joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800078ac
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.180003a90
xor ebx, ebx
cmp qword [0x180020a88], rbx
mov rdi, rax
jne 0x1800079bf
lea rcx, str.USER32.DLL
call qword [0x180016080]
mov rsi, rax
test rax, rax
je 0x180007a96
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180007a96
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180020a88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180020a90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180020a98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180020aa8], rax
test rax, rax
je 0x1800079b6
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180020aa0], rax
jmp 0x1800079c6
mov rax, qword [0x180020aa0]
jmp 0x1800079cd
mov rax, qword [0x180020aa0]
mov r11, qword [0x180020aa8]
cmp rax, rdi
je 0x180007a34
cmp r11, rdi
je 0x180007a34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180020aa8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180007a34
test rax, rax
je 0x180007a34
call rsi
test rax, rax
je 0x180007a2e
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180007a2e
test byte [rsp + 0x40], 1
jne 0x180007a34
bts ebp, 0x15
jmp 0x180007a74
mov rcx, qword [0x180020a90]
cmp rcx, rdi
je 0x180007a74
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180007a74
call rax
mov rbx, rax
test rax, rax
je 0x180007a74
mov rcx, qword [0x180020a98]
cmp rcx, rdi
je 0x180007a74
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180007a74
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180020a88]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180007a96
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180007a98
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180002fd0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180009160
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov eax, 0x2030
call fcn.180003000
sub rsp, rax
cmp dword [0x180020ed0], 0
mov rdi, rcx
jne 0x180009189
mov eax, 0x80000002
add rsp, 0x2030
pop rdi
ret
lea rcx, [rsp + 0x1030]
xor edx, edx
mov r8d, 0x1000
mov qword [rsp + 0x2040], rbx
call fcn.180003060
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x1000
call fcn.180003060
lea rcx, [rsp + 0x20]
mov edx, 1
call fcn.18000c3f0
movzx r8d, word [rdi + 0x810]
movzx r11d, byte [rsp + 0x20]
mov ecx, r8d
mov edx, 0x10
mov byte [rsp + 0x1030], r11b
mov byte [rsp + 0x1031], 0xff
call fcn.180008140
movzx ecx, r8w
shr cx, 8
mov rdx, rdi
movsxd rbx, eax
mov byte [rsp + 0x1032], cl
movzx ecx, byte [rdi + 0x810]
mov byte [rsp + 0x1033], cl
lea rcx, [rsp + 0x1034]
call fcn.180003160
lea edx, [rbx + 4]
xor r11b, r11b
test edx, edx
jle 0x18000924d
lea rax, [rsp + 0x1030]
mov ecx, edx
nop
nop
nop
xor r11b, byte [rax]
add rax, 1
sub rcx, 1
jne 0x180009240
test edx, edx
mov byte [rsp + rbx + 0x1034], r11b
jle 0x180009276
lea rcx, [rsp + 0x1031]
movzx eax, byte [rsp + 0x1030]
add rcx, 1
xor byte [rcx - 1], al
sub rdx, 1
jne 0x180009261
mov eax, dword [0x180020ed0]
lea edx, [rbx + 5]
mov dword [rsp + 0x2048], 0x1000
cmp eax, 1
jne 0x1800092ab
lea r9, [rsp + 0x2048]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x1030]
call fcn.1800087c0
jmp 0x1800092ef
cmp eax, 2
jne 0x1800092cc
lea r9, [rsp + 0x2048]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x1030]
call fcn.180008ba0
jmp 0x1800092ef
cmp eax, 3
jne 0x180009438
lea r9, [rsp + 0x2048]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x1030]
call fcn.180008cb0
test eax, eax
jne 0x18000930e
call fcn.180009910
mov eax, 0x80000012
mov rbx, qword [rsp + 0x2040]
add rsp, 0x2030
pop rdi
ret
movsxd r8, dword [rsp + 0x2048]
lea eax, [r8 - 1]
test eax, eax
jle 0x180009342
lea rcx, [rsp + 0x31]
mov edx, eax
nop
nop
nop
movzx eax, byte [rsp + 0x30]
add rcx, 1
xor byte [rcx - 1], al
sub rdx, 1
jne 0x180009330
cmp byte [rsp + 0x31], 0xff
jne 0x1800092f8
lea eax, [r8 - 5]
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x1800092f8
lea edx, [r8 - 1]
xor cl, cl
test edx, edx
jle 0x18000937c
lea rax, [rsp + 0x30]
nop
nop
xor cl, byte [rax]
add rax, 1
sub rdx, 1
jne 0x180009370
cmp cl, byte [rsp + r8 + 0x2f]
jne 0x1800092f8
movzx eax, byte [rsp + 0x32]
shl ax, 8
movzx r9d, ax
movzx eax, byte [rsp + 0x33]
add r9d, eax
cmp r9d, 2
jl 0x1800092f8
movsxd rax, r9d
mov qword [rsp + 0x2050], rsi
movzx ecx, byte [rsp + rax + 0x32]
movzx eax, byte [rsp + rax + 0x33]
shl cx, 8
add cx, ax
movzx eax, cx
and ax, 0xff00
cmp ax, 0x6800
jne 0x1800093de
mov byte [rdi + 0x10], cl
mov word [rdi + 0x812], 1
mov cx, ax
call fcn.180008150
test eax, eax
mov esi, eax
jne 0x18000941d
sub r9w, 2
lea rcx, [rdi + 0x10]
xor edx, edx
mov r8d, 0x800
mov word [rdi + 0x812], r9w
call fcn.180003060
movzx r8d, word [rdi + 0x812]
lea rdx, [rsp + 0x34]
lea rcx, [rdi + 0x10]
call fcn.180003160
mov rbx, qword [rsp + 0x2040]
mov eax, esi
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
mov eax, 0x80000002
mov rbx, qword [rsp + 0x2040]
add rsp, 0x2030
pop rdi
ret
Function at 0x18000a3b0
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0x28
xor eax, eax
lea rcx, [0x180020f70]
xor edx, edx
lea r8d, [rax + 0x40]
mov dword [0x180020f10], 0x67452301
mov dword [0x180020f14], 0xefcdab89
mov dword [0x180020f24], eax
mov dword [0x180020f20], eax
mov dword [0x180020f18], 0x98badcfe
mov dword [0x180020f1c], 0x10325476
call fcn.18000a390
mov byte [0x180020f70], 0x80
add rsp, 0x28
ret

Function at 0x18000ad10
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [0x180020f20]
lea rcx, [rsp + 0x38]
mov r8d, 8
call fcn.18000a2b0
mov r9d, dword [0x180020f20]
mov edx, 0x38
shr r9d, 3
and r9d, 0x3f
cmp r9d, 0x38
jb 0x18000ad4f
mov edx, 0x78
lea rcx, [0x180020f70]
sub edx, r9d
call fcn.18000ac30
lea rcx, [rsp + 0x38]
mov edx, 8
call fcn.18000ac30
lea rdx, [0x180020f10]
mov r8d, 0x10
mov rcx, rbx
call fcn.18000a2b0
add rsp, 0x20
pop rbx
jmp fcn.18000a3b0

Function at 0x18000c7a0
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xb0
movzx eax, byte [rdx + 1]
movzx r10d, byte [rdx]
movzx r8d, byte [rdx + 4]
mov r9, rdx
shl r10d, 8
shl r8d, 8
or r10d, eax
movzx eax, byte [rdx + 2]
mov rdi, rcx
movzx ecx, byte [r9 + 0xc]
shl r10d, 8
lea rsi, [0x180018220]
or r10d, eax
movzx eax, byte [rdx + 3]
shl ecx, 8
shl r10d, 8
or r10d, eax
movzx eax, byte [rdx + 5]
or r8d, eax
movzx eax, byte [rdx + 6]
xor r10d, 0xa3b1bac6
shl r8d, 8
mov dword [rsp + 0x20], r10d
or r8d, eax
movzx eax, byte [rdx + 7]
movzx edx, byte [rdx + 8]
shl edx, 8
shl r8d, 8
or r8d, eax
movzx eax, byte [r9 + 9]
or edx, eax
movzx eax, byte [r9 + 0xa]
xor r8d, 0x56aa3350
shl edx, 8
mov dword [rsp + 0x24], r8d
or edx, eax
movzx eax, byte [r9 + 0xb]
shl edx, 8
or edx, eax
movzx eax, byte [r9 + 0xd]
or ecx, eax
movzx eax, byte [r9 + 0xe]
xor edx, 0x677d9197
shl ecx, 8
mov dword [rsp + 0x28], edx
or ecx, eax
movzx eax, byte [r9 + 0xf]
shl ecx, 8
or ecx, eax
xor ecx, 0xb27022dc
xor r11d, r11d
lea ebx, [r11 + 0x20]
mov dword [rsp + 0x2c], ecx
mov ecx, dword [r11 + rsi]
xor ecx, dword [rsp + r11 + 0x24]
xor ecx, dword [rsp + r11 + 0x2c]
xor ecx, dword [rsp + r11 + 0x28]
call fcn.18000c720
add r11, 4
xor eax, dword [rsp + r11 + 0x1c]
sub rbx, 1
mov dword [rsp + r11 + 0x2c], eax
mov dword [r11 + rdi - 4], eax
jne 0x18000c882
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x18000caa0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov dword [rcx], 1
add rcx, 4
jmp fcn.18000c7a0
Function at 0x18000cb80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
cmp edx, 1
mov rbp, r9
jne 0x18000cc81
test r8d, r8d
jle 0x18000cd2f
mov rbx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
lea r13d, [r8 - 1]
mov rsi, r9
mov r12, r9
shr r13d, 4
mov qword [rsp + 0x60], r15
sub rsi, rbx
sub r12, rdi
add r13d, edx
lea r15, [rcx + 4]
nop
nop
mov r8, rbx
lea r9, [rbp + 3]
lea rdx, [rbx + 1]
mov rcx, rdi
mov r10d, 4
sub r8, rdi
nop
nop
nop
movzx eax, byte [r12 + rcx]
add rdx, 4
add rcx, 4
xor al, byte [rcx - 4]
add r9, 4
mov byte [r8 + rcx - 4], al
movzx eax, byte [rsi + rdx - 4]
xor al, byte [rcx - 3]
mov byte [rdx - 4], al
movzx eax, byte [rcx - 2]
xor al, byte [r9 - 5]
mov byte [rdx - 3], al
movzx eax, byte [rcx - 1]
xor al, byte [r9 - 4]
sub r10, 1
mov byte [rdx - 2], al
jne 0x18000cc00
mov r8, rbx
mov rdx, rbx
mov rcx, r15
call fcn.18000c8d0
mov rax, qword [rbx]
add rdi, 0x10
mov qword [rbp], rax
mov rax, qword [rbx + 8]
sub r12, 0x10
add rbx, 0x10
sub rsi, 0x10
sub r13, 1
mov qword [rbp + 8], rax
jne 0x18000cbe0
mov r15, qword [rsp + 0x60]
jmp 0x18000cd2f
test r8d, r8d
jle 0x18000cd2f
mov rbx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
lea r12d, [r8 - 1]
mov rdi, r9
shr r12d, 4
lea r13, [rcx + 4]
sub rdi, rbx
add r12d, 1
mov rax, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, rbx
mov qword [rcx], rax
mov rax, qword [rsi + 8]
mov rdx, rsi
mov qword [rcx + 8], rax
mov rcx, r13
call fcn.18000c8d0
lea r11, [rbp + 2]
mov ecx, 4
nop
nop
movzx eax, byte [rbx + rdi]
add rbx, 4
add r11, 4
xor byte [rbx - 4], al
movzx eax, byte [r11 - 5]
xor byte [rbx - 3], al
movzx eax, byte [r11 - 4]
xor byte [rbx - 2], al
movzx eax, byte [r11 - 3]
xor byte [rbx - 1], al
sub rcx, 1
jne 0x18000cce0
lea rcx, [rsp + 0x20]
add rsi, 0x10
sub rdi, 0x10
sub r12, 1
mov rax, qword [rcx]
mov qword [rbp], rax
mov rax, qword [rcx + 8]
mov qword [rbp + 8], rax
jne 0x18000ccb0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18000f7c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x250
movsxd rdi, edx
mov r12, r8
mov rbx, rcx
mov eax, edi
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x18000fa03
mov qword [rsp + 0x268], rsi
movzx esi, byte [rsp + 0x288]
test sil, sil
je 0x18000f80e
cmp sil, 1
jne 0x18000f9fb
mov qword [rsp + 0x260], rbp
movzx ebp, byte [rsp + 0x280]
cmp bpl, 1
je 0x18000f82d
test bpl, bpl
jne 0x18000f9f3
test r9, r9
je 0x18000f847
mov rax, qword [r9]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [r9 + 8]
mov qword [rcx + 8], rax
jmp 0x18000f853
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x204
call fcn.180003060
lea rcx, [rsp + 0x40]
mov r8d, pe_nt_image_headers64
mov rdx, r12
call fcn.18000ce80
test sil, sil
jne 0x18000f93b
test rdi, rdi
jle 0x18000f9f3
add rdi, 0xffffffffffffffff
shr rdi, 4
add rdi, 1
cmp bpl, 1
jne 0x18000f8df
xor ecx, ecx
nop
movzx eax, byte [rbx + rcx]
add rcx, 4
xor al, byte [rsp + rcx + 0x2c]
mov byte [rsp + rcx + 0x1c], al
movzx eax, byte [rbx + rcx - 3]
xor al, byte [rsp + rcx + 0x2d]
mov byte [rsp + rcx + 0x1d], al
movzx eax, byte [rbx + rcx - 2]
xor al, byte [rsp + rcx + 0x2e]
mov byte [rsp + rcx + 0x1e], al
movzx eax, byte [rbx + rcx - 1]
xor al, byte [rsp + rcx + 0x2f]
cmp rcx, 0x10
mov byte [rsp + rcx + 0x1f], al
jl 0x18000f8a0
jmp 0x18000f8f0
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.18000d7d0
cmp bpl, 1
lea rcx, [rsp + 0x20]
mov rax, qword [rcx]
mov qword [rbx], rax
mov rax, qword [rcx + 8]
mov qword [rbx + 8], rax
jne 0x18000f928
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
add rbx, 0x10
sub rdi, 1
jne 0x18000f896
jmp 0x18000f9f3
cmp sil, 1
jne 0x18000f9f3
test rdi, rdi
jle 0x18000f9f3
add rdi, 0xffffffffffffffff
shr rdi, 4
add rdi, 1
nop
nop
mov rax, qword [rbx]
lea rcx, [rsp + 0x20]
lea r8, [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x20]
mov qword [rcx + 8], rax
lea rcx, [rsp + 0x40]
call fcn.18000e7c0
cmp bpl, 1
jne 0x18000f9d1
xor ecx, ecx
nop
movzx eax, byte [rsp + rcx + 0x30]
add rcx, 4
xor byte [rsp + rcx + 0x1c], al
movzx eax, byte [rsp + rcx + 0x2d]
xor byte [rsp + rcx + 0x1d], al
movzx eax, byte [rsp + rcx + 0x2e]
xor byte [rsp + rcx + 0x1e], al
movzx eax, byte [rsp + rcx + 0x2f]
xor byte [rsp + rcx + 0x1f], al
cmp rcx, 0x10
jl 0x18000f990
mov rax, qword [rbx]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
lea rcx, [rsp + 0x20]
add rbx, 0x10
sub rdi, 1
mov rax, qword [rcx]
mov qword [rbx - 0x10], rax
mov rax, qword [rcx + 8]
mov qword [rbx - 8], rax
jne 0x18000f960
mov rbp, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x268]
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x18000fbc0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18000fc08
xor al, al
jmp 0x18000fc8c
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x4550
je 0x18000fc32
xor al, al
jmp 0x18000fc8c
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x18000fc84
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
mov ecx, dword [rcx + 0xec]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x18000fc84
mov al, 1
jmp 0x18000fc8c
jmp 0x18000fc8a
xor al, al
add rsp, 0x78
ret

Function at 0x18000fd20
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180021400]
mov qword [rsp + 0x20], rax
jmp 0x18000fd40
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18000fd71
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18000fd6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000fd73
jmp 0x18000fd32
xor eax, eax
add rsp, 0x38
ret
Function at 0x18000fd80
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x180021418], eax
je 0x18000fd9c
mov eax, 0x10dd
jmp 0x18000feb9
mov rax, qword [0x180021430]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18000fe42
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x20]
cmp dword [rax + 8], 0
jne 0x18000fe12
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x20], 0
je 0x18000fe12
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x20]
call fcn.18000ff30
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.18001308c
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
jmp 0x18000fda8
mov qword [0x180021430], 0
call fcn.18000fec0
mov rax, qword [0x180021428]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18000fea2
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.18001308c
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x18000fe5e
mov qword [0x180021428], 0
mov dword [0x180021418], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800105f0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x52727464
je 0x18001060d
xor eax, eax
jmp 0x1800106a5
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp]
add rax, 0x10000
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
add rax, 0x60
mov qword [rsp + 0x10], rax
mov dword [rsp + 0x18], 0
jmp 0x180010647
mov eax, dword [rsp + 0x18]
inc eax
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0x2a9
jae 0x1800106a0
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
cmp qword [rcx + rax + 0x48], 0
je 0x18001069e
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp]
cmp qword [rcx + rax + 0x48], rdx
jb 0x18001069a
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
cmp qword [rcx + rax + 0x48], rdx
jb 0x18001069e
xor eax, eax
jmp 0x1800106a5
jmp 0x18001063d
mov eax, 1
add rsp, 0x28
ret

Function at 0x180010790
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x18002141c], 0
je 0x1800107ad
mov eax, dword [0x18002141c]
jmp 0x180010871
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp qword [rsp + 0x50], rax
jne 0x1800107c1
xor eax, eax
jmp 0x180010871
mov ecx, 0x10
call fcn.180013104
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18001082a
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x18001080f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.18001308c
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x18002141c], eax
mov qword [0x180021420], 0
mov eax, dword [rsp + 0x20]
jmp 0x180010871
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180010846
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x1800107ea
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x180021428]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x180021428], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x180011940
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180011a50
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180011a43
mov rax, qword [0x18001f2a8]
cmp qword [rsp + 0x20], rax
jb 0x18001199b
mov rax, qword [0x18001f2b0]
cmp qword [rsp + 0x20], rax
ja 0x18001199b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18001195d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.180003060
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800119ca
jmp 0x180011a43
cmp dword [rsp + 0x48], 0x10000
jne 0x180011a21
cmp qword [rsp + 0x40], 0x10000
jb 0x180011a21
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x180011a0f
mov rax, qword [rsp + 0x58]
jmp 0x180011a45
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180011a3e
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180011a50
mov qword [rsp + 0x20], rax
jmp 0x18001195d
xor eax, eax
add rsp, 0x68
ret

Function at 0x180011aa0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180011bb0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180011ba7
mov rax, qword [0x18001f2a8]
cmp qword [rsp + 0x20], rax
jb 0x180011b04
mov rax, qword [0x18001f2b0]
cmp qword [rsp + 0x20], rax
ja 0x180011b04
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180011ac6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.180003060
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180011b33
jmp 0x180011ba7
cmp dword [rsp + 0x48], 0x10000
jne 0x180011b8a
cmp qword [rsp + 0x40], 0x10000
jb 0x180011b8a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x180011b78
mov rax, qword [rsp + 0x58]
jmp 0x180011ba9
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180011ba2
mov rax, qword [rsp + 0x30]
sub rax, 0x10000
mov rcx, rax
call fcn.180011bb0
mov qword [rsp + 0x20], rax
jmp 0x180011ac6
xor eax, eax
add rsp, 0x68
ret