joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800124f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xa0
cmp qword [0x180076d28], 0
mov r14d, r9d
mov r15, r8
mov r12, rdx
mov r13, rcx
jne 0x1800126b0
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
lea rcx, [rbp - 0x41]
mov qword [rax + 0x18], rdi
mov dword [rbp - 0x41], 0x6c64746e
mov dword [rbp - 0x3d], 0x6c642e6c
mov word [rbp - 0x39], 0x6c
mov dword [rbp - 0x21], 0x7250775a
mov dword [rbp - 0x1d], 0x6365746f
mov dword [rbp - 0x19], 0x72695674
mov dword [rbp - 0x15], 0x6c617574
mov dword [rbp - 0x11], 0x6f6d654d
mov word [rbp - 0xd], 0x7972
mov byte [rbp - 0xb], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x21]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x41]
mov qword [rbp - 9], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x41]
xor edi, edi
mov rsi, rax
mov dword [rbp - 1], edi
call fcn.1800127b0
mov rbx, rax
test rax, rax
je 0x180012698
mov r8d, dword [rbp - 1]
mov rdx, rsi
mov rcx, rax
call fcn.180012d20
mov rcx, rbx
test eax, eax
jne 0x1800125d4
call fcn.1800031d0
jmp 0x180012698
mov edx, dword [rbp - 9]
sub edx, esi
call fcn.180012e80
mov rcx, rbx
mov r11d, eax
mov rax, qword [r11 + rbx]
mov qword [rbp + 7], rax
mov rax, qword [r11 + rbx + 8]
mov qword [rbp + 0xf], rax
call fcn.1800031d0
lea rcx, [rbp - 0x31]
mov dword [rbp - 0x31], 0x65696253
mov dword [rbp - 0x2d], 0x2e6c6c44
mov dword [rbp - 0x29], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x10
lea r9, [rbp - 1]
test rax, rax
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
cmovne r8d, edi
or rcx, 0xffffffffffffffff
lea eax, [r8 + 1]
mov edx, r8d
mov byte [rbp + r8 + 7], 0xff
mov byte [rbp + rax + 7], 0x25
mov rax, qword [rbp - 9]
lea ebx, [r8 + 0xe]
add rax, rdx
lea rdx, [rbp - 9]
mov dword [rbp + r8 + 9], edi
mov qword [rbp - 9], rdi
mov qword [rbp - 1], rbx
mov qword [rbp + r8 + 0xd], rax
call fcn.180012250
test eax, eax
cmovns rdi, qword [rbp - 9]
mov qword [0x180076d28], rdi
test rdi, rdi
je 0x180012698
lea rdx, [rbp + 7]
mov r8d, ebx
mov rcx, rdi
call fcn.1800029a0
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xe0]
mov rax, qword [rbp + 0x7f]
mov r10, qword [0x180076d28]
mov r9d, r14d
mov r8, r15
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], rax
call r10
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180013870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rbx, r8
lea rcx, [rbp - 0x4e]
xor edi, edi
xor edx, edx
mov r8d, 0x1fe
mov word [rbp - 0x50], di
call fcn.180008040
lea rcx, [rsp + 0x40]
mov qword [rbp + 0x1d8], rdi
mov dword [rsp + 0x40], 0x786f4256
mov dword [rsp + 0x44], 0x642e5452
mov word [rsp + 0x48], 0x6c6c
mov byte [rsp + 0x4a], dil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800138ec
mov r8, rbx
xor edx, edx
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
jmp 0x1800139f3
test rbx, rbx
jne 0x180013901
lea ecx, [rbx + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800139f3
lea rax, [rbp - 0x50]
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [0x18007b950]
test rax, rax
jne 0x180013993
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x6c64746e
mov dword [rsp + 0x34], 0x6c642e6c
mov word [rsp + 0x38], 0x6c
mov dword [rsp + 0x50], 0x496c7452
mov dword [rsp + 0x54], 0x5574696e
mov dword [rsp + 0x58], 0x6f63696e
mov dword [rsp + 0x5c], 0x74536564
mov dword [rsp + 0x60], 0x676e6972
mov byte [rsp + 0x64], dil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007b950], rax
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x70]
call rax
mov rax, qword [0x18007b068]
xor edx, edx
lea r9, [rbp + 0x1d8]
lea r8, [rsp + 0x70]
lea rcx, [rbp - 0x80]
test rax, rax
jne 0x1800139c3
call fcn.180013c00
jmp 0x1800139c5
call rax
test eax, eax
jns 0x1800139d4
mov ecx, eax
call fcn.180013e00
xor eax, eax
jmp 0x1800139f3
mov r8, qword [rbp + 0x1d8]
lea rcx, [rsp + 0x68]
mov edx, 0xf001f
call fcn.180013e90
test eax, eax
js 0x1800139c9
mov rax, qword [rsp + 0x68]
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x180013a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x786f4256
mov dword [rsp + 0x24], 0x642e5452
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x2a], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180013a54
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add rsp, 0x30
pop rdi
ret
mov rdx, rdi
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x40], rbx
call fcn.180014080
mov ebx, eax
test eax, eax
jns 0x180013aa6
cmp eax, 0xc0000045
jne 0x180013a92
xor edx, edx
mov rcx, rdi
call fcn.180018bd0
test al, al
je 0x180013a92
mov rdx, rdi
or rcx, 0xffffffffffffffff
call fcn.180014080
mov ebx, eax
test eax, eax
jns 0x180013aa6
mov ecx, ebx
call fcn.180013e00
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180013ac0
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rdi, rcx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x786f4256
mov dword [rsp + 0x64], 0x642e5452
mov word [rsp + 0x68], 0x6c6c
mov byte [rsp + 0x6a], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
mov rcx, rdi
test rax, rax
je 0x180013b20
lea edx, [rbx + 6]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
lea rax, [rsp + 0x58]
mov dword [rsp + 0x48], 4
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa0]
or rdx, 0xffffffffffffffff
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x28], rax
call fcn.180014260
test eax, eax
jns 0x180013b7b
mov ecx, eax
call fcn.180013e00
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov rbx, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x180013c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov r14, rcx
lea rcx, [rbp - 0x50]
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov dword [rbp - 0x50], 0x6e72656b
mov dword [rbp - 0x4c], 0x61626c65
mov dword [rbp - 0x48], 0x642e6573
mov word [rbp - 0x44], 0x6c6c
mov byte [rbp - 0x42], 0
mov dword [rbp - 0x28], 0x65736142
mov dword [rbp - 0x24], 0x6d726f46
mov dword [rbp - 0x20], 0x624f7461
mov dword [rbp - 0x1c], 0x7463656a
mov dword [rbp - 0x18], 0x72747441
mov dword [rbp - 0x14], 0x74756269
mov word [rbp - 0x10], 0x7365
mov byte [rbp - 0xe], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007b068], rax
test rax, rax
jne 0x180013cff
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x40], 0x6e65704f
mov dword [rbp - 0x3c], 0x656c6946
mov dword [rbp - 0x38], 0x7070614d
mov dword [rbp - 0x34], 0x57676e69
mov byte [rbp - 0x30], al
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
mov rdx, rax
mov eax, r8d
mov ecx, r8d
