joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180080020
Capabilities:
Create thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rbp + 8], rax
mov rbx, r9
mov r13, r8
mov r15, rdx
mov rdi, rcx
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], r8
mov qword [rbp], rbx
mov r14d, dword [rbp + 0x80]
xor r12d, r12d
mov dword [rsp + 0x38], r12d
cmp qword [rcx + 0x20128], r12
jne 0x1800800a3
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
mov r9, rcx
lea r8, [0x180082b70]
xor edx, edx
xor ecx, ecx
call fcn.1800c902c
mov qword [rdi + 0x20128], rax
mov ecx, 0x28
call fcn.1800969c8
mov rsi, rax
mov qword [rbp - 0x48], rax
test rax, rax
je 0x1800800d9
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.1800370a0
mov r9d, r14d
mov r8, rax
mov rdx, rsi
mov rcx, rdi
call fcn.180080480
mov r12, rax
mov ecx, 0x18
call fcn.1800969c8
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800800fa
mov rcx, rax
call fcn.180081c20
mov r14, rax
jmp 0x1800800fd
xor r14d, r14d
mov rdx, r15
mov rcx, r14
call fcn.180088870
mov dword [rsp + 0x38], 1
lea rsi, [r13 + 8]
lea rax, [0x18007fc90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
xor r14d, r14d
mov qword [rbp - 0x70], r14
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x180080152
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
call qword [rax]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdi
mov dword [rsp + 0x38], 3
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rbp - 8], r14
lea rcx, [rsp + 0x40]
call fcn.1800807e0
mov qword [rbp - 8], rax
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x180080198
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp - 0x70], r14
lea rcx, [rdi + 0x200e0]
lea rdx, [rbp - 0x40]
call fcn.180088b50
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1800801c3
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x1800801dc
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
call qword [rax + 0x20]
mov qword [rsi + 0x38], r14
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x180080212
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18008020d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180080244
mov rcx, r8
call fcn.1800965cc
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, r15
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.180096b80
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800c9338
int3
Function at 0x180082400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov rbx, rdx
mov qword [rsp + 0x20], rdx
xor edi, edi
mov dword [rsp + 0x28], 0x4f0053
xor edx, edx
mov word [rsp + 0x4c], di
mov r8d, 0x208
mov dword [rsp + 0x2c], 0x540046
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x30], 0x410057
mov dword [rsp + 0x34], 0x450052
mov dword [rsp + 0x38], 0x43005c
mov dword [rsp + 0x3c], 0x6d006f
mov dword [rsp + 0x40], 0x61004d
mov dword [rsp + 0x44], 0x740073
mov dword [rsp + 0x48], 0x720065
call fcn.1800c61d0
lea r9, [rsp + 0x50]
mov rcx, 0xffffffff80000002
lea r8, str.c_identity
lea rdx, [rsp + 0x28]
call fcn.18009c7d0
mov qword [rbx + 0x10], rdi
lea rax, [rsp + 0x50]
mov qword [rbx + 0x18], 7
mov r8, 0xffffffffffffffff
mov word [rbx], di
nop dword [rax]
inc r8
cmp word [rax + r8*2], di
jne 0x1800824d0
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.18001b400
mov rax, rbx
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.180096b80
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180095cf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov qword [r11 - 0x58], rdx
mov qword [r11 - 0x50], r9
mov rbp, qword [rsp + 0xc0]
xor r15d, r15d
mov dword [r11 - 0x68], r15d
mov qword [r11 - 0x40], r15
xor eax, eax
mov qword [rdx], rax
call fcn.18000a5b0
mov rcx, rax
test rax, rax
je 0x180095ec0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rdi, [r15 - 1]
test eax, eax
jne 0x180095e81
mov qword [rsp + 0x60], r15
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180095e70
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x180095e81
