joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800257e8
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x180048040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor ebx, ebx
cmp qword [0x18004dcc8], rbx
jne 0x18002589c
lea ecx, [rbx + 0x1b]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18002589c
lea rcx, str.dwm.exe
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18002589c
mov rax, qword [0x18004dee8]
lea rcx, [0x1800258d4]
test rax, rax
je 0x18002584a
cmp rax, rcx
jne 0x1800258b5
mov qword [0x18004dee8], rcx
lea rcx, [0x180023e6c]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x18002454c]
mov qword [0x18004dcd8], rax
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180025895
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x18004dbe5], 1
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.18002dc90
add rsp, 0xe0
pop rbx
ret
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x98
call sub.ucrtbase.dll_memset
lea rcx, [rsp + 0x30]
call fcn.18000b25c
int3
Function at 0x180025aa8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x180025ad0
mov rdx, qword [r8]
xor ecx, ecx
movabs r14, 0xcbf29ce484222325
cmp qword [r8 + 0x10], rcx
jbe 0x180025b00
movzx eax, byte [rdx + rcx]
xor r14, rax
movabs r8, 0x100000001b3
imul r14, r8
inc rcx
cmp rcx, qword [rbx + 0x10]
jb 0x180025ae2
mov r9, r14
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.180019578
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x180025b30
mov rcx, qword [r15]
mov qword [rax + 0x30], rcx
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x180025ce2
movabs rax, 0x492492492492492
cmp qword [rbp + 0x10], rax
je 0x180025cf4
lea r12, [rbp + 8]
mov qword [rsp + 0x30], r12
and qword [rsp + 0x38], 0
mov ecx, 0x38
call fcn.18001bb70
mov rdi, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
and qword [rax + 0x20], 0
and qword [rax + 0x28], 0
movups xmm0, xmmword [rbx]
movups xmmword [rax + 0x10], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x20], xmm1
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, qword [r15]
mov qword [rdi + 0x30], rax
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x180025bb0
cvtsi2ss xmm0, rcx
jmp 0x180025bc5
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rbx, qword [rbp + 0x38]
xorps xmm2, xmm2
test rbx, rbx
js 0x180025bd8
cvtsi2ss xmm2, rbx
jmp 0x180025bf0
mov rcx, rbx
shr rcx, 1
mov rax, rbx
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
comiss xmm1, dword [rbp]
seta al
test al, al
je 0x180025c8b
divss xmm0, dword [rbp]
call sub.ucrtbase.dll_ceilf
xor ecx, ecx
movss xmm1, dword [0x18003a100]
comiss xmm0, xmm1
jb 0x180025c35
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x180025c35
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x180025c63
cmp rbx, 0x200
jae 0x180025c60
shl rbx, 3
cmp rbx, rcx
jae 0x180025c63
mov rbx, rcx
mov rdx, rbx
mov rcx, rbp
call fcn.180025e10
lea r8, [rdi + 0x10]
mov r9, r14
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.180019578
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rdx + 8], rdi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, r14
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x180025cc4
mov qword [rcx + rax*8], rdi
jmp 0x180025cd6
cmp r9, rdx
jne 0x180025ccf
mov qword [rcx + rax*8], rdi
jmp 0x180025cdb
cmp qword [rcx + rax*8 + 8], r8
jne 0x180025cdb
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.unordered_map_set_too_long
call fcn.18002db24
int3
Function at 0x180025e10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movabs rax, 0xfffffffffffffff
mov qword [rsp + 0x20], rcx
mov rsi, rcx
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
ja 0x180026030
mov rbp, qword [rsi + 8]
lea rax, [rdx - 1]
or rax, 1
lea r12, [rsi + 0x18]
bsr rcx, rax
mov ebx, 1
mov r8, rbp
inc ecx
shl rbx, cl
mov rcx, r12
lea rdx, [rbx + rbx]
call fcn.1800078d4
lea rax, [rbx - 1]
mov qword [rsi + 0x38], rbx
mov qword [rsi + 0x30], rax
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
mov rdi, rbx
cmp rbx, rbp
je 0x180025fe2
mov rdi, qword [rdi]
lea r14, [rbx + 0x10]
mov rax, qword [r14 + 0x18]
mov r8, r14
mov r13, qword [r14 + 0x10]
cmp rax, 0xf
jbe 0x180025eb2
mov r8, qword [r14]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r13, r13
je 0x180025ee5
movzx eax, byte [r8 + rdx]
movabs r9, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r9
cmp rdx, r13
jb 0x180025ec3
mov rax, qword [r14 + 0x18]
mov r15, qword [rsi + 0x30]
mov r12, qword [r12]
and r15, rcx
add r15, r15
cmp qword [r12 + r15*8], rbp
jne 0x180025f07
mov qword [r12 + r15*8], rbx
mov qword [r12 + r15*8 + 8], rbx
jmp 0x180025fd2
mov rsi, qword [r12 + r15*8 + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0xf
mov r8, qword [rdx + 0x10]
jbe 0x180025f1e
mov rdx, qword [rdx]
mov rcx, r14
cmp rax, 0xf
jbe 0x180025f2a
mov rcx, qword [r14]
cmp r13, r8
jne 0x180025fa2
mov r8, r13
call sub.ucrtbase.dll_memcmp
test eax, eax
jne 0x180025f9e
mov r8, qword [rsi]
cmp r8, rbx
je 0x180025f64
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r15*8 + 8], rbx
jmp 0x180025fcd
mov rsi, qword [rsi + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0xf
mov r8, qword [rdx + 0x10]
jbe 0x180025f81
mov rdx, qword [rdx]
mov rcx, r14
cmp rax, 0xf
jbe 0x180025f8d
mov rcx, qword [r14]
cmp r13, r8
jne 0x180025fa2
mov r8, r13
call sub.ucrtbase.dll_memcmp
test eax, eax
je 0x18002600a
mov rax, qword [r14 + 0x18]
cmp qword [r12 + r15*8], rsi
jne 0x180025f6b
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rsi
mov rax, qword [rsi + 8]
mov qword [rax], rbx
mov qword [rsi + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r15*8], rbx
mov rsi, qword [rsp + 0x20]
lea r12, [rsi + 0x18]
mov rbx, rdi
cmp rdi, rbp
jne 0x180025e97
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.180026040
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, qword [rsi]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x180025fcd
lea rcx, str.invalid_hash_bucket_count
call fcn.18002db24
int3
Function at 0x180026118
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, rdx
mov qword [rsp + 0x20], rcx
mov rbp, r8
mov rdx, rcx
cmp r15, r8
je 0x1800262c5
mov rax, qword [rcx + 8]
mov rsi, r15
mov r12, qword [rcx + 0x18]
lea rcx, [r15 + 0x10]
cmp qword [rcx + 0x18], 0xf
mov r14, qword [r15 + 8]
mov r10, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
jbe 0x180026171
mov rcx, qword [rcx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
movabs r11, 0x100000001b3
test r10, r10
je 0x1800261a1
movzx eax, byte [rcx + r8]
inc r8
xor r9, rax
imul r9, r11
cmp r8, r10
jb 0x18002618d
mov r13, qword [rdx + 0x30]
and r13, r9
add r13, r13
mov rax, qword [r12 + r13*8]
mov qword [rsp + 0x28], rax
mov rax, qword [r12 + r13*8 + 8]
mov qword [rsp + 0x38], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x10]
call fcn.18000a888
mov rcx, qword [0x18004e268]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x20]
dec qword [r8 + 0x10]
cmp rbx, qword [rsp + 0x38]
je 0x18002620b
cmp rsi, rbp
jne 0x1800261be
cmp qword [rsp + 0x28], r15
jne 0x1800262be
mov qword [r12 + r13*8], rsi
jmp 0x1800262be
cmp qword [rsp + 0x28], r15
jne 0x180026220
mov rdx, qword [rsp + 0x30]
mov qword [r12 + r13*8], rdx
mov rax, rdx
jmp 0x180026223
mov rax, r14
mov qword [r12 + r13*8 + 8], rax
jmp 0x1800262f4
lea rcx, [rsi + 0x10]
cmp qword [rcx + 0x18], 0xf
mov r10, qword [rcx + 0x10]
jbe 0x18002623f
mov rcx, qword [rcx]
xor r9d, r9d
movabs rdx, 0xcbf29ce484222325
test r10, r10
je 0x180026274
movabs r8, 0x100000001b3
movzx eax, byte [rcx + r9]
inc r9
xor rdx, rax
imul rdx, r8
cmp r9, r10
jb 0x18002625b
mov r8, qword [rsp + 0x20]
mov r15, qword [r8 + 0x30]
and r15, rdx
add r15, r15
mov r13, qword [r12 + r15*8 + 8]
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x10]
call fcn.18000a888
mov rcx, qword [0x18004e268]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x20]
dec qword [r8 + 0x10]
cmp rbx, r13
je 0x1800262e6
cmp rsi, rbp
jne 0x180026283
mov qword [r12 + r15*8], rsi
mov qword [r14], rsi
mov qword [rsi + 8], r14
lea r11, [rsp + 0x40]
mov rax, rbp
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [rsp + 0x30]
mov qword [r12 + r15*8], rax
mov qword [r12 + r15*8 + 8], rax
cmp rsi, rbp
jne 0x18002622d
jmp 0x1800262be
Function at 0x180027590
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x180048040]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r15d, r15d
lea rax, [rsp + 0x30]
mov qword [r8], r15
lea rdx, [rsp + 0x30]
sub rcx, rax
mov r14, r8
mov r9d, 0x104
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x180027601
movzx eax, word [rcx + rdx]
test ax, ax
je 0x180027601
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x1800275df
test r9, r9
lea rax, [rdx - 2]
lea r8, [0x180039df0]
cmovne rax, rdx
lea rcx, [rsp + 0x30]
mov word [rax], r15w
call fcn.1800263f4
mov ebx, 0x1f0003
lea r8, [rsp + 0x30]
mov ecx, ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov rdi, rax
test rax, rax
jne 0x18002765d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18002764d
mov esi, r15d
jmp 0x180027688
mov rcx, qword [rbp + 0x168]
call fcn.18000fcac
mov esi, eax
jmp 0x180027688
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], r15d
mov rcx, rdi
mov dword [rsp + 0x24], r15d
call fcn.180027470
mov esi, eax
test eax, eax
jns 0x1800276bf
mov rcx, qword [rbp + 0x168]
mov edx, eax
call fcn.18001020c
test rdi, rdi
jne 0x18002774b
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.18002dc90
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea r8, [0x180039e30]
lea rcx, [rsp + 0x30]
call fcn.1800263f4
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov rbx, rax
test rax, rax
jne 0x1800276f7
mov rcx, qword [rbp + 0x168]
call fcn.18000fcac
mov esi, eax
jmp 0x18002774b
lea rdx, [rsp + 0x24]
mov rcx, rbx
call fcn.180027470
mov esi, eax
test eax, eax
jns 0x180027727
mov rcx, qword [rbp + 0x168]
mov edx, eax
call fcn.18001020c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18002776a
jmp 0x18002774b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18002775d
movsxd rcx, dword [rsp + 0x24]
mov esi, r15d
movsxd rax, dword [rsp + 0x20]
shl rcx, 0x1f
or rcx, rax
mov qword [r14], rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x180027777
jmp 0x180027691
mov rcx, qword [rbp + 0x168]
call fcn.18002745c
int3
mov rcx, qword [rbp + 0x168]
call fcn.18002745c
int3
mov rcx, qword [rbp + 0x168]
call fcn.18002745c
int3
Function at 0x180028ef4
Capabilities:
Check for sandbox and av modules

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov rbx, qword [rdi + 8]
lea rax, str.api_ms_win_core_libraryloader_l1_1_0.dll
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x28
lea rcx, [0x180039f98]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov r9, rbx
lea r8, [0x180039f08]
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.180021e78
mov qword [rdi + 8], rax
lea rcx, [rdi + 0x50]
call fcn.18000ad10
add rdi, 0x10
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x180028f83
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
and qword [rdi + 0x38], 0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180029840
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x40]
call sub.ucrtbase.dll_memset
nop
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
ja 0x18002988c
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18002995a
cmp dword [rsp + 0x60], 0x1000
jne 0x1800298b1
mov eax, dword [rsp + 0x64]
and eax, 0xff
cmp eax, 1
je 0x1800298b1
mov eax, dword [rsp + 0x64]
and eax, 0x100
test eax, eax
je 0x1800298c3
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18002995a
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800298eb
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18002995a
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x180029920
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18002995a
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x18002993c
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18002995a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x28]
jmp 0x18002995a
add rsp, 0x78
ret

Function at 0x180029ac0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180029ce0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180029bc7
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180029b24
mov rax, qword [0x180048008]
cmp qword [rsp + 0x20], rax
ja 0x180029b24
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180029ae6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.ucrtbase.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180029b53
jmp 0x180029bc7
cmp dword [rsp + 0x50], 0x10000
jne 0x180029baa
cmp qword [rsp + 0x48], 0x10000
jb 0x180029baa
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180029b98
mov rax, qword [rsp + 0x28]
jmp 0x180029bc9
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180029bc2
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180029ce0
mov qword [rsp + 0x20], rax
jmp 0x180029ae6
xor eax, eax
add rsp, 0x68
ret
Function at 0x180029bd0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180029d20
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180029cd3
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180029c2b
mov rax, qword [0x180048008]
cmp qword [rsp + 0x20], rax
ja 0x180029c2b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180029bed
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.ucrtbase.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180029c5a
jmp 0x180029cd3
cmp dword [rsp + 0x50], 0x10000
jne 0x180029cb1
cmp qword [rsp + 0x48], 0x10000
jb 0x180029cb1
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180029c9f
mov rax, qword [rsp + 0x28]
jmp 0x180029cd5
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180029cce
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180029d20
mov qword [rsp + 0x20], rax
jmp 0x180029bed
xor eax, eax
add rsp, 0x68
ret
Function at 0x180029d70
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18002a300
mov qword [rsp + 0x28], 0
cmp qword [0x18004d4c8], 0
jne 0x180029db8
cmp qword [0x18004d4c0], 0
je 0x180029db8
mov rax, qword [0x18004d4c0]
mov qword [0x18004d4c8], rax
cmp qword [0x18004d4c8], 0
je 0x180029e5e
mov rax, qword [0x18004d4c8]
cmp qword [rax + 0x10], 0
je 0x180029e5e
mov rax, qword [0x18004d4c8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180029e5e
mov rax, qword [0x18004d4c8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180029e5e
mov rax, qword [0x18004d4c8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180029e24
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x180029e2b
xor eax, eax
jmp 0x180029fd9
mov rax, qword [0x18004d4c8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.ucrtbase.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x180029fd9
mov rax, qword [0x18004d4c0]
mov qword [0x18004d4c8], rax
jmp 0x180029e80
mov rax, qword [0x18004d4c8]
mov rax, qword [rax + 8]
mov qword [0x18004d4c8], rax
cmp qword [0x18004d4c8], 0
je 0x180029ecd
cmp qword [0x18004d4c8], 0
je 0x180029ecb
mov rax, qword [0x18004d4c8]
cmp qword [rax + 0x10], 0
je 0x180029ecb
mov rax, qword [0x18004d4c8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180029ecb
mov rax, qword [0x18004d4c8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180029ecb
jmp 0x180029dfc
jmp 0x180029e6e
mov rcx, qword [rsp + 0x60]
call fcn.18002c1b0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180029fe0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180029fd7
mov rax, qword [rsp + 0x48]
mov qword [0x18004d4c8], rax
mov rax, qword [0x18004d4c8]
mov dword [rax], 0x52727464
mov rax, qword [0x18004d4c8]
mov qword [rax + 0x10], 0
mov rax, qword [0x18004d4c8]
mov rcx, qword [0x18004d4c0]
mov qword [rax + 8], rcx
mov rax, qword [0x18004d4c8]
mov qword [0x18004d4c0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18004d4c8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180029f88
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180029fc2
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180029f7e
mov rax, qword [0x18004d4c8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x180029dfc
xor eax, eax
add rsp, 0x58
ret
Function at 0x140028974
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c284
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c284
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140028ac4
cmp rax, 0xffffffffffffffff
je 0x140028ac4
xor edi, edi
test rbp, rbp
jle 0x140028a6f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001eb98
mov rbx, rax
test rax, rax
jne 0x1400289fc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140028a65
mov edx, 0x8000
mov ecx, r14d
call fcn.140019be8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001cf60
cmp eax, 0xffffffff
je 0x140028a45
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140028a0c
mov edx, r15d
mov ecx, r14d
call fcn.140019be8
jmp 0x140028a65
cmp byte [rsi + 0x38], dil
je 0x140028a5c
cmp dword [rsi + 0x34], 5
jne 0x140028a5c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140028a65
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001a948
jmp 0x140028ad8
jns 0x140028ad8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c284
cmp rax, 0xffffffffffffffff
jne 0x140028a90
cmp byte [rsi + 0x30], dil
je 0x140028ad8
mov edi, dword [rsi + 0x2c]
jmp 0x140028ad8
mov ecx, r14d
call fcn.14001871c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140028ad8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140028ad8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140028ad1
mov eax, dword [rsi + 0x2c]
jmp 0x140028ad6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c284
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140029bd0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140029bf8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140029bf8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140f66aa4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f66aae
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f66ad7
pop rbp
sub rbp, 0x33
sub rbp, 0xf66aa4
sub rsp, 0x20
jmp 0x140f66af6
mov rax, 0xf66aa4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x3c600a1d
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f66b15
jmp 0x140f66b2c
push rbp
xchg esp, eax
hlt