joyce8/EMBER2024-capa huggingface dataset:
Function at 0x75b8bc408
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rdi, r8
mov rbx, rdx
mov rdx, rcx
lea r8, [0x75b91c090]
mov rcx, qword [0x75b91c090]
cmp rcx, r8
je 0x75b8bc476
test byte [rcx + 0x1c], 4
je 0x75b8bc476
mov rax, qword [rdi + 8]
add rax, qword [rdi]
mov r9, qword [rbx + 8]
add r9, qword [rbx]
mov edx, 0xf
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
call fcn.75b8bc140
mov rcx, qword [0x75b91c090]
mov rdx, qword [rsp + 0xc0]
lea r8, [0x75b91c090]
mov r12, qword [rbx + 8]
mov r13, qword [rbx]
lea rbp, [r12 + r13]
mov qword [rsp + 0xd8], rbp
mov rax, qword [rdi + 8]
mov qword [rsp + 0xc8], rax
mov r15, qword [rdi]
lea r14, [r15 + rax]
mov qword [rsp + 0x30], r14
cmp r14, rbp
je 0x75b8bc4cc
xor esi, esi
cmp r14, rbp
jge 0x75b8bc4df
cmp rcx, r8
je 0x75b8bc4cc
test byte [rcx + 0x1c], 1
je 0x75b8bc4cc
lea edx, [rsi + 0x10]
mov qword [rsp + 0x20], r14
mov r9, rbp
mov rcx, qword [rcx + 0x10]
call fcn.75b8bc140
xor eax, eax
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
add rdx, 0x10
mov r8, rbx
lea rcx, [rsp + 0x50]
call fcn.75b8bcef0
nop
mov ecx, 0x400
call fcn.75b8bded0
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rdi, [rax + 0x400]
mov qword [rsp + 0x48], rdi
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call fcn.75b8c0190
mov qword [rsp + 0x40], rdi
sub r15, r13
sub r15, r12
add r15, qword [rsp + 0xc8]
mov qword [rsp + 0xc8], 0
je 0x75b8bc604
mov r13, rdi
sub r13, rbx
mov rbp, qword [rsp + 0xc8]
mov r14, qword [rsp + 0xc0]
mov rax, r15
sub rax, rbp
cmp rax, r13
cmovae rax, r13
mov qword [rsp + 0xd0], rax
mov r8, rax
mov rdx, rbx
mov rcx, r14
call fcn.75b8b65c0
xor r12d, r12d
mov r8, r13
mov rdx, qword [rsp + 0xd0]
cmp rdx, r13
cmovbe r8, rdx
mov rax, r8
shr rax, 2
and r8d, 3
xor ecx, ecx
test rax, rax
je 0x75b8bc5b2
xor r12d, dword [rcx + rbx]
add rcx, 4
sub rax, 1
jne 0x75b8bc5a4
test r8, r8
je 0x75b8bc5e8
xor eax, eax
mov dword [rsp + 0xc8], eax
test r8, r8
je 0x75b8bc5e5
lea rdx, [rcx + rbx]
lea rcx, [rsp + 0xc8]
call fcn.75b8cb300
mov eax, dword [rsp + 0xc8]
mov rdx, qword [rsp + 0xd0]
xor r12d, eax
xor esi, r12d
add rbp, rdx
cmp rbp, r15
jb 0x75b8bc55a
mov rbp, qword [rsp + 0xd8]
mov r14, qword [rsp + 0x30]
test rbx, rbx
je 0x75b8bc639
sub rdi, rbx
cmp rdi, 0x1000
jb 0x75b8bc62d
add rdi, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x75b8bc692
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.75b8bdec8
nop
mov rdx, qword [rsp + 0x58]
add rdx, qword [rsp + 0x60]
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call fcn.75b8bce10
nop
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b8bc68b
test byte [rcx + 0x1c], 4
je 0x75b8bc68b
mov edx, 0x11
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
mov r9, rbp
lea r8, [0x75b8f8150]
mov rcx, qword [rcx + 0x10]
call fcn.75b84b8b8
mov eax, esi
jmp 0x75b8bc4ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x75b8cbe10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x75b8cbe38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x75b8cbe38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180013870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rbx, r8
lea rcx, [rbp - 0x4e]
xor edi, edi
xor edx, edx
mov r8d, 0x1fe
mov word [rbp - 0x50], di
call fcn.180008040
lea rcx, [rsp + 0x40]
mov qword [rbp + 0x1d8], rdi
mov dword [rsp + 0x40], 0x786f4256
mov dword [rsp + 0x44], 0x642e5452
mov word [rsp + 0x48], 0x6c6c
mov byte [rsp + 0x4a], dil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800138ec
mov r8, rbx
xor edx, edx
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
jmp 0x1800139f3
test rbx, rbx
jne 0x180013901
lea ecx, [rbx + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800139f3
lea rax, [rbp - 0x50]
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [0x18007b950]
test rax, rax
jne 0x180013993
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x6c64746e
mov dword [rsp + 0x34], 0x6c642e6c
mov word [rsp + 0x38], 0x6c
mov dword [rsp + 0x50], 0x496c7452
mov dword [rsp + 0x54], 0x5574696e
mov dword [rsp + 0x58], 0x6f63696e
mov dword [rsp + 0x5c], 0x74536564
mov dword [rsp + 0x60], 0x676e6972
mov byte [rsp + 0x64], dil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007b950], rax
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x70]
call rax
mov rax, qword [0x18007b068]
xor edx, edx
lea r9, [rbp + 0x1d8]
lea r8, [rsp + 0x70]
lea rcx, [rbp - 0x80]
test rax, rax
jne 0x1800139c3
call fcn.180013c00
jmp 0x1800139c5
call rax
test eax, eax
jns 0x1800139d4
mov ecx, eax
call fcn.180013e00
xor eax, eax
jmp 0x1800139f3
mov r8, qword [rbp + 0x1d8]
lea rcx, [rsp + 0x68]
mov edx, 0xf001f
call fcn.180013e90
test eax, eax
js 0x1800139c9
mov rax, qword [rsp + 0x68]
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x180013a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x786f4256
mov dword [rsp + 0x24], 0x642e5452
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x2a], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180013a54
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add rsp, 0x30
pop rdi
ret
mov rdx, rdi
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x40], rbx
call fcn.180014080
mov ebx, eax
test eax, eax
jns 0x180013aa6
cmp eax, 0xc0000045
jne 0x180013a92
xor edx, edx
mov rcx, rdi
call fcn.1800186d0
test al, al
je 0x180013a92
mov rdx, rdi
or rcx, 0xffffffffffffffff
call fcn.180014080
mov ebx, eax
test eax, eax
jns 0x180013aa6
mov ecx, ebx
call fcn.180013e00
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800148e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x30
lea rcx, [rsp + 0x20]
mov rbx, rdx
mov dword [rsp + 0x20], 0x72657375
mov dword [rsp + 0x24], 0x642e3233
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x2a], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rax
test rax, rax
je 0x1800149a8
mov ecx, dword [rbx + 0x100045c]
mov dword [0x18007b048], ecx
cmp ecx, 0xffff
jne 0x180014954
mov eax, dword [rbx + 0x1000458]
add rax, 6
add rax, rdx
mov qword [0x18007b878], rax
call fcn.180017d40
mov eax, 1
add rsp, 0x30
pop rbx
ret
cmp ecx, 0xfffe
jne 0x180014968
mov ecx, dword [rbx + 0x1000458]
add rcx, 0xb
jmp 0x18001498e
cmp ecx, 0xfffd
jne 0x18001497c
mov ecx, dword [rbx + 0x1000458]
add rcx, 6
jmp 0x18001498e
cmp ecx, 0xfffc
mov ecx, dword [rbx + 0x1000458]
je 0x180014976
add rcx, 7
add rcx, rax
mov qword [0x18007b878], rcx
call fcn.180017d40
mov eax, 1
add rsp, 0x30
pop rbx
ret
add rsp, 0x30
pop rbx
ret
Function at 0x1800184f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x18007c0c0]
xor ebx, ebx
lea rcx, [0x18007ad70]
lea r8d, [rbx + 0x60]
xor edx, edx
mov dword [0x18007b940], ebx
mov dword [0x180076d50], ebx
mov dword [0x18007b894], ebx
mov dword [0x18007b970], ebx
mov dword [0x18007b890], ebx
mov dword [0x18007b060], ebx
mov dword [0x18007ad60], ebx
mov dword [0x18007b968], ebx
mov dword [0x18007adf0], ebx
mov dword [0x18007ad6c], ebx
mov dword [0x18007b874], ebx
mov dword [0x180048620], 1
mov dword [0x18004861c], 1
mov dword [0x18007b948], ebx
mov dword [0x180076d54], ebx
mov dword [0x180048624], 1
mov dword [0x18007b03c], ebx
mov dword [0x18007b064], ebx
mov dword [0x18007b934], ebx
mov qword [0x180076d48], rbx
mov qword [0x18007b888], rbx
mov qword [0x18007b040], rbx
mov qword [0x18007b928], rbx
mov dword [0x180048618], 1
mov dword [0x180048610], 1
mov dword [0x18007b05c], ebx
mov dword [0x18007b8b4], ebx
mov dword [0x18007b8ac], ebx
mov qword [0x180076d38], rbx
mov qword [0x18007c0c8], rax
call fcn.180008040
lea r8d, [rbx + 0x60]
lea rcx, [0x18007b8c0]
xor edx, edx
call fcn.180008040
mov dword [0x18007b04c], ebx
mov dword [0x18007ad64], ebx
movsd xmm0, qword [0x180041638]
movsd qword [0x180048628], xmm0
mov dword [0x180076d44], ebx
mov dword [0x18007b8a4], ebx
mov dword [0x18007b870], ebx
mov dword [0x18007adf8], ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x180076d58]
mov dword [0x18007b930], eax
mov dword [0x18007b8b0], eax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x180076d58]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x6d6e6977
mov dword [rbp - 0x1c], 0x6c642e6d
mov word [rbp - 0x18], 0x6c
mov qword [0x180076d30], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800186bb
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x10], 0x656d6974
mov dword [rbp - 0xc], 0x54746547
mov dword [rbp - 8], 0x656d69
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800186bb
call rax
mov dword [0x18007adfc], eax
mov dword [0x18007b058], eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1800186d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18007add0]
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x180018756
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x6c64746e
mov dword [rbp - 0x2c], 0x6c642e6c
mov word [rbp - 0x28], 0x6c
mov dword [rbp - 0x20], 0x466c7452
mov dword [rbp - 0x1c], 0x6873756c
mov dword [rbp - 0x18], 0x75636553
mov dword [rbp - 0x14], 0x654d6572
mov dword [rbp - 0x10], 0x79726f6d
mov dword [rbp - 0xc], 0x68636143
mov word [rbp - 8], 0x65
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007add0], rax
mov rdx, rbx
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18001a030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp qword [0x18007b9d0], 0
je 0x18001a04e
mov eax, 1
add rsp, 0x50
pop rbp
ret
mov rcx, qword [sym.imp.USER32.dll_GetCursorPos]
mov r8d, 0x14
call fcn.18001a5e0
mov rcx, qword [sym.imp.USER32.dll_GetCursorPos]
mov r8d, 0xa
mov qword [0x18007b9d0], rax
call fcn.18001a4e0
mov dword [0x18007b9a0], eax
call fcn.18001a1f0
test eax, eax
jne 0x18001a10c
mov rcx, qword [sym.imp.USER32.dll_SetCursorPos]
lea r8d, [rax + 0xd]
call fcn.18001a4e0
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x72657375
mov dword [rbp - 0x2c], 0x642e3233
mov word [rbp - 0x28], 0x6c6c
mov byte [rbp - 0x26], 0
mov dword [0x18007b9b4], eax
mov dword [rbp - 0x20], 0x50746553
mov dword [rbp - 0x1c], 0x69737968
mov dword [rbp - 0x18], 0x436c6163
mov dword [rbp - 0x14], 0x6f737275
mov dword [rbp - 0x10], 0x736f5072
mov byte [rbp - 0xc], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, 0xd
mov rcx, rax
call fcn.18001a4e0
mov dword [0x18007b978], eax
xor eax, eax
cmp qword [0x18007b9d0], rax
setne al
add rsp, 0x50
pop rbp
ret

Function at 0x18001a130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp qword [0x18007b990], 0
je 0x18001a14e
mov eax, 1
add rsp, 0x50
pop rbp
ret
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x336e6977
mov dword [rbp - 0x2c], 0x642e7532
mov word [rbp - 0x28], 0x6c6c
mov byte [rbp - 0x26], 0
mov dword [rbp - 0x20], 0x7355744e
mov dword [rbp - 0x1c], 0x65477265
mov dword [rbp - 0x18], 0x72754374
mov dword [rbp - 0x14], 0x50726f73
mov word [rbp - 0x10], 0x736f
mov byte [rbp - 0xe], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001a1ca
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov qword [0x18007b990], rax
xor eax, eax
test rcx, rcx
setne al
add rsp, 0x50
pop rbp
ret
mov rcx, qword [0x18007b990]
xor eax, eax
test rcx, rcx
setne al
add rsp, 0x50
pop rbp
ret
Function at 0x18001a1f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
cmp qword [0x18007b9a8], 0
jne 0x18001a31b
cmp qword [0x18007b980], 0
jne 0x18001a31b
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x336e6977
mov dword [rbp - 0x4c], 0x642e7532
mov word [rbp - 0x48], 0x6c6c
mov byte [rbp - 0x46], 0
mov dword [rbp - 0x20], 0x7355744e
mov dword [rbp - 0x1c], 0x65537265
mov dword [rbp - 0x18], 0x72754374
mov dword [rbp - 0x14], 0x50726f73
mov word [rbp - 0x10], 0x736f
mov byte [rbp - 0xe], 0
mov dword [rbp - 0x40], 0x72657375
mov dword [rbp - 0x3c], 0x642e3233
mov word [rbp - 0x38], 0x6c6c
mov byte [rbp - 0x36], 0
mov dword [rbp - 0x30], 0x43746553
mov dword [rbp - 0x2c], 0x6f737275
mov dword [rbp - 0x28], 0x736f5072
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001a2ff
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [rax], 0xff
jne 0x18001a2b5
cmp byte [rax + 1], 0x25
je 0x18001a2c1
cmp byte [rax + 1], 0xff
jne 0x18001a2e1
cmp byte [rax + 2], 0x25
jne 0x18001a2e1
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007b980], rax
jmp 0x18001a2ff
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007b9a8], rax
cmp qword [0x18007b9a8], 0
jne 0x18001a31b
cmp qword [0x18007b980], 0
jne 0x18001a31b
xor eax, eax
add rsp, 0x70
pop rbp
ret
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x18001b060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
xor r13d, r13d
mov r15, rcx
lea rcx, [rsp + 0x50]
mov edi, r13d
mov r12, rdx
mov dword [rsp + 0x50], 0x6c64746e
mov dword [rsp + 0x54], 0x6c642e6c
mov dword [rsp + 0x58], 0x6c
mov dword [rsp + 0x30], 0x7551775a
mov byte [rsp + 0x5c], dil
mov dword [rsp + 0x48], edi
mov byte [rsp + 0x4c], dil
mov dword [rsp + 0x34], 0x56797265
mov dword [rsp + 0x38], 0x75747269
mov dword [rsp + 0x3c], 0x654d6c61
mov qword [rsp + 0x40], 0x79726f6d
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x18001b1fe
mov qword [rsp + 0x360], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, rax
test rax, rax
je 0x18001b1f4
lea rcx, [rbp - 0x60]
xor edx, edx
mov r8d, 0x80
call fcn.180008040
lea rax, [rbp - 0x60]
or r9d, 0xffffffff
mov r8, r15
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x3c
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r15d, 0x80000000
nop dword [rax + rax]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x30
call r14
test eax, eax
js 0x18001b1e4
cmp dword [rbp - 0x68], 0x1000000
jne 0x18001b1e4
cmp qword [rsp + 0x78], rdi
je 0x18001b1e4
lea r9, [rbp + 0x20]
mov r8d, 2
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x20c
call r14
test eax, eax
js 0x18001b1e4
mov rcx, qword [rbp + 0x28]
mov edx, 0x5c
call fcn.1800038b4
lea rcx, [rbp - 0x60]
lea rdx, [rax + 2]
call fcn.180003740
test eax, eax
jne 0x18001b1e4
cmp rbx, r12
jne 0x18001b21b
test rdi, rdi
jne 0x18001b21b
mov rdi, qword [rsp + 0x78]
add rbx, 0x10000
cmp rbx, r15
jb 0x18001b160
xor eax, eax
mov rsi, qword [rsp + 0x360]
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, rbx
jmp 0x18001b1f6
Function at 0x18001d340
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6778645c
mov dword [rsp + 0x24], 0x6c642e69
mov word [rsp + 0x28], 0x6c
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d3b8
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d3ad
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d3d0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x2e747570
mov dword [rsp + 0x28], 0x6c6c64
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d449
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d43e
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d460
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x2e747570
mov dword [rsp + 0x28], 0x6c6c64
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d4d9
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d4ce
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d4f0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x38747570
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d56e
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d563
add rax, rbx
add rsp, 0x230
pop rbx
ret
Function at 0x18001d590
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x38747570
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d60e
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d603
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d630
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x7264645c
mov dword [rsp + 0x24], 0x642e7761
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x2a], 0
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d6ad
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d6a2
add rax, rbx
add rsp, 0x230
pop rbx
ret

Function at 0x18001d6d0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.180008040
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6433645c
mov dword [rsp + 0x24], 0x6c642e39
mov word [rsp + 0x28], 0x6c
call fcn.180003440
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001d748
xor eax, eax
add rsp, 0x230
pop rbx
ret
test ebx, ebx
je 0x18001d73d
add rax, rbx
add rsp, 0x230
pop rbx
ret