joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180095a90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xa0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov r14, r9
mov r13, rdx
mov r12, rcx
mov ecx, dword [0x180205394]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov dword [rbp - 0x49], eax
lea edx, [rax + 1]
mov ecx, dword [0x180205394]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov dword [rbp - 0x45], eax
lea edx, [rax + 1]
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea ecx, [rsi + rdi]
mov r15, qword [rbp + 0x77]
test ecx, ecx
jne 0x180095c02
lea rcx, [r12 + 0x20]
mov qword [rbp - 0x39], rcx
mov byte [rbp - 0x31], 0
call fcn.1800944f0
mov byte [rbp - 0x31], 1
mov r8, r13
lea rdx, [rbp - 0x29]
mov rcx, r12
call fcn.180093d30
nop
cmp qword [rbp - 0x29], 0
je 0x180095b8e
lea rax, [rbp - 0x39]
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x11]
call fcn.180093840
nop
mov r8, r15
mov rdx, r14
mov rcx, qword [rbp - 0x29]
call fcn.18008d700
nop
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x180095b7f
lea rdx, [rbp - 0x11]
call fcn.180093a30
cmp byte [rbp - 9], 0
je 0x180095b8e
mov rcx, qword [rbp - 0x11]
call fcn.18007b460
cmp byte [rbp - 0x31], 0
jne 0x180095bb9
lea rcx, [rbp - 1]
call fcn.180119da0
mov dword [rbp + 0x17], 0
lea rax, vtable.boost::lock_error.0
mov qword [rbp - 1], rax
lea rcx, [rbp - 1]
call fcn.180035490
nop
mov rcx, qword [rbp - 0x39]
call fcn.180093670
mov byte [rbp - 0x31], 0
mov rbx, qword [rbp - 0x21]
test rbx, rbx
je 0x180095bf3
lock dec dword [rbx + 8]
jne 0x180095bed
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lock dec dword [rbx + 0xc]
jne 0x180095bed
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov edi, dword [rbp - 0x49]
mov esi, dword [rbp - 0x45]
cmp byte [rbp - 0x31], 0
je 0x180095c02
mov rcx, qword [rbp - 0x39]
call fcn.180093670
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, r14
mov r8, qword [rbp + 0x67]
mov rdx, r13
mov rcx, qword [r12 + 0x60]
call fcn.1800915e0
mov ebx, eax
mov edx, esi
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, edi
mov ecx, dword [0x180205394]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, ebx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180095c70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rbx, rdx
mov r13, rcx
xor esi, esi
mov qword [rbp - 0x38], rsi
mov edi, esi
mov qword [rbp - 0x30], rsi
mov ecx, dword [0x180205394]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov dword [rbp + 0x50], eax
lea edx, [rax + 1]
mov ecx, dword [0x180205394]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r15, rax
mov dword [rbp + 0x54], eax
lea edx, [rax + 1]
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea ecx, [r15 + r14]
test ecx, ecx
jne 0x180095dfa
lea rcx, [r13 + 0x20]
mov qword [rbp - 0x48], rcx
mov byte [rbp - 0x40], sil
call fcn.1800944f0
mov byte [rbp - 0x40], 1
mov rcx, qword [r13 + 0x48]
mov rax, qword [rcx + 8]
cmp byte [rax + 0x31], sil
jne 0x180095d38
nop word [rax + rax]
cmp qword [rax + 0x18], rbx
jae 0x180095d2c
mov rax, qword [rax + 0x10]
jmp 0x180095d32
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x31], 0
je 0x180095d20
mov qword [rbp + 0x58], rcx
mov rax, qword [r13 + 0x48]
cmp rcx, rax
je 0x180095d51
cmp rbx, qword [rcx + 0x18]
jb 0x180095d51
lea rbx, [rbp + 0x58]
jmp 0x180095d59
mov qword [rbp - 0x60], rax
lea rbx, [rbp - 0x60]
mov rbx, qword [rbx]
cmp qword [r13 + 0x48], rbx
je 0x180095ddc
lea rax, [rbp - 0x48]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x10]
call fcn.180093840
nop
mov rsi, qword [rbx + 0x20]
mov qword [rbp - 0x28], rsi
mov rdi, qword [rbx + 0x28]
mov qword [rbp - 0x20], rdi
test rdi, rdi
je 0x180095da1
lock inc dword [rdi + 8]
mov r15d, dword [rbp + 0x54]
mov r14d, dword [rbp + 0x50]
mov rdi, qword [rbp - 0x20]
mov rsi, qword [rbp - 0x28]
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rdi
mov r8, rbx
lea rdx, [rbp - 0x50]
lea rcx, [r13 + 0x40]
call fcn.18003b120
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180095dcc
lea rdx, [rbp - 0x10]
call fcn.180093a30
cmp byte [rbp - 8], 0
je 0x180095ddc
mov rcx, qword [rbp - 0x10]
call fcn.18007b460
nop
cmp byte [rbp - 0x40], 0
je 0x180095deb
mov rcx, qword [rbp - 0x48]
call fcn.180093670
test rsi, rsi
je 0x180095dfa
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
nop
mov edx, r15d
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, r14d
mov ecx, dword [0x180205394]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rdi, rdi
je 0x180095e41
lock dec dword [rdi + 8]
jne 0x180095e41
mov rbx, qword [rbp - 0x30]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lock dec dword [rbx + 0xc]
jne 0x180095e41
mov rcx, qword [rbp - 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180099000
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
mov qword [rcx], rdx
test rbx, rbx
je 0x180093811
mov rcx, rbx
call fcn.1800926c0
mov rcx, rbx
call fcn.1801196dc
add rsp, 0x20
pop rbx
ret
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rbp, rcx
mov ecx, dword [0x180205394]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov dword [rsp + 0x60], eax
lea edx, [rax + 1]
mov ecx, dword [0x180205394]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov dword [rsp + 0x64], eax
lea edx, [rax + 1]
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rbx, [rbp + 0x20]
mov qword [rsp + 0x28], rbx
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.180082c20
mov byte [rsp + 0x30], 1
lea rcx, [rbp + 0x40]
call fcn.180095e60
nop
mov rcx, rbx
call fcn.18007b460
nop
mov edx, edi
mov ecx, dword [0x180209190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, esi
mov ecx, dword [0x180205394]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rcx, [rbp + 0x60]
xor edx, edx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
jmp 0x1800937f0
Function at 0x18009c910
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18009c952
xor al, al
jmp 0x18009c9ca
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x50]
add rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x4550
je 0x18009c979
xor al, al
jmp 0x18009c9ca
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax + 0xe8]
mov rax, qword [rsp + 0x50]
add rax, rcx
cmp qword [rsp + 0x78], rax
jb 0x18009c9c2
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rdx, qword [rsp + 0x50]
add rdx, rax
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax + 0xec]
mov rax, rdx
add rax, rcx
cmp qword [rsp + 0x78], rax
jae 0x18009c9c2
mov al, 1
jmp 0x18009c9ca
xor al, al
jmp 0x18009c9ca
add rsp, 0x68
ret

Function at 0x18009ca80
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1802053a0]
mov qword [rsp + 0x20], rax
jmp 0x18009caa0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18009cac5
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x18009ca92
add rsp, 0x38
ret

Function at 0x18009cad0
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1802053b4], eax
je 0x18009caec
mov eax, 0x10dd
jmp 0x18009cc07
mov rax, qword [0x1802053d0]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18009cb90
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
movzx edx, byte [rax + 0x1f]
lea r9, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
mov r8d, dword [rax + 0x28]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x20]
cmp dword [rax + 8], 0
jne 0x18009cb60
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x20], 0
je 0x18009cb60
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x20]
call fcn.18009cc70
mov r11, qword [rsp + 0x20]
mov qword [r11 + 0x20], 0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.1801196dc
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
jmp 0x18009caf8
mov qword [0x1802053d0], 0
call fcn.18009cc20
mov rax, qword [0x1802053c8]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18009cbf0
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.1801196dc
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x18009cbac
mov qword [0x1802053c8], 0
mov dword [0x1802053b4], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x18009d200
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x1802053b8], 0
je 0x18009d21d
mov eax, dword [0x1802053b8]
jmp 0x18009d2e1
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp qword [rsp + 0x50], rax
jne 0x18009d231
xor eax, eax
jmp 0x18009d2e1
mov ecx, 0x10
call fcn.1801196e4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18009d29a
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x18009d27f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.1801196dc
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x1802053b8], eax
mov qword [0x1802053c0], 0
mov eax, dword [rsp + 0x20]
jmp 0x18009d2e1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x18009d2b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x18009d25a
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x50]
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 0x28]
mov rax, qword [0x1802053c8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x28]
mov qword [0x1802053c8], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x18009dcc0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18009dce8
xor eax, eax
jmp 0x18009dd48
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18009dd05
xor eax, eax
jmp 0x18009dd48
mov rax, qword [rsp + 0x20]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x20]
add rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x4550
je 0x18009dd2c
xor eax, eax
jmp 0x18009dd48
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x18009dd3d
xor eax, eax
jmp 0x18009dd48
mov rax, qword [rsp + 0x20]
jmp 0x18009dd48
add rsp, 0x68
ret
Function at 0x18009dd60
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1802053b4], eax
je 0x18009dd8e
mov eax, 0x10dd
jmp 0x18009df89
cmp dword [0x1802053b8], 0
je 0x18009dda2
mov eax, dword [0x1802053b8]
jmp 0x18009df89
cmp qword [rsp + 0x70], 0
jne 0x18009ddb4
mov eax, 6
jmp 0x18009df89
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x18009dde6
mov dword [rsp + 0x30], 6
mov eax, dword [rsp + 0x30]
mov dword [0x1802053b8], eax
mov rax, qword [rsp + 0x70]
mov qword [0x1802053c0], rax
mov eax, dword [rsp + 0x30]
jmp 0x18009df89
mov ecx, 0x30
call fcn.1801196e4
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x18009de53
mov dword [rsp + 0x30], 8
mov eax, dword [rsp + 0x30]
mov dword [0x1802053b8], eax
cmp qword [rsp + 0x48], 0
je 0x18009de3e
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.1801196dc
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x70]
mov qword [0x1802053c0], rax
mov eax, dword [rsp + 0x30]
jmp 0x18009df89
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, qword [rsp + 0x78]
call fcn.18009c8e0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rax + 0x1f]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x20]
sub rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 0x1f]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x18009deaa
movsxd rax, dword [rsp + 0x20]
cmp rax, 0x1f
jbe 0x18009dec7
mov dword [rsp + 0x30], 9
cmp dword [0x1802053b0], 0
je 0x18009dec2
jmp 0x18009de19
jmp 0x18009de0f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x78]
cmp qword [rcx + 0x28], rax
je 0x18009def4
mov dword [rsp + 0x30], 9
cmp dword [0x1802053b0], 0
je 0x18009deef
jmp 0x18009de19
jmp 0x18009de0f
mov dword [rsp + 0x40], 0
movsxd rdx, dword [rsp + 0x20]
lea r9, [rsp + 0x40]
mov r8d, 0x40
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18009df2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
jmp 0x18009de0f
mov rax, qword [rsp + 0x48]
mov dword [rax + 8], 1
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x70]
mov qword [rcx + 0x10], rax
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov qword [rcx + 0x20], rax
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x28]
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x40]
mov dword [rcx + 0x28], eax
mov rcx, qword [rsp + 0x48]
mov rax, qword [0x1802053d0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1802053d0], rax
xor eax, eax
add rsp, 0x68
ret
Function at 0x18009e2c0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
cmp dword [0x180205430], 0
je 0x18009e2d4
xor eax, eax
jmp 0x18009e53a
cmp qword [0x180205428], 0
je 0x18009e2ea
mov rax, qword [0x180205428]
jmp 0x18009e53a
mov r8d, 0x48
xor edx, edx
lea rcx, [0x1802053e0]
call fcn.18011a1e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x1802053e0], rax
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1802053e8], rax
cmp qword [0x1802053e8], 0
jne 0x18009e39e
mov dword [0x180205430], 1
cmp qword [0x1802053e8], 0
je 0x18009e34a
mov rcx, qword [0x1802053e8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1802053f0], 0
mov qword [0x1802053f8], 0
mov qword [0x180205400], 0
mov qword [0x180205408], 0
mov qword [0x180205410], 0
mov qword [0x180205418], 0
mov qword [0x180205420], 0
xor eax, eax
jmp 0x18009e53a
lea rdx, str.ImagehlpApiVersionEx
mov rcx, qword [0x1802053e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802053f0], rax
lea rdx, str.SymInitialize
mov rcx, qword [0x1802053e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802053f8], rax
lea rdx, str.SymSetOptions
mov rcx, qword [0x1802053e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180205400], rax
lea rdx, str.SymGetOptions
mov rcx, qword [0x1802053e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180205408], rax
lea rdx, str.SymLoadModule64
mov rcx, qword [0x1802053e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180205410], rax
lea rdx, str.SymGetModuleInfo64
mov rcx, qword [0x1802053e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180205418], rax
lea rdx, str.SymFromName
mov rcx, qword [0x1802053e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180205420], rax
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.18011a1e0
mov r11d, 0xb
mov word [rsp + 0x20], r11w
cmp qword [0x1802053f0], 0
je 0x18009e4ab
cmp qword [0x1802053f8], 0
je 0x18009e4ab
cmp qword [0x180205410], 0
je 0x18009e4ab
cmp qword [0x180205418], 0
je 0x18009e4ab
cmp qword [0x180205420], 0
jne 0x18009e4b0
jmp 0x18009e329
lea rcx, [rsp + 0x20]
call qword [0x1802053f0]
movzx eax, word [rsp + 0x20]
cmp eax, 0xb
jge 0x18009e4ca
jmp 0x18009e329
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1802053e0]
call qword [0x1802053f8]
test eax, eax
jne 0x18009e4e5
jmp 0x18009e329
cmp qword [0x180205408], 0
je 0x18009e525
cmp qword [0x180205400], 0
je 0x18009e525
call qword [0x180205408]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
and eax, 0xfffffff8
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
or eax, 0x2704
mov dword [rsp + 0x28], eax
mov ecx, dword [rsp + 0x28]
call qword [0x180205400]
lea rax, [0x1802053e0]
mov qword [0x180205428], rax
mov rax, qword [0x180205428]
add rsp, 0x38
ret
Function at 0x18009e9a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x80], 0
jne 0x18009e9bf
mov qword [rsp + 0x20], 0x10000
jmp 0x18009e9d2
mov rax, qword [rsp + 0x80]
add rax, 0x10000
mov qword [rsp + 0x20], rax
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18011a1e0
jmp 0x18009e9f8
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
add rax, rcx
mov qword [rsp + 0x20], rax
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
ja 0x18009ea15
jmp 0x18009ea7e
cmp dword [rsp + 0x48], 0x1000
jne 0x18009ea2c
mov eax, dword [rsp + 0x4c]
and eax, 0x100
test eax, eax
je 0x18009ea2e
jmp 0x18009e9e6
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x18009e9e6
mov rax, qword [rsp + 0x58]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x58]
add rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp dword [rax], 0x4550
jne 0x18009e9e6
mov rax, qword [rsp + 0x58]
jmp 0x18009ea80
xor eax, eax
add rsp, 0x78
ret
Function at 0x18009ef60
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x60], 0
jne 0x18009ef88
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18009efa9
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18009f11c
mov rax, qword [rsp + 0x20]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x20]
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x18009efde
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18009f11c
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x18009effd
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18009f11c
mov rax, qword [rsp + 0x30]
movzx ecx, word [rax + 0x14]
mov rax, qword [rsp + 0x30]
lea rax, [rax + rcx + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x38], 0
jmp 0x18009f02a
mov eax, dword [rsp + 0x38]
add eax, 1
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x38], eax
jae 0x18009f0fe
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
add rcx, rax
lea rdx, str..detour
call fcn.18011d3e0
test eax, eax
jne 0x18009f0f9
mov ecx, dword [rsp + 0x38]
imul rcx, rcx, 0x28
mov rax, qword [rsp + 0x28]
cmp dword [rax + rcx + 0xc], 0
je 0x18009f089
mov ecx, dword [rsp + 0x38]
imul rcx, rcx, 0x28
mov rax, qword [rsp + 0x28]
cmp dword [rax + rcx + 0x10], 0
jne 0x18009f08b
jmp 0x18009f0fe
mov ecx, dword [rsp + 0x38]
imul rcx, rcx, 0x28
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + rcx + 0xc]
mov rax, qword [rsp + 0x20]
add rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
cmp rax, 0x40
jb 0x18009f0ce
mov rax, qword [rsp + 0x40]
cmp dword [rax + 4], 0x727444
je 0x18009f0d0
jmp 0x18009f0fe
mov rax, qword [rsp + 0x40]
cmp dword [rax + 8], 0
jne 0x18009f0ea
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov dword [rcx + 8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x40]
jmp 0x18009f11c
jmp 0x18009f01f
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18009f11c
add rsp, 0x58
ret
Function at 0x18009f380
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
cmp rax, 0x170
jne 0x18009f3b3
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x58]
cmp dword [rcx], eax
jbe 0x18009f3c5
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18009f538
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x2c]
mov r8d, 0x40
mov edx, 0x40
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18009f3fa
jmp 0x18009f534
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x108
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18009f427
jmp 0x18009f516
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x18], 0
je 0x18009f460
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, 4
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18009f460
jmp 0x18009f4f8
mov rdx, qword [rsp + 0x30]
add rdx, 0x24
mov r8d, 0x40
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 8]
call fcn.180119850
mov rdx, qword [rsp + 0x30]
add rdx, 0x64
mov r8d, 0x108
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
call fcn.180119850
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x18], 0
je 0x18009f4c6
mov rdx, qword [rsp + 0x30]
add rdx, 0x16c
mov r8d, 4
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x18]
call fcn.180119850
mov dword [rsp + 0x24], 1
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x18], 0
je 0x18009f4f8
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x2c]
mov edx, 4
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x20]
mov edx, 0x108
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x2c]
mov edx, 0x40
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rsp + 0x24]
add rsp, 0x48
ret