joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ddc40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800ddc82
cmp qword [rbp + 0x1c0], 0
jne 0x1800ddc89
xor al, al
jmp 0x1800dde6c
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf480
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800dde53
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800dde4f
int3
xor al, al
jmp 0x1800dde6c
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e1db0
movzx eax, al
test eax, eax
jne 0x1800dde6a
xor al, al
jmp 0x1800dde6c
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800dde90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800dded2
cmp qword [rbp + 0x1c0], 0
jne 0x1800dded9
xor al, al
jmp 0x1800de0bc
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf480
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800de0a3
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800de09f
int3
xor al, al
jmp 0x1800de0bc
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e1fb0
movzx eax, al
test eax, eax
jne 0x1800de0ba
xor al, al
jmp 0x1800de0bc
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800de0e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800de122
cmp qword [rbp + 0x1c0], 0
jne 0x1800de129
xor al, al
jmp 0x1800de30c
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf480
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800de2f3
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800de2ef
int3
xor al, al
jmp 0x1800de30c
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e21b0
movzx eax, al
test eax, eax
jne 0x1800de30a
xor al, al
jmp 0x1800de30c
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800de330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800de372
cmp qword [rbp + 0x1c0], 0
jne 0x1800de379
xor al, al
jmp 0x1800de55c
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf480
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800de543
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800de53f
int3
xor al, al
jmp 0x1800de55c
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e23b0
movzx eax, al
test eax, eax
jne 0x1800de55a
xor al, al
jmp 0x1800de55c
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800de580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800de5c2
cmp qword [rbp + 0x1c0], 0
jne 0x1800de5c9
xor al, al
jmp 0x1800de7ac
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf480
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800de793
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800de78f
int3
xor al, al
jmp 0x1800de7ac
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e25b0
movzx eax, al
test eax, eax
jne 0x1800de7aa
xor al, al
jmp 0x1800de7ac
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800de7d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800de812
cmp qword [rbp + 0x1c0], 0
jne 0x1800de819
xor al, al
jmp 0x1800de9fc
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf480
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800de9e3
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800de9df
int3
xor al, al
jmp 0x1800de9fc
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e27b0
movzx eax, al
test eax, eax
jne 0x1800de9fa
xor al, al
jmp 0x1800de9fc
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800dea20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800dea62
cmp qword [rbp + 0x1c0], 0
jne 0x1800dea69
xor al, al
jmp 0x1800dec4c
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf480
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800dec33
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800dec2f
int3
xor al, al
jmp 0x1800dec4c
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e29b0
movzx eax, al
test eax, eax
jne 0x1800dec4a
xor al, al
jmp 0x1800dec4c
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800dec70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x1b8], 0
je 0x1800decb2
cmp qword [rbp + 0x1c0], 0
jne 0x1800decb9
xor al, al
jmp 0x1800dee9c
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x1b0]
add rax, 0x18
mov r8, rax
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf480
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800dee83
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x32
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_create_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800dee7f
int3
xor al, al
jmp 0x1800dee9c
mov rcx, qword [rbp + 0x1b0]
call fcn.1800e2bb0
movzx eax, al
test eax, eax
jne 0x1800dee9a
xor al, al
jmp 0x1800dee9c
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1800e13b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
mov rax, qword [0x180370940]
xor rax, rbp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x1b0]
cmp qword [rax + 8], 0
jne 0x1800e13e9
xor al, al
jmp 0x1800e1597
mov rax, qword [rbp + 0x1b0]
movzx eax, byte [rax]
test eax, eax
je 0x1800e13fe
xor al, al
jmp 0x1800e1597
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax + 8]
call fcn.1800bf790
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1800e158b
mov byte [rbp + 0xe8], 0x5b
mov byte [rbp + 0xe9], 0x64
mov byte [rbp + 0xea], 0x65
mov byte [rbp + 0xeb], 0x74
mov byte [rbp + 0xec], 0x6f
mov byte [rbp + 0xed], 0x75
mov byte [rbp + 0xee], 0x72
mov byte [rbp + 0xef], 0x68
mov byte [rbp + 0xf0], 0x6f
mov byte [rbp + 0xf1], 0x6f
mov byte [rbp + 0xf2], 0x6b
mov byte [rbp + 0xf3], 0x2e
mov byte [rbp + 0xf4], 0x68
mov byte [rbp + 0xf5], 0x3a
mov byte [rbp + 0xf6], 0x35
mov byte [rbp + 0xf7], 0x36
mov byte [rbp + 0xf8], 0x5d
mov byte [rbp + 0xf9], 0x20
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0xe8]
call fcn.1800df810
mov r8, rax
mov dl, 3
lea rcx, [0x1802c1e08]
call fcn.18015e150
mov qword [rbp + 0x148], rax
lea rdx, str.failed_to_enable_hook__status:__
mov rcx, qword [rbp + 0x148]
call fcn.18015de80
mov qword [rbp + 0x150], rax
mov ecx, dword [rbp + 4]
call fcn.1800bf930
mov qword [rbp + 0x158], rax
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.18015de80
mov qword [rbp + 0x160], rax
lea rdx, str.__with_base_address:
mov rcx, qword [rbp + 0x160]
call fcn.18015de80
mov qword [rbp + 0x168], rax
mov cx, 6
call fcn.18015e4a0
mov word [rbp + 0x114], ax
movzx eax, word [rbp + 0x114]
mov word [rbp + 0x134], ax
movzx edx, word [rbp + 0x134]
mov rcx, qword [rbp + 0x168]
call fcn.18015dfd0
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x1b0]
mov rax, qword [rax + 8]
mov qword [rbp + 0x178], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x170]
call fcn.1800cae50
xor eax, eax
test eax, eax
jne 0x1800e1587
int3
xor al, al
jmp 0x1800e1597
mov rax, qword [rbp + 0x1b0]
mov byte [rax], 1
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rbp
call fcn.180224dd0
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret