joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800e1320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e1359
xor al, al
jmp 0x1800e1507
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e136e
xor al, al
jmp 0x1800e1507
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0990
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e14fb
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800e14f7
int3
xor al, al
jmp 0x1800e1507
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e1520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e1559
xor al, al
jmp 0x1800e1707
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e156e
xor al, al
jmp 0x1800e1707
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0990
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e16fb
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800e16f7
int3
xor al, al
jmp 0x1800e1707
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e1720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e1759
xor al, al
jmp 0x1800e1907
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e176e
xor al, al
jmp 0x1800e1907
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0990
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e18fb
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800e18f7
int3
xor al, al
jmp 0x1800e1907
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e1920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e1959
xor al, al
jmp 0x1800e1b07
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e196e
xor al, al
jmp 0x1800e1b07
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0990
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e1afb
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800e1af7
int3
xor al, al
jmp 0x1800e1b07
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e1b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e1b59
xor al, al
jmp 0x1800e1d07
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e1b6e
xor al, al
jmp 0x1800e1d07
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0990
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e1cfb
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800e1cf7
int3
xor al, al
jmp 0x1800e1d07
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e1d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e1d59
xor al, al
jmp 0x1800e1f07
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e1d6e
xor al, al
jmp 0x1800e1f07
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0990
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e1efb
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800e1ef7
int3
xor al, al
jmp 0x1800e1f07
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e1f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e1f59
xor al, al
jmp 0x1800e2107
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e1f6e
xor al, al
jmp 0x1800e2107
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0990
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e20fb
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800e20f7
int3
xor al, al
jmp 0x1800e2107
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e2120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e2159
xor al, al
jmp 0x1800e2307
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e216e
xor al, al
jmp 0x1800e2307
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800c0990
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e22fb
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df280
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015e890
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800c0b30
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015e890
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015e890
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015e9e0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800e22f7
int3
xor al, al
jmp 0x1800e2307
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e6ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x130], rax
mov rcx, qword [rbp + 0x160]
call fcn.180162150
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1800e6b12
xor eax, eax
jmp 0x1800e6c16
lea rdx, str.CreateInterface
mov rcx, qword [rbp + 8]
call fcn.180161a90
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1800e6bff
mov byte [rbp + 0x108], 0x5b
mov byte [rbp + 0x109], 0x69
mov byte [rbp + 0x10a], 0x6e
mov byte [rbp + 0x10b], 0x74
mov byte [rbp + 0x10c], 0x65
mov byte [rbp + 0x10d], 0x72
mov byte [rbp + 0x10e], 0x66
mov byte [rbp + 0x10f], 0x61
mov byte [rbp + 0x110], 0x63
mov byte [rbp + 0x111], 0x65
mov byte [rbp + 0x112], 0x73
mov byte [rbp + 0x113], 0x2e
mov byte [rbp + 0x114], 0x63
mov byte [rbp + 0x115], 0x70
mov byte [rbp + 0x116], 0x70
mov byte [rbp + 0x117], 0x3a
mov byte [rbp + 0x118], 0x34
mov byte [rbp + 0x119], 0x30
mov byte [rbp + 0x11a], 0x5d
mov byte [rbp + 0x11b], 0x20
mov byte [rbp + 0x11c], 0
lea rcx, [rbp + 0x108]
call fcn.1800e6a70
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x128], rax
lea rdx, str.failed_to_get__CreateInterface__address
mov rcx, qword [rbp + 0x128]
call fcn.18015e890
xor eax, eax
jmp 0x1800e6c16
mov r8d, 7
mov edx, 3
mov rcx, qword [rbp + 0x28]
call fcn.1800e23c0
mov rax, qword [rax]
mov rcx, qword [rbp + 0x130]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1800e7820
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
mov rbp, rsp
mov qword [rbp + 8], 0
jmp 0x1800e7850
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x1800e78a6
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1800e7845
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1800fca10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x6e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2c8]
mov rax, qword [0x180371940]
xor rax, rbp
mov qword [rbp + 0x268], rax
lea rax, [rbp + 0xf4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rbp + 0xf4]
mov byte [rbp + 0x154], al
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x118]
call fcn.1800fc0a0
mov rax, qword [rax]
mov qword [rbp + 0x138], rax
movzx eax, byte [rbp + 0x154]
mov byte [rsp + 0x20], al
mov r9, qword [rbp + 0x138]
lea r8, [0x180379138]
lea rdx, [rbp + 8]
lea rcx, [0x18025e8a2]
call fcn.1800fae40
lea rdx, [rbp + 0x198]
lea rcx, [0x180379138]
call fcn.1800fdb20
mov qword [rbp + 0x248], rax
mov rdx, qword [rbp + 0x248]
lea rcx, [rbp + 8]
call fcn.1800fc500
movzx eax, al
test eax, eax
jne 0x1800fcaf0
mov dword [rbp + 0x250], 1
jmp 0x1800fcafa
mov dword [rbp + 0x250], 0
movzx eax, byte [rbp + 0x250]
mov byte [rbp + 0x174], al
lea rcx, [rbp + 0x198]
call fcn.1800fc430
movzx eax, byte [rbp + 0x174]
test eax, eax
je 0x1800fcb44
lea rcx, [rbp + 8]
call fcn.1800fc5a0
mov eax, dword [rax + 8]
mov dword [rbp + 0x1c4], eax
lea rcx, [rbp + 8]
call fcn.1800fc430
mov eax, dword [rbp + 0x1c4]
jmp 0x1800fcc6d
lea rcx, [rbp + 8]
call fcn.1800fc430
mov byte [rbp + 0x1e8], 0x5b
mov byte [rbp + 0x1e9], 0x73
mov byte [rbp + 0x1ea], 0x63
mov byte [rbp + 0x1eb], 0x68
mov byte [rbp + 0x1ec], 0x65
mov byte [rbp + 0x1ed], 0x6d
mov byte [rbp + 0x1ee], 0x61
mov byte [rbp + 0x1ef], 0x2e
mov byte [rbp + 0x1f0], 0x63
mov byte [rbp + 0x1f1], 0x70
mov byte [rbp + 0x1f2], 0x70
mov byte [rbp + 0x1f3], 0x3a
mov byte [rbp + 0x1f4], 0x31
mov byte [rbp + 0x1f5], 0x31
mov byte [rbp + 0x1f6], 0x31
mov byte [rbp + 0x1f7], 0x5d
mov byte [rbp + 0x1f8], 0x20
mov byte [rbp + 0x1f9], 0
lea rcx, [rbp + 0x1e8]
call fcn.1800cefd0
mov r8, rax
mov dl, 3
lea rcx, [0x1802c2df8]
call fcn.18015eb60
mov qword [rbp + 0x248], rax
lea rdx, str.failed_to_find_offset_for_field_with_hash:
mov rcx, qword [rbp + 0x248]
call fcn.18015e890
mov qword [rbp + 0x250], rax
mov cx, 6
call fcn.18015eeb0
mov word [rbp + 0x214], ax
movzx eax, word [rbp + 0x214]
mov word [rbp + 0x234], ax
movzx edx, word [rbp + 0x234]
mov rcx, qword [rbp + 0x250]
call fcn.18015e9e0
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 0x290]
mov qword [rbp + 0x260], rax
mov rdx, qword [rbp + 0x260]
mov rcx, qword [rbp + 0x258]
call fcn.1800cb2f0
xor eax, eax
test eax, eax
jne 0x1800fcc6b
int3
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x18025e5a0]
call fcn.180225a10
mov rax, rdi
mov rcx, qword [rbp + 0x268]
xor rcx, rbp
call fcn.180225d60
lea rsp, [rbp + 0x278]
pop rdi
pop rbp
ret