joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cdf4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r8
mov r15, rdx
mov rdi, rcx
test r8, r8
jne 0x14000ce1f
mov al, 1
jmp 0x14000cf37
cmp dword [rcx + 0x14], 1
lea r14, [rcx + 8]
jne 0x14000ce37
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [r14], rax
mov r13d, 0x4000
and dword [rsp + 0x70], 0
xor bpl, bpl
cmp dword [rdi + 0x14], 0
je 0x14000ce91
xor ebx, ebx
test rsi, rsi
je 0x14000ceb7
mov eax, esi
lea rdx, [rbx + r15]
sub eax, ebx
lea r9, [rsp + 0x70]
mov r8d, r13d
mov rcx, rsi
sub rcx, rbx
cmp rcx, r13
mov rcx, qword [r14]
cmovb r8d, eax
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete bpl
jne 0x14000ceb2
add rbx, r13
cmp rbx, rsi
jb 0x14000ce52
jmp 0x14000ceb2
mov rcx, qword [r14]
lea r9, [rsp + 0x70]
and qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete bpl
test bpl, bpl
jne 0x14000cf30
cmp byte [rdi + 0x22], 0
je 0x14000cf30
cmp dword [rdi + 0x14], 0
jne 0x14000cf30
xor r8d, r8d
lea rdx, [rdi + 0x3a]
lea rcx, [0x140054488]
call fcn.1400086d8
test al, al
je 0x14000cf1e
mov ecx, dword [rsp + 0x70]
cmp rcx, rsi
jae 0x14000ce3d
test ecx, ecx
je 0x14000ce3d
mov rbx, qword [rdi]
mov rcx, rdi
mov rax, qword [rbx + 0x28]
call qword [0x140040510]
mov ecx, dword [rsp + 0x70]
xor r8d, r8d
sub rax, rcx
mov rcx, rdi
mov rdx, rax
mov rax, qword [rbx + 0x20]
call qword [0x140040510]
jmp 0x14000ce3d
lea r8, [rdi + 0x3a]
xor edx, edx
lea rcx, [0x140054488]
call fcn.140008bb0
mov byte [rdi + 0x10], 1
mov al, bpl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret

Function at 0x14000d084
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1030
call fcn.140026310
sub rsp, rax
mov rax, qword [0x1400517e8]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000d0e2
mov r8d, 0x800
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14000f330
test al, al
je 0x14000d0e2
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov al, bl
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140025ea0
mov rbx, qword [rsp + 0x1048]
add rsp, 0x1030
pop rdi
ret

Function at 0x14000d108
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1030
call fcn.140026310
sub rsp, rax
mov rax, qword [0x1400517e8]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test eax, eax
jne 0x14000d166
mov r8d, 0x800
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14000f330
test al, al
je 0x14000d166
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov al, bl
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140025ea0
mov rbx, qword [rsp + 0x1048]
add rsp, 0x1030
pop rdi
ret
Function at 0x14000d1a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1030
call fcn.140026310
sub rsp, rax
mov rax, qword [0x1400517e8]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14000d1f9
mov r8d, 0x800
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14000f330
test al, al
je 0x14000d1f9
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140025ea0
mov rbx, qword [rsp + 0x1048]
add rsp, 0x1030
pop rdi
ret

Function at 0x14000d3ec
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1030
call fcn.140026310
sub rsp, rax
mov rax, qword [0x1400517e8]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov ebp, r8d
mov sil, dl
mov rdi, rcx
call fcn.14000fc10
xor ebx, ebx
cmp word [rax], 0x2e
je 0x14000d43e
cmp word [rax], 0x20
je 0x14000d43e
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000d473
mov rcx, rdi
call fcn.14000d1a0
cmp eax, 0xffffffff
jne 0x14000d486
mov r8d, 0x800
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14000f330
test al, al
je 0x14000d486
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000d486
test sil, sil
je 0x14000d482
mov edx, ebp
mov rcx, rdi
call fcn.14000d864
xor eax, eax
jmp 0x14000d4a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14000d49c
cmp eax, 3
sete bl
lea eax, [rbx + 1]
jmp 0x14000d4a1
mov eax, 2
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140025ea0
mov rbx, qword [rsp + 0x1058]
add rsp, 0x1030
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000d5ec
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2030
call fcn.140026310
sub rsp, rax
mov rax, qword [0x1400517e8]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
test eax, eax
jne 0x14000d674
mov r8d, 0x800
lea rdx, [rsp + 0x1020]
mov rcx, rdi
call fcn.14000f330
test al, al
je 0x14000d674
mov r8d, 0x800
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14000f330
test al, al
je 0x14000d674
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x1020]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov al, bl
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.140025ea0
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000d864
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1030
call fcn.140026310
sub rsp, rax
mov rax, qword [0x1400517e8]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov edi, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test eax, eax
jne 0x14000d8cb
mov r8d, 0x800
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14000f330
test al, al
je 0x14000d8cb
mov edx, edi
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
mov al, bl
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140025ea0
lea r11, [rsp + 0x1030]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14000dab0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x1180]
mov eax, 0x1280
call fcn.140026310
sub rsp, rax
mov rax, qword [0x1400517e8]
xor rax, rsp
mov qword [rbp + 0x1170], rax
mov rsi, rdx
lea rdx, [rsp + 0x20]
mov rdi, r8
mov rbx, rcx
mov r15d, 0x800
cmp rcx, 0xffffffffffffffff
jne 0x14000db61
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000db7d
mov r8d, r15d
lea rdx, [rbp + 0x170]
mov rcx, rsi
call fcn.14000f330
test al, al
je 0x14000db3a
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000db7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 2]
test ecx, 0xffffffee
jne 0x14000db54
cmp eax, 0x13
je 0x14000db54
xor al, al
jmp 0x14000db56
mov al, 1
mov byte [rdi + 0x1044], al
jmp 0x14000dc12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000db7d
or rbx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
jmp 0x14000db56
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call fcn.1400149a8
mov r8, r15
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call fcn.14000fcc4
mov eax, dword [rsp + 0x40]
lea rdx, [rsp + 0x34]
mov ecx, dword [rsp + 0x3c]
shl rcx, 0x20
add rcx, rax
mov eax, dword [rsp + 0x20]
mov dword [rdi + 0x1008], eax
mov rax, qword [rsp + 0x24]
mov qword [rdi + 0x1028], rax
mov rax, qword [rsp + 0x2c]
mov qword [rdi + 0x1030], rax
mov rax, qword [rsp + 0x34]
mov qword [rdi + 0x1000], rcx
lea rcx, [rdi + 0x1010]
mov qword [rdi + 0x1038], rax
call fcn.140015d2c
lea rcx, [rdi + 0x1018]
lea rdx, [rsp + 0x24]
call fcn.140015d2c
lea rcx, [rdi + 0x1020]
lea rdx, [rsp + 0x2c]
call fcn.140015d2c
and dword [rdi + 0x1040], 0
mov rax, rbx
mov rcx, qword [rbp + 0x1170]
xor rcx, rsp
call fcn.140025ea0
add rsp, 0x1280
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000e54c
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1400517e8]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor bl, bl
cmp byte [0x1400544a0], bl
jne 0x14000e5b1
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 0xa
ja 0x14000e5a0
jne 0x14000e5a2
cmp dword [rsp + 0x2c], 0x55f0
jb 0x14000e5a2
call fcn.14000e5d4
test al, al
jne 0x14000e5a2
mov bl, 1
mov byte [0x1400544a1], bl
mov byte [0x1400544a0], 1
jmp 0x14000e5b7
mov bl, byte [0x1400544a1]
mov al, bl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140025ea0
add rsp, 0x150
pop rbx
ret
Function at 0x14000f330
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x1030
call fcn.140026310
sub rsp, rax
mov rax, qword [0x1400517e8]
xor rax, rsp
mov qword [rsp + 0x1020], rax
xor r14d, r14d
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp word [rcx], r14w
je 0x14000f4e3
call fcn.14000f50c
mov rcx, rbx
call fcn.14002cab8
mov rcx, rbx
mov rbp, rax
call fcn.14000f53c
test al, al
je 0x14000f418
mov rcx, rbx
call fcn.14000f50c
test al, al
je 0x14000f3cc
lea rax, [rbp + 4]
cmp rdi, rax
jbe 0x14000f4e3
mov r8, rdi
lea rdx, [0x140040f90]
mov rcx, rsi
call fcn.1400149a8
mov rdx, rbx
mov r8, rdi
mov rcx, rsi
call fcn.140014964
mov al, 1
jmp 0x14000f4e5
cmp word [rbx], 0x5c
jne 0x14000f4e3
cmp word [rbx + 2], 0x5c
jne 0x14000f4e3
lea rax, [rbp + 6]
cmp rdi, rax
jbe 0x14000f4e3
mov r8, rdi
lea rdx, [0x140040f90]
mov rcx, rsi
call fcn.1400149a8
mov r8, rdi
lea rdx, [0x140040fa0]
mov rcx, rsi
call fcn.140014964
lea rdx, [rbx + 2]
jmp 0x14000f3ba
lea rdx, [rsp + 0x20]
mov ecx, 0x7ff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x7fe
ja 0x14000f4e3
cmp word [rbx], 0x5c
je 0x14000f4ad
cmp word [rbx], 0x2f
je 0x14000f4ad
mov edx, 0x800
lea rcx, [rsp + 0x20]
call fcn.14000ed4c
lea rcx, [rsp + 0x20]
call fcn.14002cab8
lea rcx, [rax + 4]
add rcx, rbp
cmp rdi, rcx
jbe 0x14000f4e3
mov r8, rdi
lea rdx, [0x140040f90]
mov rcx, rsi
call fcn.1400149a8
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140014964
cmp word [rbx], 0x2e
jne 0x14000f3b7
cmp word [rbx + 2], 0x5c
je 0x14000f4a4
cmp word [rbx + 2], 0x2f
jne 0x14000f3b7
add rbx, 4
jmp 0x14000f3b7
lea rax, [rbp + 6]
cmp rdi, rax
jbe 0x14000f4e3
mov r8, rdi
lea rdx, [0x140040f90]
mov rcx, rsi
call fcn.1400149a8
mov r8, rdi
mov word [rsp + 0x24], r14w
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140014964
jmp 0x14000f3b7
xor al, al
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140025ea0
add rsp, 0x1030
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140010490
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, r8d
mov rsi, r9
mov r10b, bl
cmp r8d, 1
jbe 0x1400104c4
lea rcx, [rdx + 1]
lea r8d, [rdi - 1]
xor r10b, byte [rcx]
inc rcx
sub r8, 1
jne 0x1400104b8
cmp r10b, byte [rdx]
jne 0x140010500
mov r8, rdi
or ecx, 0xffffffff
call fcn.140007138
lea rdx, [0x140051060]
not eax
mov rcx, rdx
cmp dword [rcx + 4], eax
jne 0x1400104e9
cmp dword [rcx], edi
je 0x1400104f6
inc ebx
add rcx, 0xc
cmp ebx, 6
jae 0x140010500
jmp 0x1400104e0
lea rcx, [rbx + rbx*2]
mov eax, dword [rdx + rcx*4 + 8]
mov dword [rsi], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140014c50
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x1030
call fcn.140026310
sub rsp, rax
mov rax, qword [0x1400517e8]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rbx, rcx
mov edx, 0x800
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140014c8c
xor eax, eax
jmp 0x140014caf
mov r9d, 0x800
lea r8, [rsp + 0x20]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14000f668
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140025ea0
add rsp, 0x1030
pop rbx
ret
Function at 0x140020ef8
Capabilities:
Delete file

Disassembly:
push rbx
mov eax, 0x1080
call fcn.140026310
sub rsp, rax
mov rax, qword [0x1400517e8]
xor rax, rsp
mov qword [rsp + 0x1070], rax
xor ebx, ebx
cmp word [0x140063c92], bx
je 0x140020fc2
lea rcx, [0x140063c92]
call fcn.14000fc38
mov rdx, qword [str.RarSFX]
lea r8d, [rbx + 6]
mov rcx, rax
call fcn.14001681c
test eax, eax
jne 0x140020fc2
lea rcx, [0x140062c90]
call fcn.140020acc
mov r8d, 0x800
lea rdx, [0x140063c92]
lea rcx, [rsp + 0x60]
call fcn.1400149a8
lea rcx, [rsp + 0x60]
call fcn.14002cab8
lea rax, [rax*2 + 2]
cmp rax, 0x1002
jae 0x140020fdb
xor edx, edx
mov word [rsp + rax + 0x60], bx
lea r8d, [rbx + 0x38]
lea rcx, [rsp + 0x20]
call fcn.1400271f0
lea eax, [rbx + 0x14]
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.140025ea0
add rsp, 0x1080
pop rbx
ret
call fcn.1400260e4
int3

Function at 0x140021064
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x1400517e8]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor ebp, ebp
mov rdi, r8
cmp qword [0x1400512d8], rbp
mov rbx, rdx
mov rsi, rcx
jne 0x1400210d7
lea r9d, [rbp + 0x64]
mov ecx, 0x400
lea r8, [rsp + 0xa0]
lea edx, [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movzx eax, word [rsp + 0xa0]
mov word [0x140073328], ax
lea rax, [0x140073328]
mov qword [0x1400512d8], rax
mov word [0x14007332a], bp
mov r8d, 0x32
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400147ec
lea r9, [0x1400512c0]
mov dword [rsp + 0x28], edi
lea r8, [rsp + 0x30]
mov word [rbx], bp
xor edx, edx
mov qword [rsp + 0x20], rbx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov word [rbx + rdi*2 - 2], bp
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140025ea0
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400efd8c
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1400efe17
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1400efe17
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400efe17
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1400efe13
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1400efe0d
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jae 0x1400efe0d
test rdx, rdx
je 0x1400efe13
cmp dword [rdx + 0x24], 0
jge 0x1400efe09
xor al, al
jmp 0x1400efe1d
mov al, 1
jmp 0x1400efe1d
add rdx, 0x28
jmp 0x1400efddf
xor al, al
jmp 0x1400efe1d
xor al, al
jmp 0x1400efe1d
add rsp, 0x18
ret
Function at 0x1800011a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800011e2
xor al, al
jmp 0x180001260
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x4550
je 0x18000120c
xor al, al
jmp 0x180001260
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x78], rax
jb 0x180001258
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
mov ecx, dword [rcx + 0xec]
add rax, rcx
cmp qword [rsp + 0x78], rax
jae 0x180001258
mov al, 1
jmp 0x180001260
xor al, al
jmp 0x180001260
add rsp, 0x68
ret

Function at 0x1800012f0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1800a16d0]
mov qword [rsp + 0x20], rax
jmp 0x180001310
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180001335
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x180001302
add rsp, 0x38
ret
Function at 0x180001340
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1800a16e8], eax
je 0x18000135c
mov eax, 0x10dd
jmp 0x180001479
mov rax, qword [0x1800a1700]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180001402
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x20]
cmp dword [rax + 8], 0
jne 0x1800013d2
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x20], 0
je 0x1800013d2
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x20]
call fcn.1800014f0
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.18006a3dc
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
jmp 0x180001368
mov qword [0x1800a1700], 0
call fcn.180001480
mov rax, qword [0x1800a16f8]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180001462
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.18006a3dc
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x18000141e
mov qword [0x1800a16f8], 0
mov dword [0x1800a16e8], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x180001bf0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x52727464
je 0x180001c0d
xor eax, eax
jmp 0x180001ca5
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp]
add rax, 0x10000
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
add rax, 0x60
mov qword [rsp + 0x10], rax
mov dword [rsp + 0x18], 0
jmp 0x180001c47
mov eax, dword [rsp + 0x18]
inc eax
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0x2a9
jae 0x180001ca0
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
cmp qword [rcx + rax + 0x48], 0
je 0x180001c9e
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp]
cmp qword [rcx + rax + 0x48], rdx
jb 0x180001c9a
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
cmp qword [rcx + rax + 0x48], rdx
jb 0x180001c9e
xor eax, eax
jmp 0x180001ca5
jmp 0x180001c3d
mov eax, 1
add rsp, 0x28
ret

Function at 0x180001d90
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x1800a16ec], 0
je 0x180001dad
mov eax, dword [0x1800a16ec]
jmp 0x180001e71
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp qword [rsp + 0x50], rax
jne 0x180001dc1
xor eax, eax
jmp 0x180001e71
mov ecx, 0x10
call fcn.180069dac
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180001e2a
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x180001e0f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.18006a3dc
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x1800a16ec], eax
mov qword [0x1800a16f0], 0
mov eax, dword [rsp + 0x20]
jmp 0x180001e71
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180001e46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x180001dea
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x1800a16f8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x1800a16f8], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x1800029a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180002aa0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180002a98
cmp qword [rsp + 0x20], 0x50000000
jb 0x1800029f0
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x1800029f0
mov eax, 0x80010000
mov qword [rsp + 0x20], rax
jmp 0x1800029bd
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180002a1f
jmp 0x180002a98
cmp dword [rsp + 0x48], 0x10000
jne 0x180002a76
cmp qword [rsp + 0x40], 0x10000
jb 0x180002a76
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x180002a64
mov rax, qword [rsp + 0x58]
jmp 0x180002a9a
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180002a93
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180002aa0
mov qword [rsp + 0x20], rax
jmp 0x1800029bd
xor eax, eax
add rsp, 0x68
ret

Function at 0x180002af0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180002c00
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180002beb
cmp qword [rsp + 0x20], 0x50000000
jb 0x180002b48
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x180002b48
mov qword [rsp + 0x20], 0x4fff0000
jmp 0x180002b16
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180002b77
jmp 0x180002beb
cmp dword [rsp + 0x48], 0x10000
jne 0x180002bce
cmp qword [rsp + 0x40], 0x10000
jb 0x180002bce
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x180002bbc
mov rax, qword [rsp + 0x58]
jmp 0x180002bed
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180002be6
mov rax, qword [rsp + 0x30]
sub rax, 0x10000
mov rcx, rax
call fcn.180002c00
mov qword [rsp + 0x20], rax
jmp 0x180002b16
xor eax, eax
add rsp, 0x68
ret