joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov word [rbp - 0x17], 0x7250
mov dword [rbp - 0x1e], 0x72685474
mov dword [rbp - 0x13], 0x79746972
mov word [rbp - 0x1a], 0x6165
mov word [rbp - 0x15], 0x6f69
mov byte [rbp - 0xf], 0
mov word [rbp - 0x20], 0x6547
mov byte [rbp - 0x18], 0x64
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001050d
mov rcx, rbx
call rax
jmp 0x180010512
mov eax, 0x7fffffff
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x180010530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x1b], 0x6854646e
mov dword [rbp - 0x16], 0x646165
mov dword [rbp - 0x20], 0x70737553
mov byte [rbp - 0x1c], 0x65
mov byte [rbp - 0x17], 0x72
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800105ac
mov rcx, rbx
call rax
jmp 0x1800105af
or eax, 0xffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x1800105d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov word [rbp - 0x20], 0x6956
mov dword [rbp - 0x17], 0x636f6c
mov dword [rbp - 0x1d], 0x6c617574
mov word [rbp - 0x19], 0x6c41
mov byte [rbp - 0x1e], 0x72
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001065a
mov edx, 0x78
mov r8d, 0x3000
mov rcx, rbx
lea r9d, [rdx - 0x58]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x1800108a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov edi, edx
mov dword [rbp - 0x1b], 0x64616572
mov word [rbp - 0x13], 0x6972
mov word [rbp - 0x10], 0x79
mov word [rbp - 0x16], 0x6972
mov byte [rbp - 0x11], 0x74
mov byte [rbp - 0x17], 0x50
mov dword [rbp - 0x20], 0x54746553
mov byte [rbp - 0x14], 0x6f
mov byte [rbp - 0x1c], 0x68
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010936
mov edx, edi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x180010a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
mov ebx, r8d
mov word [rbp - 0x2b], 0x7268
mov word [rbp - 0x28], 0x6461
mov dword [rbp - 0x30], 0x6e65704f
mov byte [rbp - 0x26], 0
mov byte [rbp - 0x2c], 0x54
mov byte [rbp - 0x29], 0x65
mov dword [rbp - 0x19], 0x6c642e32
mov word [rbp - 0x15], 0x6c
mov dword [rbp - 0x1f], 0x656e7265
mov word [rbp - 0x1b], 0x336c
mov byte [rbp - 0x20], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010a93
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x180010b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, qword [rbp + 0x58]
mov rbx, rcx
lea rcx, [rbp - 0x38]
mov r14d, r9d
mov rsi, r8
mov rdi, rdx
mov dword [rbp - 0x26], 0x61757472
mov dword [rbp - 0x1b], 0x784574
mov dword [rbp - 0x21], 0x746f7250
mov word [rbp - 0x28], 0x6956
mov word [rbp - 0x1d], 0x6365
mov byte [rbp - 0x22], 0x6c
mov dword [rbp - 0x31], 0x6c642e32
mov word [rbp - 0x2d], 0x6c
mov dword [rbp - 0x37], 0x656e7265
mov word [rbp - 0x33], 0x336c
mov byte [rbp - 0x38], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010c10
mov r9d, r14d
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], r15
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014280
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180010c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov word [rbp - 0x15], 0x64
mov dword [rbp - 0x1e], 0x656d7573
mov dword [rbp - 0x1a], 0x65726854
mov word [rbp - 0x20], 0x6552
mov byte [rbp - 0x16], 0x61
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010cad
mov rcx, rbx
call rax
jmp 0x180010cb0
or eax, 0xffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x180010cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x20], 0x65536c61
mov dword [rbp - 0x1a], 0x6e6f69
mov dword [rbp - 0x2a], 0x657a696c
mov dword [rbp - 0x2e], 0x61697469
mov word [rbp - 0x1c], 0x7463
mov word [rbp - 0x25], 0x6972
mov word [rbp - 0x30], 0x6e49
mov word [rbp - 0x22], 0x6369
mov byte [rbp - 0x26], 0x43
mov byte [rbp - 0x23], 0x74
mov dword [rbp - 0x39], 0x6c642e32
mov word [rbp - 0x35], 0x6c
mov dword [rbp - 0x3f], 0x656e7265
mov word [rbp - 0x3b], 0x336c
mov byte [rbp - 0x40], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010d66
lea rcx, [0x18005ca38]
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014280
add rsp, 0x60
pop rbp
ret

Function at 0x180010d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x17], 0x6c6c64
mov dword [rbp - 0x1b], 0x2e323369
mov word [rbp - 0x1d], 0x7061
mov word [rbp - 0x20], 0x6441
mov byte [rbp - 0x1e], 0x76
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180010e05
lea rdx, [rbp - 0x30]
mov rcx, rax
mov word [rbp - 0x30], 0x6552
mov word [rbp - 0x2a], 0x6573
mov word [rbp - 0x2d], 0x6c43
mov dword [rbp - 0x28], 0x79654b
mov byte [rbp - 0x2e], 0x67
mov byte [rbp - 0x2b], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010e05
mov rcx, rbx
call rax
jmp 0x180010e0a
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180010e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, qword [rbp + 0x30]
lea rcx, [rbp - 0x30]
mov rbx, rdx
mov dword [rbp - 0x27], 0x6c6c64
mov dword [rbp - 0x2b], 0x2e323369
mov word [rbp - 0x2d], 0x7061
mov word [rbp - 0x30], 0x6441
mov byte [rbp - 0x2e], 0x76
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180010ed4
lea rdx, [rbp - 0x20]
mov rcx, rax
mov dword [rbp - 0x16], 0x417845
mov word [rbp - 0x20], 0x6552
mov dword [rbp - 0x1d], 0x6e65704f
mov word [rbp - 0x19], 0x654b
mov byte [rbp - 0x1e], 0x67
mov byte [rbp - 0x17], 0x79
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010ed4
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rdi
call rax
jmp 0x180010ed9
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret

Function at 0x180010f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x30]
mov rbx, rdx
mov word [rbp - 0x17], 0x6946
mov dword [rbp - 0x1c], 0x6c75646f
mov dword [rbp - 0x20], 0x4d746547
mov word [rbp - 0x12], 0x6d61
mov byte [rbp - 0x18], 0x65
mov word [rbp - 0xf], 0x41
mov word [rbp - 0x14], 0x4e65
mov byte [rbp - 0x15], 0x6c
mov byte [rbp - 0x10], 0x65
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010f97
mov r8d, 0x104
mov rdx, rbx
xor ecx, ecx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x180010fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
mov rsi, r9
mov rdi, r8
mov ebx, edx
mov word [rbp - 0x2c], 0x3233
mov dword [rbp - 0x2a], 0x6c6c642e
mov word [rbp - 0x2f], 0x6573
mov byte [rbp - 0x26], 0
mov byte [rbp - 0x30], 0x55
mov byte [rbp - 0x2d], 0x72
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180011059
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x14], 0x7845
mov byte [rbp - 0x12], 0
mov dword [rbp - 0x19], 0x6f6f4874
mov dword [rbp - 0x1d], 0x78654e6c
mov word [rbp - 0x1f], 0x6c61
mov byte [rbp - 0x15], 0x6b
mov byte [rbp - 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011059
mov r9, rsi
mov r8, rdi
mov edx, ebx
xor ecx, ecx
call rax
jmp 0x18001105b
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov r9, r8
mov r8, rdx
mov edx, ecx
jmp 0x180010fc0

Function at 0x180011080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov rsi, r8
mov rdi, rdx
mov word [rbp - 0x12], 0x6e6f
mov dword [rbp - 0x17], 0x74637572
mov word [rbp - 0xf], 0x6361
mov word [rbp - 0x1a], 0x736e
mov word [rbp - 0xc], 0x65
mov byte [rbp - 0x10], 0x43
mov dword [rbp - 0x1f], 0x6873756c
mov byte [rbp - 0x18], 0x74
mov byte [rbp - 0x20], 0x46
mov byte [rbp - 0xd], 0x68
mov byte [rbp - 0x1b], 0x49
mov byte [rbp - 0x13], 0x69
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011129
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x180011240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov rdi, rdx
mov word [rbp - 0x19], 0x4e32
mov word [rbp - 0x1c], 0x6461
mov dword [rbp - 0x17], 0x747865
mov byte [rbp - 0x1a], 0x33
mov word [rbp - 0x1f], 0x7268
mov byte [rbp - 0x1d], 0x65
mov byte [rbp - 0x20], 0x54
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800112cd
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x1800112f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov rdi, rdx
mov dword [rbp - 0x1d], 0x33646165
mov word [rbp - 0x17], 0x7269
mov word [rbp - 0x14], 0x74
mov word [rbp - 0x19], 0x4632
mov word [rbp - 0x1f], 0x7268
mov byte [rbp - 0x20], 0x54
mov byte [rbp - 0x15], 0x73
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001137f
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x1800113b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x40]
mov ebx, edx
mov dword [rbp - 0x1c], 0x746f6873
mov dword [rbp - 0x2e], 0x65746165
mov word [rbp - 0x22], 0x3233
mov word [rbp - 0x28], 0x6c6f
mov word [rbp - 0x30], 0x7243
mov word [rbp - 0x25], 0x6c65
mov word [rbp - 0x1f], 0x616e
mov word [rbp - 0x2a], 0x6f54
mov byte [rbp - 0x26], 0x68
mov byte [rbp - 0x1d], 0x70
mov byte [rbp - 0x18], 0
mov byte [rbp - 0x23], 0x70
mov byte [rbp - 0x20], 0x53
mov dword [rbp - 0x39], 0x6c642e32
mov word [rbp - 0x35], 0x6c
mov dword [rbp - 0x3f], 0x656e7265
mov word [rbp - 0x3b], 0x336c
mov byte [rbp - 0x40], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011458
mov edx, ebx
mov ecx, 4
call rax
jmp 0x18001145c
or rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x180011600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x30]
mov word [rbp - 0x11], 0x64
mov dword [rbp - 0x1a], 0x746e6572
mov word [rbp - 0x20], 0x6547
mov word [rbp - 0x1d], 0x7543
mov dword [rbp - 0x16], 0x65726854
mov byte [rbp - 0x1e], 0x74
mov byte [rbp - 0x1b], 0x72
mov byte [rbp - 0x12], 0x61
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011691
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180014280
add rsp, 0x50
pop rbp
ret
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180014280
add rsp, 0x50
pop rbp
ret

Function at 0x1800116b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x30]
mov rsi, r9
mov rdi, r8
mov ebx, edx
mov word [rbp - 0x2c], 0x3233
mov dword [rbp - 0x2a], 0x6c6c642e
mov word [rbp - 0x2f], 0x6573
mov byte [rbp - 0x26], 0
mov byte [rbp - 0x30], 0x55
mov byte [rbp - 0x2d], 0x72
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180011059
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x14], 0x7845
mov byte [rbp - 0x12], 0
mov dword [rbp - 0x19], 0x6f6f4874
mov dword [rbp - 0x1d], 0x78654e6c
mov word [rbp - 0x1f], 0x6c61
mov byte [rbp - 0x15], 0x6b
mov byte [rbp - 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011059
mov r9, rsi
mov r8, rdi
mov edx, ebx
xor ecx, ecx
call rax
jmp 0x18001105b
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180014280
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov r9, r8
mov r8, rdx
mov edx, ecx
jmp 0x180010fc0
Function at 0x1800116d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp + 0x60], rax
cmp edx, 1
jne 0x1800117f6
lea rdx, [rsp + 0x50]
call fcn.180010f00
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x46], 0x75732074
mov dword [rsp + 0x4c], 0x74726f
mov dword [rsp + 0x41], 0x6174736e
mov word [rsp + 0x4a], 0x7070
mov byte [rsp + 0x40], 0x69
mov byte [rsp + 0x45], 0x6e
mov dword [rsp + 0x30], 0x776c6853
mov dword [rsp + 0x34], 0x2e697061
mov word [rsp + 0x39], 0x6c6c
mov byte [rsp + 0x3b], 0
mov byte [rsp + 0x38], 0x64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x18001179c
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x25], 0x414972
mov word [rsp + 0x23], 0x7453
mov word [rsp + 0x20], 0x7453
mov byte [rsp + 0x22], 0x72
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001179c
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call rax
test rax, rax
jne 0x18001182a
lea rdx, [sym.drvhlp.dll_mae8c4]
lea rcx, [0x18005c9b0]
call fcn.180013720
test eax, eax
je 0x18001182a
lea rdx, [sym.drvhlp.dll_vhspeo]
lea rcx, [0x18005c990]
call fcn.180013720
test eax, eax
je 0x18001182a
lea rdx, [sym.drvhlp.dll_ir3pbi]
lea rcx, [0x18005ca30]
call fcn.180013720
test eax, eax
je 0x18001182a
lea rdx, [sym.drvhlp.dll_p6vxtz]
lea rcx, [0x18005c9e8]
call fcn.180013720
jmp 0x18001182a
test edx, edx
jne 0x18001182a
lea rcx, [0x18005c9b0]
call fcn.1800122c0
lea rcx, [0x18005c990]
call fcn.1800122c0
lea rcx, [0x18005ca30]
call fcn.1800122c0
lea rcx, [0x18005c9e8]
call fcn.1800122c0
mov eax, 1
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.180014280
add rsp, 0x170
pop rbp
ret
Function at 0x1800118a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x1800303c0]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rbx, rcx
lea rcx, [rsp + 0x48]
call fcn.180012df0
cmp qword [rax + 0x18], 0x10
jb 0x1800118e2
mov rax, qword [rax]
lea rcx, [rsp + 0x38]
mov rdx, rax
mov qword [rsp + 0x20], rcx
call fcn.180010e30
cmp qword [rsp + 0x60], 0x10
movsxd rdi, eax
jb 0x180011909
mov rcx, qword [rsp + 0x48]
call fcn.180015094
test rdi, rdi
jne 0x180011ac1
lea rcx, [rbp + 0x91]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x90], dil
call fcn.180017c80
mov rdi, qword [rsp + 0x38]
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x7a], 0x736c61
mov word [rsp + 0x78], 0x7668
mov dword [rsp + 0x71], 0x6c6c64
mov dword [rsp + 0x6d], 0x2e323369
mov word [rsp + 0x6b], 0x7061
mov word [rsp + 0x68], 0x6441
mov byte [rsp + 0x6a], 0x76
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180011ab7
lea rdx, [rsp + 0x48]
mov rcx, rax
mov dword [rsp + 0x54], 0x41784565
mov dword [rsp + 0x50], 0x756c6156
mov word [rsp + 0x4b], 0x7551
mov word [rsp + 0x48], 0x6552
mov word [rsp + 0x4d], 0x7265
mov byte [rsp + 0x4f], 0x79
mov byte [rsp + 0x4a], 0x67
mov byte [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011ab7
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x90]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, rdi
call rax
test eax, eax
jne 0x180011ab7
cmp dword [rsp + 0x40], eax
jbe 0x180011ab7
lea rcx, [rbp - 0x7f]
xor edx, edx
mov r8d, 0x103
mov byte [rbp - 0x80], al
call fcn.180017c80
lea r9, [rsp + 0x30]
lea rcx, [rbp - 0x80]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov word [rsp + 0x30], 0x6425
mov byte [rsp + 0x32], 0
mov qword [rsp + 0x20], rbx
call fcn.180014edc
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x68], 0x776c6853
mov dword [rsp + 0x6c], 0x2e697061
mov word [rsp + 0x71], 0x6c6c
mov byte [rsp + 0x73], 0
mov byte [rsp + 0x70], 0x64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180011ab7
lea rdx, [rsp + 0x48]
mov rcx, rax
mov dword [rsp + 0x4d], 0x414972
mov word [rsp + 0x4b], 0x7453
mov word [rsp + 0x48], 0x7453
mov byte [rsp + 0x4a], 0x72
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011ab7
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x90]
call rax
test rax, rax
je 0x180011ab7
mov rcx, qword [rsp + 0x38]
call fcn.180010d80
mov rax, rbx
jmp 0x180011aca
mov rcx, qword [rsp + 0x38]
call fcn.180010d80
mov rcx, rbx
call qword [0x18005ca30]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.180014280
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret