joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002840
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x18000c040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18000286d
xor eax, eax
jmp 0x1800029d9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1800028a7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1800028a7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1800029d9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1800029cc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800028ea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180002915
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800029d1
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180002984
sub eax, 1
je 0x180002984
cmp eax, 2
jne 0x1800029cc
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800029d1
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1800029b2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1800029cc
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1800029d1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800070f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180002dc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18000c040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180002e93
cmp byte [rcx + 0x71], 0
je 0x180002e93
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180002e8f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180002e54
sub eax, 1
je 0x180002e58
cmp eax, 2
jne 0x180002e8f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800070f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180002e86
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180002e8f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180002e3c
xor al, al
jmp 0x180002e3c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800070f0
add rsp, 0x60
pop rbx
ret

Function at 0x180003620
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180003840
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180003727
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180003684
mov rax, qword [0x18000c008]
cmp qword [rsp + 0x20], rax
ja 0x180003684
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180003646
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800036b3
jmp 0x180003727
cmp dword [rsp + 0x50], 0x10000
jne 0x18000370a
cmp qword [rsp + 0x48], 0x10000
jb 0x18000370a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800036f8
mov rax, qword [rsp + 0x28]
jmp 0x180003729
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180003722
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180003840
mov qword [rsp + 0x20], rax
jmp 0x180003646
xor eax, eax
add rsp, 0x68
ret
Function at 0x180003730
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180003880
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180003833
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18000378b
mov rax, qword [0x18000c008]
cmp qword [rsp + 0x20], rax
ja 0x18000378b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18000374d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800037ba
jmp 0x180003833
cmp dword [rsp + 0x50], 0x10000
jne 0x180003811
cmp qword [rsp + 0x48], 0x10000
jb 0x180003811
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800037ff
mov rax, qword [rsp + 0x28]
jmp 0x180003835
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18000382e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180003880
mov qword [rsp + 0x20], rax
jmp 0x18000374d
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800038d0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180003e60
mov qword [rsp + 0x28], 0
cmp qword [0x18000c368], 0
jne 0x180003918
cmp qword [0x18000c360], 0
je 0x180003918
mov rax, qword [0x18000c360]
mov qword [0x18000c368], rax
cmp qword [0x18000c368], 0
je 0x1800039be
mov rax, qword [0x18000c368]
cmp qword [rax + 0x10], 0
je 0x1800039be
mov rax, qword [0x18000c368]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800039be
mov rax, qword [0x18000c368]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800039be
mov rax, qword [0x18000c368]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180003984
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18000398b
xor eax, eax
jmp 0x180003b39
mov rax, qword [0x18000c368]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x180003b39
mov rax, qword [0x18000c360]
mov qword [0x18000c368], rax
jmp 0x1800039e0
mov rax, qword [0x18000c368]
mov rax, qword [rax + 8]
mov qword [0x18000c368], rax
cmp qword [0x18000c368], 0
je 0x180003a2d
cmp qword [0x18000c368], 0
je 0x180003a2b
mov rax, qword [0x18000c368]
cmp qword [rax + 0x10], 0
je 0x180003a2b
mov rax, qword [0x18000c368]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180003a2b
mov rax, qword [0x18000c368]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180003a2b
jmp 0x18000395c
jmp 0x1800039ce
mov rcx, qword [rsp + 0x60]
call fcn.180005ce0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180003b40
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180003b37
mov rax, qword [rsp + 0x48]
mov qword [0x18000c368], rax
mov rax, qword [0x18000c368]
mov dword [rax], 0x52727464
mov rax, qword [0x18000c368]
mov qword [rax + 0x10], 0
mov rax, qword [0x18000c368]
mov rcx, qword [0x18000c360]
mov qword [rax + 8], rcx
mov rax, qword [0x18000c368]
