joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002171
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x1400095b4
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140009641
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140009641
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009641
sub r8, rdx
movzx edx, word [rcx + 0x14]
add rdx, 0x18
add rdx, rcx
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140009628
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140009622
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14000962a
add rdx, 0x28
jmp 0x140009607
xor edx, edx
test rdx, rdx
jne 0x140009633
xor al, al
jmp 0x140009647
cmp dword [rdx + 0x24], 0
jge 0x14000963d
xor al, al
jmp 0x140009647
mov al, 1
jmp 0x140009647
xor al, al
jmp 0x140009647
add rsp, 0x18
ret

Function at 0x140002437
Capabilities:
Query environment variable

Disassembly:
jmp 0x140059cdc
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140059d63
mov rsi, rbx
cmp word [rax], bp
je 0x140059d22
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140059d0c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140059d08
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140001037
mov rdi, rax
test rax, rax
je 0x140059d50
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000259f
mov rbp, rdi
xor ecx, ecx
call fcn.140001168
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400026d5
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140016e68
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x140084958]
mov ecx, 2
lea r8, [0x140084950]
lea rdx, str.FlsGetValue
call fcn.140016938
mov ecx, ebx
test rax, rax
je 0x140016ea2
add rsp, 0x20
pop rbx
jmp qword [0x1400a4020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x14000281f
Capabilities:
Query environment variable

Disassembly:
jmp 0x140059b88
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140059bb8
xor eax, eax
jmp 0x140059c7b
mov rbp, rbx
cmp word [rax], si
je 0x140059bdd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140059bc4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140059bc0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000317f
movsxd r14, eax
test eax, eax
jne 0x140059c1b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140059bb1
mov rcx, r14
call fcn.140001037
mov rdi, rax
test rax, rax
jne 0x140059c34
xor ecx, ecx
call fcn.140001168
jmp 0x140059c10
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000317f
test eax, eax
jne 0x140059c65
mov rcx, rdi
call fcn.140001168
jmp 0x140059c6f
xor ecx, ecx
call fcn.140001168
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140002829
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140016db8
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x140084918]
xor ecx, ecx
lea r8, [0x140084910]
lea rdx, str.FlsAlloc
call fcn.140016938
test rax, rax
je 0x140016df1
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x1400a4020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1400028a6
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400624c4
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov esi, edx
lea r9, [0x140088478]
mov rbp, rcx
lea r8, [0x140088470]
lea rdx, str.GetLocaleInfoEx
mov ecx, 8
call fcn.1400619e4
test rax, rax
je 0x140062524
movabs r10, 0xe375262d7cd44270
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov rcx, rbp
call qword [0x1400a4030]
jmp 0x14006253e
xor edx, edx
mov rcx, rbp
call fcn.1400021c6
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400028b5
Capabilities:
Terminate process

Disassembly:
jmp 0x140008d98
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1400029eb
Capabilities:
Parse pe header

Disassembly:
jmp 0x140020cdc
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x140020a38

Function at 0x140002b76
Capabilities:
Parse pe header

Disassembly:
jmp 0x140078f30
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140078f58
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140078f58
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140002e7d
Capabilities:
Parse pe header

Disassembly:
jmp 0x140009b70
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009bba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009bba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009bba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009bba
cmp dword [rcx + 0x84], 0xe
jbe 0x140009bba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009bbc
xor al, al
add rsp, 0x28
ret
Function at 0x1400030f8
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x140078e70
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
test r11d, r11d
je 0x140078eb1
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x140078ea5
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x140078eb3
inc r9d
add rax, 0x28
cmp r9d, r11d
jb 0x140078e93
xor eax, eax
ret

Function at 0x1400032e2
Capabilities:
Terminate process

Disassembly:
jmp 0x140054d44
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140054d5e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.140003981
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140003a62
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140016ec0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x140084978]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x140084970]
call fcn.140016938
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x140016f00
call qword [0x1400a4020]
jmp 0x140016f06
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140003be8
Capabilities:
Parse pe header

Disassembly:
jmp 0x140020ccc
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140020aa7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140020aa7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140020aa7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140020aa7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140020aa7
cmp dword [rcx + 0x84], 0xe
jbe 0x140020aa7
cmp dword [rcx + 0xf8], 0
je 0x140020aa7
mov ecx, ebx
call fcn.140020c10
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140020788
nop
cmp dword [rbp + 0x20], 0
je 0x140020af5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140020b30
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140020a38

Function at 0x140009b70
Capabilities:
Parse pe header

Disassembly:
jmp 0x140009b70
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009bba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009bba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009bba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009bba
cmp dword [rcx + 0x84], 0xe
jbe 0x140009bba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009bbc
xor al, al
add rsp, 0x28
ret
Function at 0x180001204
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
xor edx, edx
mov esi, ecx
xor ecx, ecx
lea r8d, [rdx + 5]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1800012f6
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x70]
and qword [rsp + 0x40], 0
xor edx, edx
mov qword [rsp + 0x38], rax
mov rcx, rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
lea r9d, [rdx + 1]
and qword [rsp + 0x20], 0
lea r8d, [rdx + 0x30]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x1800012ed
mov ecx, eax
call fcn.18000a1a4
mov rbx, rax
test rax, rax
je 0x1800012ed
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x70]
and qword [rsp + 0x40], 0
xor edx, edx
mov ecx, dword [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
lea r9d, [rdx + 1]
mov rcx, rdi
mov qword [rsp + 0x20], rbx
lea r8d, [rdx + 0x30]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x1800012e5
mov edx, dword [rsp + 0x70]
xor ecx, ecx
test edx, edx
je 0x1800012e5
mov eax, ecx
imul r8, rax, 0x38
cmp dword [r8 + rbx + 0x2c], esi
je 0x180001308
inc ecx
cmp ecx, edx
jb 0x1800012d2
mov rcx, rbx
call fcn.18000a190
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [r8 + rbx]
call fcn.18000a104
mov rsi, rax
test rax, rax
jne 0x180001319
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call fcn.18000a190
mov rax, rsi
jmp 0x1800012f8
Function at 0x180003794
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rax, qword gs:[0x60]
mov edi, edx
mov ebx, ecx
xor esi, esi
mov r8, qword [rax + 0x18]
mov r11, qword [r8 + 0x20]
mov r8, r11
mov r10, qword [r8 + 0x50]
mov r9d, esi
test r10, r10
je 0x1800037f3
cmp si, word [r8 + 0x48]
jae 0x1800037f3
movzx edx, word [r8 + 0x48]
movsx ecx, byte [r10]
ror r9d, 0xd
cmp byte [r10], 0x61
lea eax, [rcx - 0x20]
cmovge ecx, eax
inc r10
add r9d, ecx
sub rdx, 1
jne 0x1800037d5
cmp r9d, ebx
je 0x180003812
mov r8, qword [r8]
cmp r8, r11
jne 0x1800037bd
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov r9, qword [r8 + 0x20]
mov ebx, esi
movsxd rax, dword [r9 + 0x3c]
mov r8d, dword [rax + r9 + 0x88]
add r8, r9
mov edx, dword [r8 + 0x20]
mov ecx, dword [r8 + 0x24]
add rdx, r9
add rcx, r9
cmp dword [r8 + 0x18], esi
jbe 0x180003800
mov r10d, dword [rdx]
mov r11d, esi
add r10, r9
jmp 0x180003853
ror r11d, 0xd
movsx eax, al
add r11d, eax
inc r10
mov al, byte [r10]
test al, al
jne 0x180003846
cmp r11d, edi
je 0x180003871
inc ebx
add rdx, 4
add rcx, 2
cmp ebx, dword [r8 + 0x18]
jb 0x18000383b
jmp 0x180003800
movzx edx, word [rcx]
mov ecx, dword [r8 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x180003802

Function at 0x180003888
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str.svchost.exe
mov edi, eax
call fcn.1800011ac
test eax, eax
je 0x180003917
mov ecx, edi
xor ebx, ebx
call fcn.180001204
mov r11, rax
lea r8, [rsp + 0x258]
lea rax, [0x18001c110]
xor edx, edx
mov qword [rsp + 0x258], rax
mov r9, qword [r8]
mov rcx, r11
sub r9, r11
movzx eax, word [rcx]
movzx r10d, word [rcx + r9]
sub eax, r10d
jne 0x1800038f1
add rcx, 2
test r10d, r10d
jne 0x1800038db
test eax, eax
je 0x180003902
inc edx
add r8, 8
cmp edx, 1
jb 0x1800038d2
jmp 0x180003907
mov ebx, 1
mov rcx, r11
call fcn.18000a190
test ebx, ebx
jne 0x1800039bd
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
js 0x1800039bd
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rcx, rax
call fcn.180003b68
test eax, eax
jne 0x1800039bd
call fcn.180003aa8
test eax, eax
je 0x1800039bd
cmp dword [0x180020d50], 0
jne 0x1800039b6
mov dword [0x180020d50], 1
call fcn.18000147c
and qword [rsp + 0x28], 0
lea r8, [0x180001c2c]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
and qword [rsp + 0x28], 0
lea r8, [0x180001ca8]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov qword [0x180020d08], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180020d48], rax
mov eax, 1
jmp 0x1800039bf
xor eax, eax
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x1800039d0
Capabilities:
Allocate or change rwx memory
Terminate thread

Disassembly:
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x30
cmp dword [0x180020d50], 0
je 0x180003a8a
and dword [0x180020d50], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x180003a67
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
mov r8d, 0x200
mov rcx, rax
mov rdx, rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x180003a67
mov eax, 0x1f0e
mov word [rbx + 0x40], ax
movabs rax, 0xb821cd09b4000eba
mov qword [rbx + 0x42], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, dword [rsp + 0x40]
mov r8d, 0x200
mov rcx, rax
mov rdx, rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x180020d08]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x180020d48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
call fcn.180001918
add rsp, 0x30
pop rbx
ret

Function at 0x180003aa8
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ecx, ecx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x180003b53
mov esi, 0x7260
cmp word [rax + 0x40], si
je 0x180003b53
mov eax, 0x7832
cmp word [rbx + 0x40], ax
je 0x180003b53
mov eax, 0x7868
cmp word [rbx + 0x40], ax
je 0x180003b53
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [rdi + 4]
mov r8d, 0x200
mov rcx, rax
mov rdx, rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x180003b53
lea rax, [0x180003a90]
mov word [rbx + 0x40], si
mov qword [rbx + 0x42], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, dword [rsp + 0x40]
mov r8d, 0x200
mov rcx, rax
mov rdx, rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edi, 1
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180003d00
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180003f50
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180003e1a
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180003d64
mov rax, qword [0x18001f008]
cmp qword [rsp + 0x20], rax
ja 0x180003d64
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180003d26
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180009010
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x180003d95
jmp 0x180003e1a
cmp dword [rsp + 0x50], 0x10000
jne 0x180003dfd
cmp qword [rsp + 0x48], 0x10000
jb 0x180003dfd
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180003ddb
mov rax, qword [rsp + 0x28]
jmp 0x180003e1c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x180003deb
xor eax, eax
jmp 0x180003e1c
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180003e15
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180003f50
mov qword [rsp + 0x20], rax
jmp 0x180003d26
xor eax, eax
add rsp, 0x68
ret

Function at 0x180003e30
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180003f90
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180003f46
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180003e8b
mov rax, qword [0x18001f008]
cmp qword [rsp + 0x20], rax
ja 0x180003e8b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180003e4d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180009010
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x180003ebc
jmp 0x180003f46
cmp dword [rsp + 0x50], 0x10000
jne 0x180003f24
cmp qword [rsp + 0x48], 0x10000
jb 0x180003f24
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180003f02
mov rax, qword [rsp + 0x28]
jmp 0x180003f48
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x180003f12
xor eax, eax
jmp 0x180003f48
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180003f41
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180003f90
mov qword [rsp + 0x20], rax
jmp 0x180003e4d
xor eax, eax
add rsp, 0x68
ret
Function at 0x180003fe0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180004570
mov qword [rsp + 0x28], 0
cmp qword [0x18001fa98], 0
jne 0x180004028
cmp qword [0x18001fa90], 0
je 0x180004028
mov rax, qword [0x18001fa90]
mov qword [0x18001fa98], rax
cmp qword [0x18001fa98], 0
je 0x1800040ce
mov rax, qword [0x18001fa98]
cmp qword [rax + 0x10], 0
je 0x1800040ce
mov rax, qword [0x18001fa98]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800040ce
mov rax, qword [0x18001fa98]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800040ce
mov rax, qword [0x18001fa98]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180004094
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18000409b
xor eax, eax
jmp 0x180004249
mov rax, qword [0x18001fa98]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.180009010
mov rax, qword [rsp + 0x28]
jmp 0x180004249
mov rax, qword [0x18001fa90]
mov qword [0x18001fa98], rax
jmp 0x1800040f0
mov rax, qword [0x18001fa98]
mov rax, qword [rax + 8]
mov qword [0x18001fa98], rax
cmp qword [0x18001fa98], 0
je 0x18000413d
cmp qword [0x18001fa98], 0
je 0x18000413b
mov rax, qword [0x18001fa98]
cmp qword [rax + 0x10], 0
je 0x18000413b
mov rax, qword [0x18001fa98]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18000413b
mov rax, qword [0x18001fa98]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18000413b
jmp 0x18000406c
jmp 0x1800040de
mov rcx, qword [rsp + 0x60]
call fcn.1800063e0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180004250
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180004247
mov rax, qword [rsp + 0x48]
mov qword [0x18001fa98], rax
mov rax, qword [0x18001fa98]
mov dword [rax], 0x52727464
mov rax, qword [0x18001fa98]
mov qword [rax + 0x10], 0
mov rax, qword [0x18001fa98]
mov rcx, qword [0x18001fa90]
mov qword [rax + 8], rcx
mov rax, qword [0x18001fa98]
mov qword [0x18001fa90], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18001fa98]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x1800041f8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180004232
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1800041ee
mov rax, qword [0x18001fa98]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18000406c
xor eax, eax
add rsp, 0x58
ret
Function at 0x180004f60
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180004fa7
xor al, al
jmp 0x180005049
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x180004fd1
xor al, al
jmp 0x180005049
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x180005041
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x180005041
mov al, 1
jmp 0x180005049
jmp 0x180005047
xor al, al
add rsp, 0x78
ret

Function at 0x180005350
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18001fa90]
mov qword [rsp + 0x28], rax
jmp 0x180005370
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18000539f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x18000539d
call sub.KERNEL32.dll_GetLastError
jmp 0x1800053a1
jmp 0x180005362
xor eax, eax
add rsp, 0x38
ret