add eax, 0x10
mov dword [rsp + 0x50], eax
mov ecx, eax
lea rdx, [0x1801652d0]
call fcn.180097344
mov rbx, rax
test rax, rax
je 0x180095e81
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov rcx, rax
call fcn.1800c61d0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x180095e32
mov rcx, rbx
call fcn.1800965cc
jmp 0x180095e81
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x180095e35
test rax, rax
je 0x180095e68
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x180095e50
mov r8d, eax
mov rdx, rbx
mov rcx, rsi
call fcn.18000b4d0
mov rcx, rbx
call fcn.1800965cc
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180095e81
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x180095e9c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180096b80
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.180009b50
int3
Function at 0x180095ed0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [rsp + 0x90]
mov rbx, 0xffffffffffffffff
mov rax, rbx
mov qword [rsp + 0x30], r8
mov r15, r9
mov r14, r8
mov r10, rdx
nop
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x180095f10
mov rdx, qword [r14]
lea ebp, [rax*2 + 2]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
test eax, eax
sete sil
test eax, eax
jne 0x180095f8d
mov rcx, qword [rsp + 0x30]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], ebp
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
xor esi, esi
test eax, eax
sete sil
test rcx, rcx
je 0x180095f8d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x180095fa8
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180096b80
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x180098be0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10d, edx
mov r9, rcx
test rcx, rcx
je 0x180098d1b
test edx, edx
je 0x180098d1b
mov qword [rsp], rbx
lea rbx, [0x1801133d0]
mov eax, 0xffffffff
cmp r10d, 8
jb 0x180098ce8
mov r11d, r10d
shr r11, 3
nop dword [rax]
movzx edx, byte [r9]
mov ecx, eax
xor rdx, rcx
shr eax, 8
movzx ecx, dl
add r10d, 0xfffffff8
mov edx, dword [rbx + rcx*4]
movzx ecx, byte [r9 + 1]
xor edx, eax
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov eax, dword [rbx + rax*4]
xor eax, edx
sub r11, 1
jne 0x180098c20
test r10d, r10d
je 0x180098d10
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov ecx, eax
xor rdx, rcx
shr ecx, 8
movzx r8d, dl
mov eax, dword [rbx + r8*4]
xor eax, ecx
add r10d, 0xffffffff
jne 0x180098cf0
mov rbx, qword [rsp]
not eax
add rsp, 8
ret
xor eax, eax
add rsp, 8
ret
Function at 0x180099230
Capabilities:
Check if file exists

Disassembly:
push rsi
push r14
sub rsp, 0x268
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r14, rdx
mov rsi, rcx
test rcx, rcx
je 0x180099428
cmp dword [rcx], 2
jne 0x180099428
cmp qword [rdx + 0x18], 8
mov qword [rsp + 0x290], rbx
jb 0x180099277
mov r14, qword [rdx]
cmp dword [rcx + 0x20], 0
je 0x18009928e
xor ebx, ebx
mov eax, ebx
mov rbx, qword [rsp + 0x290]
jmp 0x18009942a
test r14, r14
je 0x18009927d
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800992af
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
jne 0x18009927d
mov rcx, qword [rsi + 0x38]
xor ebx, ebx
mov qword [rsp + 0x260], rbp
movabs rax, 0xa3d70a3d70a3d70b
mov qword [rsp + 0x258], rdi
mov ebp, 1
mov rdi, qword [rsi + 0x30]
sub rcx, rdi
mov qword [rsp + 0x250], r12
imul rcx
mov r12d, ebx
add rdx, rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x180099402
mov qword [rsp + 0x248], r13
lea r13d, [rbp + 0x5b]
mov qword [rsp + 0x240], r15
mov r15d, ebx
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1800c61d0
lea r8, [rdi + 8]
mov rdx, r14
add r8, r15
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rax, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], bx
jne 0x180099353
mov rax, rbx
test rcx, rcx
je 0x18009937a
cmp word [rsp + rax*2 + 0x20], 0x2f
jne 0x180099372
mov word [rsp + rax*2 + 0x20], r13w
inc rax
cmp rax, rcx
jb 0x180099364
mov rax, qword [rsi + 0x30]
mov rcx, qword [rax + r15]
test byte [rcx + 0x26], 0x10
je 0x180099397
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
jmp 0x1800993b6
test ebp, ebp
je 0x1800993b4
lea r8, [rsp + 0x20]
mov rdx, r12
mov rcx, rsi
call fcn.180099450
mov ebp, 1
test eax, eax
jne 0x1800993b6
mov ebp, ebx
mov rdi, qword [rsi + 0x30]
movabs rax, 0xa3d70a3d70a3d70b
mov rcx, qword [rsi + 0x38]
inc r12
sub rcx, rdi
add r15, 0x320
imul rcx
add rdx, rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r12, rdx
jb 0x180099320
mov r15, qword [rsp + 0x240]
mov r13, qword [rsp + 0x248]
mov r12, qword [rsp + 0x250]
mov ebx, ebp
mov rdi, qword [rsp + 0x258]
mov eax, ebx
mov rbx, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x260]
jmp 0x18009942a
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180096b80
add rsp, 0x268
pop r14
pop rsi
ret
Function at 0x1800998d0
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rdi, rcx
mov ecx, 0xa0
call fcn.1800969c8
mov rbx, rax
mov qword [rsp + 0x60], rax
xor esi, esi
test rax, rax
je 0x180099922
xor edx, edx
mov r8d, SHCreateDirectory
mov rcx, rax
call fcn.1800c61d0
mov rcx, rbx
call fcn.180098930
mov rbx, rax
jmp 0x180099925
mov rbx, rsi
cmp qword [rdi + 0x18], 8
jb 0x18009992f
mov rdi, qword [rdi]
test rdi, rdi
je 0x180099a02
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180099a02
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x180099a02
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbx + 0x24], eax
cmp eax, 0x16
jb 0x180099a02
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 0x10], rax
cmp qword [rbx + 8], 0
je 0x180099a02
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x180099a02
mov r8d, dword [rbx + 0x24]
mov rdx, rax
mov rcx, rbx
call fcn.180098d30
test eax, eax
je 0x180099a02
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
test rbx, rbx
je 0x180099a1c
mov rcx, rbx
call fcn.180098a20
mov edx, 0xa0
mov rcx, rbx
call fcn.1800965cc
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x18009c7d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x34]
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180096b80
add rsp, 0x48
ret

Function at 0x18009c8f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x50], rax
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x18009c9e2
nop dword [rax]
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x18009c949
mov ebx, 0x4fff0000
jmp 0x18009c9d9
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea r8d, [rax + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18009c9e2
cmp dword [rsp + 0x40], 0x10000
jne 0x18009c9bd
cmp qword [rsp + 0x38], 0x10000
jb 0x18009c9bd
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x18009c9e4
sub rbx, 0x10000
jmp 0x18009c9d9
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x18009c930
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180096b80
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x18009ca00
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x18009ca31
sub rbx, rax
add rbx, 0x10000
mov qword [rsp + 0x78], rsi
cmp rbx, rdi
jae 0x18009cb02
mov esi, 0x80010000
nop dword [rax]
nop dword [rax + rax]
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x18009ca67
mov rbx, rsi
jmp 0x18009caf9
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea r8d, [rax + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18009cb02
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x18009cade
cmp rcx, 0x10000
jb 0x18009cade
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x18009cb04
add rbx, 0x10000
jmp 0x18009caf9
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x18009caf9
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x18009ca50
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180096b80
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x18009cb30
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx - 0x7ff80000]
mov rbx, rcx
cmp rcx, 0x7ff80000
ja 0x18009cb52
mov edi, 0x10000
mov qword [rsp + 0x38], rsi
lea rsi, [rcx + 0x7ff80000]
cmp rbx, 0xffffffff80000000
jb 0x18009cb6e
mov rsi, 0xfffffffffff80000
mov rax, qword [0x180165fb0]
mov rcx, qword [0x180165fa8]
mov qword [rsp + 0x30], rbp
test rax, rax
jne 0x18009cb95
test rcx, rcx
je 0x18009cbac
mov rax, rcx
mov qword [0x180165fb0], rcx
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x18009cbac
cmp rdx, rdi
jb 0x18009cbac
cmp rdx, rsi
jbe 0x18009ccd9
mov qword [0x180165fb0], rcx
mov rax, rcx
test rcx, rcx
je 0x18009cbe7
test rcx, rcx
je 0x18009cbd7
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x18009cbd7
cmp rcx, rdi
jb 0x18009cbd7
cmp rcx, rsi
jbe 0x18009ccd9
mov rax, qword [rax + 8]
mov qword [0x180165fb0], rax
test rax, rax
jne 0x18009cbc0
movzx eax, bx
sub rbx, rax
cmp rbx, 0x40000000
jbe 0x18009cc0a
lea rdx, [rbx - 0x40000000]
mov rcx, rdi
call fcn.18009c8f0
test rax, rax
jne 0x18009cc87
movabs rbp, 0xffffffff40000000
cmp rbx, rbp
jae 0x18009cc2d
lea rcx, [rbx + 0x40000000]
mov rdx, rsi
call fcn.18009ca00
test rax, rax
jne 0x18009cc87
cmp rbx, 0x40000000
jbe 0x18009cc4a
lea rcx, [rbx - 0x40000000]
mov rdx, rbx
call fcn.18009ca00
test rax, rax
jne 0x18009cc87
cmp rbx, rbp
jae 0x18009cc63
lea rdx, [rbx + 0x40000000]
mov rcx, rbx
call fcn.18009c8f0
test rax, rax
jne 0x18009cc87
mov rdx, rbx
mov rcx, rdi
call fcn.18009c8f0
test rax, rax
jne 0x18009cc87
mov rdx, rsi
mov rcx, rbx
call fcn.18009ca00
test rax, rax
je 0x18009cd05
mov dword [rax], 0x52727464
lea rdx, [rax + 0xffa8]
xor r8d, r8d
mov qword [0x180165fb0], rax
mov qword [rax + 0x10], r8
mov r9d, 0x2a7
mov rcx, qword [0x180165fa8]
mov qword [rax + 8], rcx
lea rcx, [rax + 0xff60]
mov qword [0x180165fa8], rax
mov qword [rdx], r8
lea rdx, [rdx - 0x60]
mov r8, rcx
sub rcx, 0x60
sub r9, 1
jne 0x18009ccc1
mov qword [rax + 0x10], r8
mov rbx, qword [rax + 0x10]
cmp rbx, rdi
jb 0x18009cd05
cmp rbx, rsi
ja 0x18009cd05
mov rcx, qword [rbx + 0x48]
mov edx, 0xcc
mov qword [rax + 0x10], rcx
mov rcx, rbx
lea r8d, [rdx - 0x6c]
call fcn.1800c61d0
mov rax, rbx
jmp 0x18009cd07
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18009cd20
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x18009cd5d
xor al, al
jmp 0x18009cd9b
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x18009cd6e
xor al, al
jmp 0x18009cd9b
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x18009cd95
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x18009cd95
mov al, 1
jmp 0x18009cd9b
xor al, al
jmp 0x18009cd9b
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180096b80
add rsp, 0x60
pop rbx
ret
Function at 0x18009d270
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1801548a8]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp dword [0x180165fc0], 0
jne 0x18009d30b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x180165fc0], ecx
jne 0x18009d30b
xor eax, eax
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180165fa8]
mov qword [0x180165fd8], rax
mov qword [0x180165fd0], rax
mov dword [0x180165fc4], eax
mov qword [0x180165fc8], rax
test rbx, rbx
je 0x18009d2f2
nop
lea r9, [rsp + 0x20]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x18009d2d0
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180096b80
add rsp, 0x38
ret
mov eax, 0x10dd
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180096b80
add rsp, 0x38
ret
Function at 0x18009d8b0
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x180165fc4]
mov rdi, rcx
test eax, eax
jne 0x18009d953
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
jne 0x18009d8da
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rbx
call fcn.1800969c8
mov rbx, rax
test rax, rax
jne 0x18009d8f6
lea edi, [rax + 8]
jmp 0x18009d919
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x18009d937
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov edx, 0x10
mov rcx, rbx
call fcn.1800965cc
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x180165fc4], edi
mov qword [0x180165fc8], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x180165fd0]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x180165fd0], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret