joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180009390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180009405
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180009405
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1800093f5
nop
cmp rbx, rcx
jae 0x180009405
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1800093e0
cmp rbx, rcx
jae 0x180009405
cmp word [rbx], 0
je 0x180009405
mov rax, rbx
jmp 0x180009407
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18000f2c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r11d, r11d
mov dword [rsp], 0x4f0053
lea r10, [0x180176b48]
mov dword [rsp + 4], 0x540046
lea r9, [rsp]
mov dword [rsp + 8], 0x410057
mov dword [rsp + 0xc], 0x450052
mov rcx, r10
lea r8d, [r11 + 0x14]
mov dword [rsp + 0x10], 0x4d005c
mov dword [rsp + 0x14], 0x520070
sub r9, r10
mov dword [rsp + 0x18], 0x730065
mov dword [rsp + 0x1c], 0x720065
mov dword [rsp + 0x20], 0x650076
mov word [rsp + 0x24], r11w
nop dword [rax + rax]
lea rax, [r8 + 0x7fffffea]
test rax, rax
je 0x18000f363
movzx edx, word [r9 + rcx]
test dx, dx
je 0x18000f363
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x18000f340
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x38
ret

Function at 0x18000f390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r11d, r11d
mov dword [rsp], 0x4f0053
lea r10, [0x180176b70]
mov dword [rsp + 4], 0x540046
lea r9, [rsp]
mov dword [rsp + 8], 0x410057
mov dword [rsp + 0xc], 0x450052
mov rcx, r10
lea r8d, [r11 + 0x14]
mov dword [rsp + 0x10], 0x4d005c
mov dword [rsp + 0x14], 0x520070
sub r9, r10
mov dword [rsp + 0x18], 0x730065
mov dword [rsp + 0x1c], 0x720065
mov dword [rsp + 0x20], 0x650076
mov word [rsp + 0x24], r11w
nop dword [rax + rax]
lea rax, [r8 + 0x7fffffea]
test rax, rax
je 0x18000f433
movzx edx, word [r9 + rcx]
test dx, dx
je 0x18000f433
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x18000f410
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x38
ret

Function at 0x18000f500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x20], rax
xor r11d, r11d
mov dword [rsp], 0x6f0043
lea r10, [0x180176ba0]
mov dword [rsp + 4], 0x70006d
lea r9, [rsp]
mov dword [rsp + 8], 0x740075
mov dword [rsp + 0xc], 0x720065
mov rcx, r10
lea r8d, [r11 + 0x11]
mov dword [rsp + 0x10], 0x31005a
mov dword [rsp + 0x14], 0x2e0034
sub r9, r10
mov dword [rsp + 0x18], 0x780065
mov dword [rsp + 0x1c], 0x65
nop word [rax + rax]
lea rax, [r8 + 0x7fffffed]
test rax, rax
je 0x18000f593
movzx edx, word [r9 + rcx]
test dx, dx
je 0x18000f593
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x18000f570
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x38
ret
Function at 0x180011040
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, [0x180011a30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call fcn.1800d76ec
mov rcx, rax
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
Function at 0x180022ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x20], rax
lea r10, [0x180176e40]
mov dword [rsp], 0x720070
mov edx, 0x70
mov dword [rsp + 4], 0x63006f
xor r11d, r11d
mov dword [rsp + 8], 0x780065
lea r9, [rsp]
mov dword [rsp + 0xc], 0x360070
mov dword [rsp + 0x10], 0x2e0034
mov rcx, r10
lea r8d, [rdx - 0x61]
mov dword [rsp + 0x14], 0x780065
mov dword [rsp + 0x18], 0x65
sub r9, r10
nop word [rax + rax]
lea rax, [r8 + 0x7fffffef]
test rax, rax
je 0x180022b43
movzx edx, word [r9 + rcx]
test dx, dx
je 0x180022b43
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x180022b20
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x38
ret

Function at 0x180022b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x20], rax
xor r11d, r11d
mov dword [rsp], 0x720070
lea r10, [0x180176e20]
mov dword [rsp + 4], 0x63006f
lea r9, [rsp]
mov dword [rsp + 8], 0x6f006d
mov dword [rsp + 0xc], 0x36006e
mov rcx, r10
lea r8d, [r11 + 0xf]
mov dword [rsp + 0x10], 0x2e0034
mov dword [rsp + 0x14], 0x780065
sub r9, r10
mov dword [rsp + 0x18], 0x65
lea rax, [r8 + 0x7fffffef]
test rax, rax
je 0x180022bf5
movzx edx, word [r9 + rcx]
test dx, dx
je 0x180022bf5
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x180022bd2
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x38
ret

Function at 0x180022c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x20], rax
xor r11d, r11d
mov dword [rsp], 0x700073
lea r10, [0x180176ce8]
mov dword [rsp + 4], 0x780079
lea r9, [rsp]
mov dword [rsp + 8], 0x5f0078
mov dword [rsp + 0xc], 0x6d0061
mov rcx, r10
lea r8d, [r11 + 0x11]
mov dword [rsp + 0x10], 0x360064
mov dword [rsp + 0x14], 0x2e0034
sub r9, r10
mov dword [rsp + 0x18], 0x780065
mov dword [rsp + 0x1c], 0x65
nop word [rax + rax]
lea rax, [r8 + 0x7fffffed]
test rax, rax
je 0x180022cb3
movzx edx, word [r9 + rcx]
test dx, dx
je 0x180022cb3
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x180022c90
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x38
ret
Function at 0x180022ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x28
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x18], rax
xor r11d, r11d
mov dword [rsp], 0x690066
lea r10, [0x180176c78]
mov dword [rsp + 4], 0x640064
lea r9, [rsp]
mov dword [rsp + 8], 0x65006c
mov dword [rsp + 0xc], 0x2e0072
mov rcx, r10
lea r8d, [r11 + 0xd]
mov dword [rsp + 0x10], 0x780065
mov dword [rsp + 0x14], 0x65
sub r9, r10
nop word [rax + rax]
lea rax, [r8 + 0x7ffffff1]
test rax, rax
je 0x180022d63
movzx edx, word [r9 + rcx]
test dx, dx
je 0x180022d63
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x180022d40
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x28
ret

Function at 0x180022d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r11d, r11d
mov dword [rsp], 0x750073
lea r10, [0x180176ed8]
mov dword [rsp + 4], 0x6c006e
mov edx, 0x6c
mov dword [rsp + 8], 0x67006f
lea r9, [rsp]
mov dword [rsp + 0xc], 0x6e0069
mov dword [rsp + 0x10], 0x6c0063
mov rcx, r10
mov dword [rsp + 0x14], 0x650069
sub r9, r10
lea r8d, [rdx - 0x58]
mov dword [rsp + 0x18], 0x74006e
mov dword [rsp + 0x1c], 0x65002e
mov dword [rsp + 0x20], 0x650078
mov word [rsp + 0x24], r11w
nop dword [rax]
lea rax, [r8 + 0x7fffffea]
test rax, rax
je 0x180022e33
movzx edx, word [r9 + rcx]
test dx, dx
je 0x180022e33
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x180022e10
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x38
ret

Function at 0x180022e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x28
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x18], rax
xor r11d, r11d
mov dword [rsp], 0x690077
lea r10, [0x180176c48]
mov dword [rsp + 4], 0x64006e
lea r9, [rsp]
mov dword [rsp + 8], 0x670062
mov dword [rsp + 0xc], 0x65002e
mov rcx, r10
lea r8d, [r11 + 0xc]
mov dword [rsp + 0x10], 0x650078
mov word [rsp + 0x14], r11w
sub r9, r10
nop dword [rax + rax]
lea rax, [r8 + 0x7ffffff2]
test rax, rax
je 0x180022ee3
movzx edx, word [r9 + rcx]
test dx, dx
je 0x180022ee3
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x180022ec0
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x28
ret
Function at 0x180022f10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x28
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x18], rax
xor r11d, r11d
mov dword [rsp], 0x640069
lea r10, [0x180176da8]
mov dword [rsp + 4], 0x710061
lea r9, [rsp]
mov dword [rsp + 8], 0x340036
mov dword [rsp + 0xc], 0x65002e
mov rcx, r10
lea r8d, [r11 + 0xc]
mov dword [rsp + 0x10], 0x650078
mov word [rsp + 0x14], r11w
sub r9, r10
nop dword [rax + rax]
lea rax, [r8 + 0x7ffffff2]
test rax, rax
je 0x180022f93
movzx edx, word [r9 + rcx]
test dx, dx
je 0x180022f93
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x180022f70
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x28
ret