mov qword [0x18000c360], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18000c368]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180003ae8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180003b22
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180003ade
mov rax, qword [0x18000c368]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18000395c
xor eax, eax
add rsp, 0x58
ret
Function at 0x18001122b
Capabilities:
Terminate process

Disassembly:
jmp 0x180018720
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x180014230
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1c8]
mov rax, qword [0x180023280]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x180029227]
call fcn.1800113ca
nop
mov eax, dword [rbp + 0x1a0]
imul rax, rax, 0x38
mov rcx, qword [0x180023be0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov qword [rbp + 0x48], 5
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800142d3
mov rax, qword [rbp + 0x68]
sub rax, 5
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
add rax, 2
mov qword [rbp + 0x48], rax
lea r9, [rbp + 0x24]
mov r8d, 0x40
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800142f9
mov eax, 0xa
jmp 0x18001442c
cmp dword [rbp + 0x1a8], 0
je 0x18001436d
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov byte [rax], 0xe9
mov rax, qword [rbp + 0x68]
add rax, 5
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x88]
mov dword [rcx + 1], eax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18001436b
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov byte [rax], 0xeb
mov rax, qword [rbp + 0xa8]
mov byte [rax + 1], 0xf9
jmp 0x1800143b6
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18001439b
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call fcn.1800111e5
nop
jmp 0x1800143b6
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call fcn.1800111e5
nop
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
nop
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 1
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 2
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x18001fd50]
call fcn.18001134d
mov rax, rdi
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.1800111e0
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x180014590
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [0x180023280]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x180029227]
call fcn.1800113ca
nop
mov dword [rbp + 4], 0
xor edx, edx
mov ecx, 4
call fcn.1800111d1
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x1800147d8
mov dword [rbp + 0x48], 0x1c
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call fcn.180011267
test eax, eax
je 0x1800147cd
mov dword [rbp + 4], 1
mov eax, dword [rbp + 0x48]
cmp rax, 0x10
jb 0x18001475e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp + 0x54], eax
jne 0x18001475e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbp + 0x50], eax
je 0x18001475e
mov rax, qword [rbp + 0x180]
cmp qword [rax], 0
jne 0x1800146ad
mov rax, qword [rbp + 0x180]
mov dword [rax + 8], 0x80
mov rax, qword [rbp + 0x180]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x180023448]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbp + 0x180]
mov qword [rcx], rax
mov rax, qword [rbp + 0x180]
cmp qword [rax], 0
jne 0x1800146a8
mov dword [rbp + 4], 0
jmp 0x18001477a
jmp 0x18001472e
mov rax, qword [rbp + 0x180]
mov rcx, qword [rbp + 0x180]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x18001472e
mov rax, qword [rbp + 0x180]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rbp + 0x180]
mov dword [rcx + 8], eax
mov rax, qword [rbp + 0x180]
mov eax, dword [rax + 8]
shl rax, 2
mov r9, rax
mov rax, qword [rbp + 0x180]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x180023448]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x18001471d
mov dword [rbp + 4], 0
jmp 0x18001477a
mov rax, qword [rbp + 0x180]
mov rcx, qword [rbp + 0x88]
mov qword [rax], rcx
mov rax, qword [rbp + 0x180]
mov eax, dword [rax + 0xc]
mov rcx, qword [rbp + 0x180]
mov rcx, qword [rcx]
mov edx, dword [rbp + 0x50]
mov dword [rcx + rax*4], edx
mov rax, qword [rbp + 0x180]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rbp + 0x180]
mov dword [rcx + 0xc], eax
mov dword [rbp + 0x48], 0x1c
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call fcn.180011078
test eax, eax
jne 0x18001461f
cmp dword [rbp + 4], 0
je 0x180014792
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x180014792
mov dword [rbp + 4], 0
cmp dword [rbp + 4], 0
jne 0x1800147cd
mov rax, qword [rbp + 0x180]
cmp qword [rax], 0
je 0x1800147cd
mov rax, qword [rbp + 0x180]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x180023448]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rax, qword [rbp + 0x180]
mov qword [rax], 0
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x18001fcd0]
call fcn.18001134d
mov eax, edi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.1800111e0
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x180014b30
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rcx, [0x180029227]
call fcn.1800113ca
nop
mov dword [rbp + 4], 0
mov rax, qword [rbp + 0x180]
mov qword [rax], 0
mov rax, qword [rbp + 0x180]
mov dword [rax + 8], 0
mov rax, qword [rbp + 0x180]
mov dword [rax + 0xc], 0
mov rcx, qword [rbp + 0x180]
call fcn.180014590
test eax, eax
jne 0x180014ba6
mov dword [rbp + 4], 9
jmp 0x180014c6c
mov rax, qword [rbp + 0x180]
cmp qword [rax], 0
je 0x180014c6c
mov dword [rbp + 0x24], 0
jmp 0x180014bc8
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
mov rax, qword [rbp + 0x180]
mov eax, dword [rax + 0xc]
cmp dword [rbp + 0x24], eax
jae 0x180014c6c
mov eax, dword [rbp + 0x24]
mov rcx, qword [rbp + 0x180]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x64], 0
cmp qword [rbp + 0x48], 0
je 0x180014c4d
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0xffffffff
je 0x180014c42
mov dword [rbp + 0x64], 1
mov r8d, dword [rbp + 0x190]
mov edx, dword [rbp + 0x188]
mov rcx, qword [rbp + 0x48]
call fcn.180015a40
nop
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [rbp + 0x64], 0
jne 0x180014c67
mov eax, dword [rbp + 0x24]
mov rcx, qword [rbp + 0x180]
mov rcx, qword [rcx]
mov dword [rcx + rax*4], 0
jmp 0x180014bc0
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x180015e30
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x180029227]
call fcn.1800113ca
nop
mov rax, qword [rbp + 0x140]
cmp qword [rax], 0
je 0x180015ee8
mov dword [rbp + 4], 0
jmp 0x180015e72
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x140]
mov eax, dword [rax + 0xc]
cmp dword [rbp + 4], eax
jae 0x180015ece
mov eax, dword [rbp + 4]
mov rcx, qword [rbp + 0x140]
mov rcx, qword [rcx]
mov eax, dword [rcx + rax*4]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x180015ecc
mov r8d, dword [rbp + 0x24]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x180015ecc
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x180015e6a
mov rax, qword [rbp + 0x140]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x180023448]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x180016910
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1800292fa]
call fcn.1800113ca
nop
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x180016986
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x180016986
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x180016986
xor eax, eax
jmp 0x1800169d3
mov dword [rbp + 4], 1
jmp 0x180016997
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0x108]
cmp dword [rbp + 4], eax
jae 0x1800169ce
mov eax, dword [rbp + 4]
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x100]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x1800169cc
xor eax, eax
jmp 0x1800169d3
jmp 0x18001698f
mov eax, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14007aa3c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x140098220], 0
mov r14, rdx
mov r15, rcx
lea rbx, [0x140098230]
jne 0x14007aa89
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x140098258], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x140098220], 1
mov ecx, dword [0x140098258]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x14007ab5e
mov rcx, qword [0x140096d1c]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x14007ab89
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x140098228]
test rax, rax
je 0x14007aad9
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x140098228], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x20]
mov r8, rdi
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x100000
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
lea r8, [0x14007aba4]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x140098258]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x140096d1c]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14007ab89
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x143015de4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x143015dee
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x143015e17
pop rbp
sub rbp, 0x33
sub rbp, 0x3015de4
sub rsp, 0x20
jmp 0x143015e36
mov rax, 0x3015de4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffc73b87f3
xor byte [rax], dl
inc rax
dec rcx
jne 0x143015e55
jmp 0x143015e6c
mov ebx, 0x7a781a7a
iretd
Function at 0x142adf918
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc esi
jmp 0x142a343cd
push rbx
movzx r9, r13w
push rcx
movsxd r9, r9d
cwd
movzx cx, spl
push r11
rdtsc
movzx edx, bx
cqo
push r14
movsx cx, dil
movsx r11, r12w
cdq
push rsi
setnp ah
movzx esi, ax
mov cl, r9b
push r10
cdqe
cbw
rdtsc
push r15
push rbp
cwd
mov r9b, 0xd
movzx r11d, di
push r8
movzx rdx, cx
mov rbp, r12
push rdi
movsx rdx, r14w
cwde
push r12
rdtsc
inc ebp
movabs rdx, 0
movzx rax, ax
dec bpl
xchg r9w, r9w
push rdx
movzx r11w, bpl
movzx r11d, ax
setge ah
mov rsi, qword [rsp + 0x90]
not esi
jmp 0x1429debbe
dec ecx
jmp 0x142a0317f
ror ecx, 2
jmp 0x142a83192
xor ecx, 0x41f43568
jmp 0x1429e5ac6
rol esi, 2
sar cx, cl
cmc
add esi, 0x337f4b10
adc r9w, 0x62a7
rcr r9b, cl
lea rsi, [rsi + rdx]
setle r11b
shrd r9, r13, 0x8a
neg dl
movabs rdx, 0x100000000
dec ah
add rsi, rdx
mov r9, rsp
sub rsp, 0x180
shr rbp, cl
adc rcx, r14
or eax, ebp
and rsp, 0xfffffffffffffff0
mov r11, rsi
movabs rax, 0
not ch
add bp, bx
adc ecx, edx
sub r11, rax
xadd cx, bp
clc
sal ch, 0xa0
lea rbp, [0x142a34439]
cmp r14d, 0x1b2842b0
btr rcx, r13
mov ecx, dword [rsi]
add rsi, 4
xor ecx, r11d
cmc
test ecx, 0x7c554a4f
neg ecx
cmp r11b, r15b
test r10b, al
jmp 0x142a11ac0
push rdx
jmp 0x1429e3692
inc ecx
rol ecx, 1
cmc
clc
push r11
sbb r11d, r8d
xor dword [rsp], ecx
rcr r11w, 0xfb
pop r11
cmp r12d, 0x68dd094d
movsxd rcx, ecx
cmp r9w, 0x4be1
clc
add rbp, rcx
push rbp
ret
push r9
push rax
push r13
mov r9b, 0x2c
cwde
pushfq
jmp 0x142a67151