cmp byte [rcx + rdx], 0xff
jne 0x180013ced
cmp byte [rcx + rdx + 1], 0x15
je 0x180013d27
inc rcx
inc eax
cmp rcx, 0x70
jl 0x180013ce0
mov rax, qword [0x18007b068]
mov r9, rbx
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
cdqe
add rdx, rax
mov rax, r8
nop
cmp byte [rax + rdx], 0xe8
je 0x180013d44
inc rax
inc r8d
cmp rax, 0x70
jl 0x180013d30
jmp 0x180013cf8
movsxd rax, r8d
movsxd rcx, dword [rax + rdx + 1]
add rcx, rax
lea rax, [rdx + 5]
add rax, rcx
mov qword [0x18007b068], rax
jmp 0x180013cff
Function at 0x180013e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18007b898]
mov ebx, ecx
test rax, rax
jne 0x180013e76
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x6e72656b
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x28], 0x6c6c642e
mov byte [rbp - 0x24], al
mov dword [rbp - 0x20], 0x65736142
mov dword [rbp - 0x1c], 0x4c746553
mov dword [rbp - 0x18], 0x4e747361
mov dword [rbp - 0x14], 0x72724554
mov word [rbp - 0x10], 0x726f
mov byte [rbp - 0xe], al
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007b898], rax
mov ecx, ebx
call rax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x180013e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rbx, qword [0x18007b958]
mov r15, r8
mov r12d, edx
mov rsi, rcx
test rbx, rbx
jne 0x180014036
lea rcx, [rbp - 0x21]
mov dword [rbp - 0x21], 0x6c64746e
mov dword [rbp - 0x1d], 0x6c642e6c
mov word [rbp - 0x19], 0x6c
mov dword [rbp - 1], 0x704f744e
mov dword [rbp + 3], 0x65536e65
mov dword [rbp + 7], 0x6f697463
mov word [rbp + 0xb], 0x6e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x21]
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x7f]
lea rcx, [rbp - 0x21]
mov dword [rbp + 0x7f], ebx
mov r14, rax
call fcn.1800127b0
mov rdi, rax
test rax, rax
je 0x180013f56
mov r8d, dword [rbp + 0x7f]
mov rdx, r14
mov rcx, rax
call fcn.180012d20
mov rcx, rdi
test eax, eax
jne 0x180013f6e
call fcn.1800031d0
mov rbx, qword [0x18007b958]
test rbx, rbx
jne 0x180014036
or eax, 0xffffffff
jmp 0x18001404a
mov edx, r13d
sub edx, r14d
call fcn.180012e80
mov rcx, rdi
mov r11d, eax
mov rax, qword [r11 + rdi]
mov qword [rbp + 0xf], rax
mov rax, qword [r11 + rdi + 8]
mov qword [rbp + 0x17], rax
call fcn.1800031d0
lea rcx, [rbp - 0x11]
mov dword [rbp - 0x11], 0x65696253
mov dword [rbp - 0xd], 0x2e6c6c44
mov dword [rbp - 9], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x10
lea r9, [rbp - 0x29]
test rax, rax
lea rdx, [rbp + 0x7f]
mov dword [rsp + 0x28], 0x40
cmovne r8d, ebx
or rcx, 0xffffffffffffffff
mov qword [rbp + 0x7f], rbx
lea eax, [r8 + 1]
mov byte [rbp + r8 + 0xf], 0xff
lea edi, [r8 + 0xe]
mov byte [rbp + rax + 0xf], 0x25
lea rax, [r8 + r13]
mov dword [rbp + r8 + 0x11], ebx
mov qword [rbp - 0x29], rdi
mov dword [rsp + 0x20], 0x3000
mov qword [rbp + r8 + 0x15], rax
call fcn.180012250
test eax, eax
cmovns rbx, qword [rbp + 0x7f]
mov qword [0x18007b958], rbx
test rbx, rbx
je 0x180013f66
lea rdx, [rbp + 0xf]
mov r8d, edi
mov rcx, rbx
call fcn.1800029a0
jmp 0x180013f5d
test rsi, rsi
je 0x180013f66
mov r8, r15
mov edx, r12d
mov rcx, rsi
call rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180014080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rbx, qword [0x18007ade0]
mov r15, rdx
mov rsi, rcx
test rbx, rbx
jne 0x180014228
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x6c64746e
mov dword [rbp - 0x25], 0x6c642e6c
mov word [rbp - 0x21], 0x6c
mov dword [rbp - 9], 0x6e55744e
mov dword [rbp - 5], 0x5670616d
mov dword [rbp - 1], 0x4f776569
mov dword [rbp + 3], 0x63655366
mov dword [rbp + 7], 0x6e6f6974
mov byte [rbp + 0xb], bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x29]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x29]
mov dword [rbp + 0x77], ebx
mov r14, rax
call fcn.1800127b0
mov rdi, rax
test rax, rax
je 0x180014148
mov r8d, dword [rbp + 0x77]
mov rdx, r14
mov rcx, rax
call fcn.180012d20
mov rcx, rdi
test eax, eax
jne 0x180014160
call fcn.1800031d0
mov rbx, qword [0x18007ade0]
test rbx, rbx
jne 0x180014228
or eax, 0xffffffff
jmp 0x180014239
mov edx, r12d
sub edx, r14d
call fcn.180012e80
mov rcx, rdi
mov r11d, eax
mov rax, qword [r11 + rdi]
mov qword [rbp + 0xf], rax
mov rax, qword [r11 + rdi + 8]
mov qword [rbp + 0x17], rax
call fcn.1800031d0
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x65696253
mov dword [rbp - 0x15], 0x2e6c6c44
mov dword [rbp - 0x11], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x10
lea r9, [rbp + 0x7f]
test rax, rax
lea rdx, [rbp + 0x77]
mov dword [rsp + 0x28], 0x40
cmovne r8d, ebx
or rcx, 0xffffffffffffffff
mov qword [rbp + 0x77], rbx
lea eax, [r8 + 1]
mov byte [rbp + r8 + 0xf], 0xff
lea edi, [r8 + 0xe]
mov byte [rbp + rax + 0xf], 0x25
lea rax, [r8 + r12]
mov dword [rbp + r8 + 0x11], ebx
mov qword [rbp + 0x7f], rdi
mov dword [rsp + 0x20], 0x3000
mov qword [rbp + r8 + 0x15], rax
call fcn.180012250
test eax, eax
cmovns rbx, qword [rbp + 0x77]
mov qword [0x18007ade0], rbx
test rbx, rbx
je 0x180014158
lea rdx, [rbp + 0xf]
mov r8d, edi
mov rcx, rbx
call fcn.1800029a0
jmp 0x18001414f
test rsi, rsi
je 0x180014158
mov rdx, r15
mov rcx, rsi
call rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180014260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xb0
mov rbx, qword [0x18007b8b8]
xor r13d, r13d
mov rdi, r8
mov r14, rdx
mov r15, rcx
test rbx, rbx
jne 0x18001441c
lea rcx, [rbp - 0x59]
mov dword [rbp - 0x59], 0x6c64746e
mov dword [rbp - 0x55], 0x6c642e6c
mov word [rbp - 0x51], 0x6c
mov dword [rbp - 0x39], 0x614d744e
mov dword [rbp - 0x35], 0x65695670
mov dword [rbp - 0x31], 0x53664f77
mov dword [rbp - 0x2d], 0x69746365
mov word [rbp - 0x29], 0x6e6f
mov byte [rbp - 0x27], r13b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x39]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x59]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x59]
mov dword [rbp + 0x6f], r13d
mov rsi, rax
call fcn.1800127b0
mov rbx, rax
test rax, rax
je 0x18001433a
mov r8d, dword [rbp + 0x6f]
mov rdx, rsi
mov rcx, rax
call fcn.180012d20
mov rcx, rbx
test eax, eax
jne 0x180014352
call fcn.1800031d0
mov rbx, qword [0x18007b8b8]
test rbx, rbx
jne 0x18001441c
or eax, 0xffffffff
jmp 0x18001445e
mov edx, r12d
sub edx, esi
call fcn.180012e80
mov rcx, rbx
mov r11d, eax
mov rax, qword [r11 + rbx]
mov qword [rbp - 0x21], rax
mov rax, qword [r11 + rbx + 8]
mov qword [rbp - 0x19], rax
call fcn.1800031d0
lea rcx, [rbp - 0x49]
mov dword [rbp - 0x49], 0x65696253
mov dword [rbp - 0x45], 0x2e6c6c44
mov dword [rbp - 0x41], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x10
lea r9, [rbp + 0x57]
test rax, rax
lea rdx, [rbp + 0x4f]
mov dword [rsp + 0x28], 0x40
cmovne r8d, r13d
or rcx, 0xffffffffffffffff
mov qword [rbp + 0x4f], r13
lea eax, [r8 + 1]
mov byte [rbp + r8 - 0x21], 0xff
lea esi, [r8 + 0xe]
mov byte [rbp + rax - 0x21], 0x25
lea rax, [r8 + r12]
mov dword [rbp + r8 - 0x1f], r13d
mov qword [rbp + 0x57], rsi
mov dword [rsp + 0x20], 0x3000
mov qword [rbp + r8 - 0x1b], rax
call fcn.180012250
mov rbx, r13
test eax, eax
cmovns rbx, qword [rbp + 0x4f]
mov qword [0x18007b8b8], rbx
test rbx, rbx
je 0x18001434a
lea rdx, [rbp - 0x21]
mov r8d, esi
mov rcx, rbx
call fcn.1800029a0
jmp 0x180014341
test rdi, rdi
je 0x18001434a
mov eax, dword [rbp + 0x7f]
xor r9d, r9d
mov r8, rdi
mov dword [rsp + 0x48], eax
mov rax, qword [rbp + 0x67]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x5f]
mov qword [rsp + 0x28], rax
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], r13
call rbx
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1800148e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x30
lea rcx, [rsp + 0x20]
mov rbx, rdx
mov dword [rsp + 0x20], 0x72657375
mov dword [rsp + 0x24], 0x642e3233
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x2a], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rax
test rax, rax
je 0x1800149a8
mov ecx, dword [rbx + 0x100045c]
mov dword [0x18007b048], ecx
cmp ecx, 0xffff
jne 0x180014954
mov eax, dword [rbx + 0x1000458]
add rax, 6
add rax, rdx
mov qword [0x18007b878], rax
call fcn.180018240
mov eax, 1
add rsp, 0x30
pop rbx
ret
cmp ecx, 0xfffe
jne 0x180014968
mov ecx, dword [rbx + 0x1000458]
add rcx, 0xb
jmp 0x18001498e
cmp ecx, 0xfffd
jne 0x18001497c
mov ecx, dword [rbx + 0x1000458]
add rcx, 6
jmp 0x18001498e
cmp ecx, 0xfffc
mov ecx, dword [rbx + 0x1000458]
je 0x180014976
add rcx, 7
add rcx, rax
mov qword [0x18007b878], rcx
call fcn.180018240
mov eax, 1
add rsp, 0x30
pop rbx
ret
add rsp, 0x30
pop rbx
ret
Function at 0x1800189f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x18007c0c0]
xor ebx, ebx
lea rcx, [0x18007ad70]
lea r8d, [rbx + 0x60]
xor edx, edx
mov dword [0x18007b940], ebx
mov dword [0x180076d50], ebx
mov dword [0x18007b894], ebx
mov dword [0x18007b970], ebx
mov dword [0x18007b890], ebx
mov dword [0x18007b060], ebx
mov dword [0x18007ad60], ebx
mov dword [0x18007b968], ebx
mov dword [0x18007adf0], ebx
mov dword [0x18007ad6c], ebx
mov dword [0x18007b874], ebx
mov dword [0x180048620], 1
mov dword [0x18004861c], 1
mov dword [0x18007b948], ebx
mov dword [0x180076d54], ebx
mov dword [0x180048624], 1
mov dword [0x18007b03c], ebx
mov dword [0x18007b064], ebx
mov dword [0x18007b934], ebx
mov qword [0x180076d48], rbx
mov qword [0x18007b888], rbx
mov qword [0x18007b040], rbx
mov qword [0x18007b928], rbx
mov dword [0x180048618], 1
mov dword [0x180048610], 1
mov dword [0x18007b05c], ebx
mov dword [0x18007b8b4], ebx
mov dword [0x18007b8ac], ebx
mov qword [0x180076d38], rbx
mov qword [0x18007c0c8], rax
call fcn.180008040
lea r8d, [rbx + 0x60]
lea rcx, [0x18007b8c0]
xor edx, edx
call fcn.180008040
mov dword [0x18007b04c], ebx
mov dword [0x18007ad64], ebx
movsd xmm0, qword [0x180041638]
movsd qword [0x180048628], xmm0
mov dword [0x180076d44], ebx
mov dword [0x18007b8a4], ebx
mov dword [0x18007b870], ebx
mov dword [0x18007adf8], ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x180076d58]
mov dword [0x18007b930], eax
mov dword [0x18007b8b0], eax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x180076d58]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x6d6e6977
mov dword [rbp - 0x1c], 0x6c642e6d
mov word [rbp - 0x18], 0x6c
mov qword [0x180076d30], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180018bbb
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x10], 0x656d6974
mov dword [rbp - 0xc], 0x54746547
mov dword [rbp - 8], 0x656d69
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180018bbb
call rax
mov dword [0x18007adfc], eax
mov dword [0x18007b058], eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x180018bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18007add0]
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x180018c56
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x6c64746e
mov dword [rbp - 0x2c], 0x6c642e6c
mov word [rbp - 0x28], 0x6c
mov dword [rbp - 0x20], 0x466c7452
mov dword [rbp - 0x1c], 0x6873756c
mov dword [rbp - 0x18], 0x75636553
mov dword [rbp - 0x14], 0x654d6572
mov dword [rbp - 0x10], 0x79726f6d
mov dword [rbp - 0xc], 0x68636143
mov word [rbp - 8], 0x65
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007add0], rax
mov rdx, rbx
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18001a530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp qword [0x18007b9d0], 0
je 0x18001a54e
mov eax, 1
add rsp, 0x50
pop rbp
ret
mov rcx, qword [sym.imp.USER32.dll_GetCursorPos]
mov r8d, 0x14
call fcn.18001aae0
mov rcx, qword [sym.imp.USER32.dll_GetCursorPos]
mov r8d, 0xa
mov qword [0x18007b9d0], rax
call fcn.18001a9e0
mov dword [0x18007b9a0], eax
call fcn.18001a6f0
test eax, eax
jne 0x18001a60c
mov rcx, qword [sym.imp.USER32.dll_SetCursorPos]
lea r8d, [rax + 0xd]
call fcn.18001a9e0
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x72657375
mov dword [rbp - 0x2c], 0x642e3233
mov word [rbp - 0x28], 0x6c6c
mov byte [rbp - 0x26], 0
mov dword [0x18007b9b4], eax
mov dword [rbp - 0x20], 0x50746553
mov dword [rbp - 0x1c], 0x69737968
mov dword [rbp - 0x18], 0x436c6163
mov dword [rbp - 0x14], 0x6f737275
mov dword [rbp - 0x10], 0x736f5072
mov byte [rbp - 0xc], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, 0xd
mov rcx, rax
call fcn.18001a9e0
mov dword [0x18007b978], eax
xor eax, eax
cmp qword [0x18007b9d0], rax
setne al
add rsp, 0x50
pop rbp
ret

Function at 0x18001a630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp qword [0x18007b990], 0
je 0x18001a64e
mov eax, 1
add rsp, 0x50
pop rbp
ret
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x336e6977
mov dword [rbp - 0x2c], 0x642e7532
mov word [rbp - 0x28], 0x6c6c
mov byte [rbp - 0x26], 0
mov dword [rbp - 0x20], 0x7355744e
mov dword [rbp - 0x1c], 0x65477265
mov dword [rbp - 0x18], 0x72754374
mov dword [rbp - 0x14], 0x50726f73
mov word [rbp - 0x10], 0x736f
mov byte [rbp - 0xe], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001a6ca
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov qword [0x18007b990], rax
xor eax, eax
test rcx, rcx
setne al
add rsp, 0x50
pop rbp
ret
mov rcx, qword [0x18007b990]
xor eax, eax
test rcx, rcx
setne al
add rsp, 0x50
pop rbp
ret