rbx, [rcx + 7]
add rbx, rax
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180068709
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180068704
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180068704
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180069990
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov qword [0x1800a7158], rbx
lea rcx, [0x1800a7160]
call fcn.180069ac0
mov rax, qword [0x1800a7158]
mov rax, qword [rax]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180069970
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1800689f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800a1030]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov qword [rbp - 0x28], rdx
mov dword [rbp - 0x30], 0
mov edx, dword [r8 + 0x6fc]
call fcn.180068b00
test rax, rax
jne 0x180068ac8
mov dword [rbp - 0x20], 0x17
mov byte [rbp - 0x1c], 0x59
mov byte [rbp - 0x1b], 0x47
mov byte [rbp - 0x1a], 0x54
mov byte [rbp - 0x19], 0x37
mov byte [rbp - 0x18], 0x44
mov byte [rbp - 0x17], 0x62
mov byte [rbp - 0x16], 0x65
mov byte [rbp - 0x15], 0x61
mov byte [rbp - 0x14], 0x7e
mov byte [rbp - 0x13], 0x61
mov byte [rbp - 0x12], 0x78
mov byte [rbp - 0x11], 0x65
mov byte [rbp - 0x10], al
movzx eax, byte [rbp - 0x1c]
xor eax, eax
nop
movzx ecx, byte [rbp + rax - 0x1c]
mov edx, dword [rbp - 0x20]
xor dl, cl
mov byte [rbp + rax - 0x1c], dl
inc rax
cmp rax, 0xc
jb 0x180068a70
mov byte [rbp - 0x10], 0
mov qword [rbx], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rax, [rbp - 0x1c]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180068ab0
lea rdx, [rbp - 0x1c]
mov rcx, rbx
call fcn.180031b50
jmp 0x180068ad4
mov rdx, rbx
mov rcx, rax
call fcn.180069040
nop
mov dword [rbp - 0x30], 1
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180069970
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x180068c30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1800a1030]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rdx
mov qword [rsp + 0x28], rdx
xor r8d, r8d
mov dword [rsp + 0x20], r8d
mov rcx, qword [rcx + 0x338]
test rcx, rcx
jne 0x180068cf9
mov dword [rsp + 0x30], 0x35
mov byte [rsp + 0x34], 0x60
mov byte [rsp + 0x35], 0x5b
mov byte [rsp + 0x36], 0x5e
mov byte [rsp + 0x37], 0x5b
mov byte [rsp + 0x38], 0x5a
mov byte [rsp + 0x39], 0x42
mov byte [rsp + 0x3a], 0x5b
xor eax, eax
mov byte [rsp + 0x3b], al
movzx eax, byte [rsp + 0x34]
mov edx, r8d
nop
movzx eax, byte [rsp + rdx + 0x34]
mov ecx, dword [rsp + 0x30]
xor cl, al
mov byte [rsp + rdx + 0x34], cl
inc rdx
cmp rdx, 7
jb 0x180068ca0
mov byte [rsp + 0x3b], r8b
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
lea rax, [rsp + 0x34]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180068ce0
lea rdx, [rsp + 0x34]
mov rcx, rbx
call fcn.180031b50
jmp 0x180068cff
call fcn.180068340
nop
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180069970
add rsp, 0x50
pop rbx
ret
Function at 0x180069040
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800a1030]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov qword [rbp - 0x28], rdx
xor r8d, r8d
mov dword [rbp - 0x30], r8d
test rcx, rcx
jne 0x180069118
mov dword [rbp - 0x20], 0xf
mov byte [rbp - 0x1c], 0x41
mov byte [rbp - 0x1b], 0x5f
mov byte [rbp - 0x1a], 0x4c
mov byte [rbp - 0x19], 0x2f
mov byte [rbp - 0x18], 0x5c
mov byte [rbp - 0x17], 0x7a
mov byte [rbp - 0x16], 0x7d
mov byte [rbp - 0x15], 0x79
mov byte [rbp - 0x14], 0x66
mov byte [rbp - 0x13], 0x79
mov byte [rbp - 0x12], 0x60
mov byte [rbp - 0x11], 0x7d
xor eax, eax
mov byte [rbp - 0x10], al
movzx eax, byte [rbp - 0x1c]
mov edx, r8d
nop word [rax + rax]
movzx eax, byte [rbp + rdx - 0x1c]
mov ecx, dword [rbp - 0x20]
xor cl, al
mov byte [rbp + rdx - 0x1c], cl
inc rdx
cmp rdx, 0xc
jb 0x1800690c0
mov byte [rbp - 0x10], r8b
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
lea rax, [rbp - 0x1c]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180069100
lea rdx, [rbp - 0x1c]
mov rcx, rbx
call fcn.180031b50
jmp 0x18006913e
mov rcx, qword [rcx + 0xf0]
test rcx, rcx
jne 0x180069138
mov qword [rdx], r8
mov qword [rdx + 0x10], r8
mov qword [rdx + 0x18], 0xf
mov byte [rdx], r8b
jmp 0x18006913e
call fcn.180068340
nop
mov dword [rbp - 0x30], 1
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180069970
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x140002a0f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140010040]
jne 0x140001f4a
rol rcx, 0x10
test cx, 0xffff
jne 0x140001f46
repz ret
ror rcx, 0x10
jmp 0x140002968
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140011640]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140011738]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400029ed
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140011640]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140002a0f
mov rax, qword [rsp + 0x88]
mov qword [0x140011738], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400116d8], rax
mov rax, qword [0x140011738]
mov qword [0x1400115b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400116c0], rax
mov dword [0x1400115a0], 0xc0000409
mov dword [0x1400115a4], 1
mov rax, qword [0x140010040]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140010048]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140011638], eax
mov ecx, 1
call fcn.1400034b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000c398]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140011638], 0
jne 0x140002a96
mov ecx, 1
call fcn.1400034b4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140003b60
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140004c9c
nop
cmp dword [0x140011b78], 1
je 0x140003b0c
mov dword [0x140011b74], 1
mov byte [0x140011b70], r12b
test ebx, ebx
jne 0x140003af8
mov rcx, qword [0x140013650]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140003ae5
mov rcx, qword [0x140013648]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140003a84
call fcn.1400034c4
cmp qword [rdi], rax
jne 0x140003a84
jmp 0x140003a6a
cmp rdi, rsi
jb 0x140003ae5
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.1400034c4
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140013650]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140013648]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140003ac3
cmp r13, rax
je 0x140003ae3
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140003a6a
lea rdx, [0x14000c308]
lea rcx, [0x14000c2f0]
call fcn.1400038b4
lea rdx, [0x14000c318]
lea rcx, [0x14000c310]
call fcn.1400038b4
nop
test r12d, r12d
je 0x140003b1b
mov ecx, 8
call fcn.140004b9c
test r12d, r12d
jne 0x140003b46
mov dword [0x140011b78], 1
lea ecx, [r12 + 8]
call fcn.140004b9c
mov ecx, r15d
call fcn.140003848
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400039d4

Function at 0x140003b6c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400039d4