Function at 0x180022fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov edx, 0x65
mov dword [rsp], 0x690077
lea r10, [0x180176c98]
mov dword [rsp + 4], 0x650072
xor r11d, r11d
mov dword [rsp + 8], 0x680073
lea r9, [rsp]
mov dword [rsp + 0xc], 0x720061
lea r8d, [rdx - 0x56]
mov dword [rsp + 0x10], 0x2e006b
mov dword [rsp + 0x14], 0x780065
mov rcx, r10
mov dword [rsp + 0x18], edx
sub r9, r10
lea rax, [r8 + 0x7fffffef]
test rax, rax
je 0x180023046
movzx edx, word [r9 + rcx]
test dx, dx
je 0x180023046
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x180023023
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x38
ret

Function at 0x180023070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x20], rax
xor r11d, r11d
mov dword [rsp], 0x620064
lea r10, [0x180176ea0]
mov dword [rsp + 4], 0x780067
mov edx, 0x2e
mov dword [rsp + 8], 0x73002e
lea r9, [rsp]
mov dword [rsp + 0xc], 0x650068
mov dword [rsp + 0x10], 0x6c006c
mov rcx, r10
mov dword [rsp + 0x14], 0x65002e
sub r9, r10
lea r8d, [rdx - 0x1e]
mov dword [rsp + 0x18], 0x650078
mov word [rsp + 0x1c], r11w
nop dword [rax]
lea rax, [r8 + 0x7fffffee]
test rax, rax
je 0x180023103
movzx edx, word [r9 + rcx]
test dx, dx
je 0x180023103
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x1800230e0
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x38
ret
Function at 0x180023130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x28
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x18], rax
xor r11d, r11d
mov dword [rsp], 0x6d0073
lea r10, [0x180176d10]
mov dword [rsp + 4], 0x6e0073
lea r9, [rsp]
mov dword [rsp + 8], 0x660069
mov dword [rsp + 0xc], 0x2e0066
mov rcx, r10
lea r8d, [r11 + 0xd]
mov dword [rsp + 0x10], 0x780065
mov dword [rsp + 0x14], 0x65
sub r9, r10
nop word [rax + rax]
lea rax, [r8 + 0x7ffffff1]
test rax, rax
je 0x1800231b3
movzx edx, word [r9 + rcx]
test dx, dx
je 0x1800231b3
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x180023190
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x28
ret

Function at 0x1800231e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x28
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x18], rax
mov edx, 0x65
mov dword [rsp], 0x720070
lea r10, [0x180176e00]
mov dword [rsp + 4], 0x63006f
xor r11d, r11d
mov dword [rsp + 8], 0x780065
lea r9, [rsp]
mov dword [rsp + 0xc], 0x2e0070
lea r8d, [rdx - 0x58]
mov dword [rsp + 0x10], 0x780065
mov dword [rsp + 0x14], edx
mov rcx, r10
sub r9, r10
nop dword [rax + rax]
lea rax, [r8 + 0x7ffffff1]
test rax, rax
je 0x180023263
movzx edx, word [r9 + rcx]
test dx, dx
je 0x180023263
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x180023240
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x28
ret

Function at 0x180023290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x28
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x18], rax
xor r11d, r11d
mov dword [rsp], 0x6c006f
lea r10, [0x180176d58]
mov dword [rsp + 4], 0x79006c
lea r9, [rsp]
mov dword [rsp + 8], 0x620064
mov dword [rsp + 0xc], 0x2e0067
mov rcx, r10
lea r8d, [r11 + 0xd]
mov dword [rsp + 0x10], 0x780065
mov dword [rsp + 0x14], 0x65
sub r9, r10
nop word [rax + rax]
lea rax, [r8 + 0x7ffffff1]
test rax, rax
je 0x180023313
movzx edx, word [r9 + rcx]
test dx, dx
je 0x180023313
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x1800232f0
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x28
ret
Function at 0x180023340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r11d, r11d
mov dword [rbp - 0x40], 0x650054
lea r10, [0x180176f20]
mov dword [rbp - 0x3c], 0x6d0061
lea r9, [rbp - 0x40]
mov dword [rbp - 0x38], 0x690056
mov dword [rbp - 0x34], 0x770065
mov rcx, r10
lea r8d, [r11 + 0x18]
mov dword [rbp - 0x30], 0x720065
mov dword [rbp - 0x2c], 0x44005f
sub r9, r10
mov dword [rbp - 0x28], 0x730065
mov dword [rbp - 0x24], 0x74006b
mov dword [rbp - 0x20], 0x70006f
mov dword [rbp - 0x1c], 0x65002e
mov dword [rbp - 0x18], 0x650078
mov word [rbp - 0x14], r11w
lea rax, [r8 + 0x7fffffe6]
test rax, rax
je 0x1800233e4
movzx edx, word [r9 + rcx]
test dx, dx
je 0x1800233e4
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x1800233c1
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x40
pop rbp
ret

Function at 0x180023410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x28
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x18], rax
xor r11d, r11d
mov dword [rsp], 0x650064
lea r10, [0x180176cb8]
mov dword [rsp + 4], 0x650076
mov edx, 0x65
mov dword [rsp + 8], 0x76006e
lea r9, [rsp]
mov dword [rsp + 0xc], 0x65002e
mov dword [rsp + 0x10], 0x650078
mov rcx, r10
mov word [rsp + 0x14], r11w
sub r9, r10
lea r8d, [rdx - 0x59]
nop dword [rax]
lea rax, [r8 + 0x7ffffff2]
test rax, rax
je 0x180023493
movzx edx, word [r9 + rcx]
test dx, dx
je 0x180023493
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x180023470
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x28
ret

Function at 0x1800234c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x20], rax
lea r10, [0x180176d30]
mov dword [rsp], 0x69006d
mov edx, 0x69
mov dword [rsp + 4], 0x69006e
xor r11d, r11d
mov dword [rsp + 8], 0x6e0073
lea r9, [rsp]
mov dword [rsp + 0xc], 0x660069
mov dword [rsp + 0x10], 0x650066
mov rcx, r10
lea r8d, [rdx - 0x58]
mov dword [rsp + 0x14], 0x2e0072
mov dword [rsp + 0x18], 0x780065
sub r9, r10
mov dword [rsp + 0x1c], 0x65
nop
lea rax, [r8 + 0x7fffffed]
test rax, rax
je 0x180023553
movzx edx, word [r9 + rcx]
test dx, dx
je 0x180023553
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x180023530
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x38
ret
Function at 0x180023580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x28
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x18], rax
xor r11d, r11d
mov dword [rsp], 0x720070
lea r10, [0x180176de0]
mov dword [rsp + 4], 0x63006f
lea r9, [rsp]
mov dword [rsp + 8], 0x6f006d
mov dword [rsp + 0xc], 0x2e006e
mov rcx, r10
lea r8d, [r11 + 0xd]
mov dword [rsp + 0x10], 0x780065
mov dword [rsp + 0x14], 0x65
sub r9, r10
nop word [rax + rax]
lea rax, [r8 + 0x7ffffff1]
test rax, rax
je 0x180023603
movzx edx, word [r9 + rcx]
test dx, dx
je 0x180023603
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x1800235e0
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x28
ret

Function at 0x180023630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov edx, 0x65
mov dword [rsp], 0x750073
lea r10, [0x180176e60]
mov dword [rsp + 4], 0x650070
xor r11d, r11d
mov dword [rsp + 8], 0x6b0072
lea r9, [rsp]
mov dword [rsp + 0xc], 0x6c0069
lea r8d, [rdx - 0x54]
mov dword [rsp + 0x10], 0x65006c
mov dword [rsp + 0x14], 0x2e0072
mov rcx, r10
mov dword [rsp + 0x18], 0x780065
sub r9, r10
mov dword [rsp + 0x1c], edx
nop dword [rax + rax]
lea rax, [r8 + 0x7fffffed]
test rax, rax
je 0x1800236c3
movzx edx, word [r9 + rcx]
test dx, dx
je 0x1800236c3
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x1800236a0
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x38
ret

Function at 0x1800236f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x28
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x18], rax
xor r11d, r11d
mov dword [rsp], 0x720068
lea r10, [0x180176dc0]
mov dword [rsp + 4], 0x770073
lea r9, [rsp]
mov dword [rsp + 8], 0x72006f
mov dword [rsp + 0xc], 0x2e0064
mov rcx, r10
lea r8d, [r11 + 0xd]
mov dword [rsp + 0x10], 0x780065
mov dword [rsp + 0x14], 0x65
sub r9, r10
nop word [rax + rax]
lea rax, [r8 + 0x7ffffff1]
test rax, rax
je 0x180023773
movzx edx, word [r9 + rcx]
test dx, dx
je 0x180023773
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x180023750
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1800a5130
add rsp, 0x28
ret
Function at 0x18002b3f0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x470
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, r8
mov rsi, rdx
mov qword [rsp + 0x40], rdx
xor edi, edi
mov dword [rsp + 0x34], edi
mov qword [rdx + 0x10], rdi
mov qword [rdx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdx], dil
xor r8d, r8d
lea rdx, [0x180112398]
mov rcx, rsi
call fcn.18000a3d0
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 1]
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r14, rax
test rax, rax
je 0x18002b59f
cmp qword [rbx + 0x18], 8
jb 0x18002b486
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x84000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbp, rax
test rax, rax
je 0x18002b596
mov dword [rsp + 0x30], edi
nop word [rax + rax]
xor edx, edx
mov r8d, 0x401
lea rcx, [rsp + 0x50]
call fcn.1800d4600
lea r9, [rsp + 0x30]
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x18002b582
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x18002b582
cmp rax, 0x401
jae 0x18002b5ca
mov byte [rsp + rax + 0x50], 0
lea rax, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x18002b520
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x18002b56a
lea rax, [rcx + rbx]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x18002b550
mov rax, qword [rsi]
lea rdi, [rax + rcx]
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1800d4190
mov byte [rdi + rbx], 0
jmp 0x18002b582
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.180008740
cmp dword [rsp + 0x30], 0
jne 0x18002b4c0
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rax, rsi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1800a5130
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1800a533c
int3
Function at 0x18002fa40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea r10, [0x180177160]
mov dword [rbp - 0x80], 0x4f0053
mov edx, 0x6e
mov dword [rbp - 0x7c], 0x540046
xor r11d, r11d
mov dword [rbp - 0x78], 0x410057
lea r9, [rbp - 0x80]
mov dword [rbp - 0x74], 0x450052
mov dword [rbp - 0x70], 0x4d005c
mov rcx, r10
lea r8d, [rdx - 0x39]
mov dword [rbp - 0x6c], 0x630069
mov dword [rbp - 0x68], 0x6f0072
sub r9, r10
mov dword [rbp - 0x64], 0x6f0073
mov dword [rbp - 0x60], 0x740066
mov dword [rbp - 0x5c], 0x57005c
mov dword [rbp - 0x58], 0x6e0069
mov dword [rbp - 0x54], 0x6f0064
mov dword [rbp - 0x50], 0x730077
mov dword [rbp - 0x4c], 0x43005c
mov dword [rbp - 0x48], 0x720075
mov dword [rbp - 0x44], 0x650072
mov dword [rbp - 0x40], 0x74006e
mov dword [rbp - 0x3c], 0x650056
mov dword [rbp - 0x38], 0x730072
mov dword [rbp - 0x34], 0x6f0069
mov dword [rbp - 0x30], 0x5c006e
mov dword [rbp - 0x2c], 0x6e0055
mov dword [rbp - 0x28], 0x6e0069
mov dword [rbp - 0x24], 0x740073
mov dword [rbp - 0x20], 0x6c0061
mov dword [rbp - 0x1c], 0x6c
nop word [rax + rax]
lea rax, [r8 + 0x7fffffc9]
test rax, rax
je 0x18002fb63
movzx edx, word [r9 + rcx]
test dx, dx
je 0x18002fb63
mov word [rcx], dx
add rcx, 2
sub r8, 1
jne 0x18002fb40
test r8, r8
lea rdx, [rcx - 2]
mov rax, r10
cmovne rdx, rcx
mov word [rdx], r11w
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800a5130
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret