joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009ed60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r10d, r10d
mov rbp, r8
mov rsi, rdx
mov r12, rcx
mov rbx, rdx
test rdx, rdx
je 0x18009eda1
cmp byte [rdx], r10b
je 0x18009ed99
inc rbx
cmp byte [rbx], r10b
jne 0x18009ed91
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 8]
xor edi, edi
test r13d, r13d
jle 0x18009eedd
mov qword [rsp + 0x40], r14
lea r14, [0x180129d60]
nop dword [rax]
cmp edi, 2
jge 0x18009edce
mov r9d, edi
xor r9d, 1
jmp 0x18009edd1
mov r9d, edi
test rbp, rbp
je 0x18009ee34
mov rax, qword [r12 + 0x10]
movsxd rcx, r9d
mov rdx, rbp
shl rcx, 5
mov r8, qword [rcx + rax]
movzx ecx, byte [rbp]
test cl, cl
je 0x18009ee1f
nop word [rax + rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x18009ee1f
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x18009ee00
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x18009eeb1
mov rax, qword [r12 + 0x10]
movsxd rcx, r9d
shl rcx, 5
mov r10, qword [rcx + rax + 0x18]
cmp qword [r10 + 0x18], 0
je 0x18009ee8a
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x18009ee7f
nop dword [rax + rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x18009ee60
xor edx, edx
mov eax, r8d
div dword [r10 + 8]
jmp 0x18009ee8c
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 8]
mov r8d, ebx
mov rdx, rsi
call fcn.180067ba0
test rax, rax
je 0x18009eeae
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x18009eebc
jmp 0x18009eeb1
xor r10d, r10d
inc edi
cmp edi, r13d
jl 0x18009edc0
mov r14, qword [rsp + 0x40]
mov rax, r10
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, r10
jmp 0x18009eec4
Function at 0x18009efc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
xor r9d, r9d
mov rbp, r8
mov rsi, rdx
mov rbx, rdx
test rdx, rdx
je 0x18009eff8
cmp byte [rdx], r9b
je 0x18009eff0
inc rbx
cmp byte [rbx], r9b
jne 0x18009efe8
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 8]
xor edi, edi
test r13d, r13d
jle 0x18009f11c
mov qword [rsp + 0x40], r12
mov r12, qword [rcx + 0x10]
mov qword [rsp + 0x48], r14
lea r14, [0x180129d60]
nop dword [rax]
cmp edi, 2
jge 0x18009f02c
mov eax, edi
xor eax, 1
jmp 0x18009f02e
mov eax, edi
movsxd r8, eax
shl r8, 5
mov r10, qword [r8 + r12 + 0x18]
test rbp, rbp
je 0x18009f084
movzx ecx, byte [rbp]
mov r8, qword [r8 + r12]
mov rdx, rbp
test cl, cl
je 0x18009f06f
nop
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x18009f06f
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x18009f050
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x18009f0f1
cmp qword [r10 + 0x30], 0
je 0x18009f0ca
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x18009f0bf
nop word [rax + rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x18009f0a0
xor edx, edx
mov eax, r8d
div dword [r10 + 0x20]
jmp 0x18009f0cc
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 0x20]
mov r8d, ebx
mov rdx, rsi
call fcn.180067ba0
test rax, rax
je 0x18009f0ee
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x18009f0fc
jmp 0x18009f0f1
xor r9d, r9d
inc edi
cmp edi, r13d
jl 0x18009f020
mov r12, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rax, r9
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov rax, r9
jmp 0x18009f109
Function at 0x1800ab9b0
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx]
mov rax, rdx
test rdx, rdx
je 0x1800ab9cf
cmp byte [rdx], 0
je 0x1800ab9c8
inc rax
cmp byte [rax], 0
jne 0x1800ab9c0
sub eax, edx
and eax, 0x3fffffff
mov rcx, qword [rcx + 0x78]
mov r8d, eax
add rcx, 0x50
jmp fcn.180067c70
Function at 0x1800c44b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov r13, qword [rcx + 0x18]
mov r15, qword [rcx]
mov eax, r8d
mov r12, rdx
mov r14, rcx
test rdx, rdx
je 0x1800c46e8
mov qword [r11 - 0x28], rdi
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
xor edi, edi
nop
cmp eax, 0x63
jne 0x1800c44fd
movzx edx, byte [r12 + 1]
jmp 0x1800c4500
movzx edx, al
mov byte [r14 + 0x1e1], dl
movzx ecx, byte [r12]
sub ecx, 0x69
je 0x1800c460c
sub ecx, 1
je 0x1800c45db
cmp ecx, 1
je 0x1800c4583
mov rdx, qword [r12 + 0x10]
xor r8d, r8d
mov rcx, r15
call fcn.180095f60
mov byte [rsp + 0x30], 4
mov dword [rsp + 0x34], edi
mov byte [rsp + 0x31], 0
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x3c], edi
mov rbx, rax
test rax, rax
je 0x1800c466c
mov r9, qword [r14]
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, r14
call fcn.1800c0870
mov rdx, rbx
mov rcx, r15
call fcn.1800b7580
mov rdx, rbx
mov rcx, r15
call fcn.180064250
jmp 0x1800c466c
mov rdx, qword [r12 + 0x28]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call fcn.180095760
mov rdx, qword [r12 + 0x30]
movzx edi, byte [r14 + 0x1e1]
xor r8d, r8d
mov rcx, r15
mov rsi, rax
call fcn.180095a80
mov rdx, r12
mov rcx, r14
mov rbx, rax
call fcn.1800c4380
mov r9, rsi
mov r8, rbx
mov rcx, r14
mov rdx, rax
mov dword [rsp + 0x20], edi
call fcn.1800c4e30
xor edi, edi
jmp 0x1800c466c
mov rdx, qword [r12 + 0x28]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call fcn.180095760
mov rdx, r12
mov rcx, r14
mov rbx, rax
call fcn.1800c4380
mov r8, rbx
mov rdx, rax
mov rcx, r14
call fcn.1800a5a90
jmp 0x1800c466c
movzx ebp, dl
mov rdx, qword [r12 + 0x38]
mov rcx, r15
call fcn.180095e70
mov rdx, qword [r12 + 0x10]
xor r8d, r8d
mov rcx, r15
mov rsi, rax
call fcn.180095f60
mov rdx, qword [r12 + 0x30]
xor r8d, r8d
mov rcx, r15
mov rdi, rax
call fcn.180095a80
mov rdx, r12
mov rcx, r14
mov rbx, rax
call fcn.1800c4380
mov r9, rdi
mov r8, rbx
mov rcx, r14
mov rdx, rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rsi
call fcn.1800ae4d0
xor edi, edi
cmp byte [r12], 0x74
je 0x1800c46bc
movsxd rbx, dword [r13 + 0x18]
cmp dword [r13 + 0x1c], ebx
jg 0x1800c4689
mov rcx, r13
call fcn.1800844d0
test eax, eax
jne 0x1800c46bc
mov rax, qword [r13 + 0x20]
inc dword [r13 + 0x18]
lea rcx, [rbx + rbx*2]
mov byte [rax + rcx*8], 0x3a
mov byte [rax + rcx*8 + 3], 0
mov dword [rax + rcx*8 + 4], edi
mov dword [rax + rcx*8 + 8], edi
mov dword [rax + rcx*8 + 0xc], edi
mov qword [rax + rcx*8 + 0x10], rdi
mov byte [rax + rcx*8 + 1], 0
mov byte [r13 + 0xa2], 0
mov r12, qword [r12 + 0x40]
mov eax, dword [rsp + 0x80]
test r12, r12
jne 0x1800c44f0
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1800cab70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx]
xor r15d, r15d
mov rbp, r8
mov r8, rcx
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x20], r15d
mov r14d, dword [rcx]
mov r13, qword [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov edi, r15d
mov esi, r15d
mov r12, r15
test r14d, r14d
jle 0x1800cad39
nop word [rax + rax]
cmp esi, dword [rbp + 8]
jg 0x1800cad2c
mov rbx, qword [r13]
cmp byte [rbx], 0x98
jne 0x1800cad2c
cmp dword [rbx + 0x30], r9d
jne 0x1800cad2c
mov rdx, rbx
mov rcx, r8
call fcn.180094890
mov rdx, rax
test rax, rax
jne 0x1800cac0c
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x38]
cmp qword [rbp], r15
je 0x1800cac43
cmp esi, dword [rbp + 8]
jge 0x1800cac43
mov rax, qword [rbp + 0x10]
mov r9d, dword [rax + r12*4]
mov rax, qword [rbp + 0x20]
cmp r9d, dword [rax + 8]
mov eax, 0xffffffff
cmove r9d, eax
mov rax, qword [rbp + 0x48]
movzx r10d, byte [rax + r12]
mov rax, qword [rbp + 0x50]
mov r8, qword [rax + r12*8]
jmp 0x1800cac4d
mov r8, qword [rdx]
or r9d, 0xffffffff
mov r10d, r15d
movsx eax, word [rbx + 0x34]
cmp eax, r9d
jne 0x1800cacf6
mov rdx, qword [rdx]
lea rbx, [0x180129d60]
movzx ecx, byte [rdx]
test cl, cl
je 0x1800cac8d
nop dword [rax + rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + rbx]
cmp byte [rcx + rbx], al
jne 0x1800cac8d
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x1800cac70
movzx eax, byte [r8]
movzx ecx, byte [rax + rbx]
movzx eax, byte [rdx]
movzx eax, byte [rax + rbx]
cmp eax, ecx
jne 0x1800cacf6
movzx eax, byte [r13 + 0x18]
movsxd rcx, dword [rsp + 0x98]
xor eax, r10d
cmp r12, rcx
jle 0x1800cacc1
cmp eax, dword [rsp + 0x20]
jne 0x1800cad70
jmp 0x1800cacc5
mov dword [rsp + 0x20], eax
inc edi
add r13, 0x20
test r9d, r9d
jns 0x1800cad03
mov r9d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
mov r8d, edi
call fcn.1800caac0
test eax, eax
jne 0x1800cad03
mov edi, r14d
jmp 0x1800cad03
movsxd rax, dword [rsp + 0x98]
cmp r12, rax
jge 0x1800cad1f
mov r9d, dword [rsp + 0x88]
inc esi
inc r12
cmp edi, r14d
jge 0x1800cad2c
mov r8, qword [rsp + 0x70]
jmp 0x1800cabd0
cmp esi, dword [rbp + 8]
jne 0x1800cad70
mov r9d, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x78]
cmp dword [rsp + 0x20], r15d
mov rax, qword [rsp + 0xa0]
setne r15b
cmp edi, r14d
mov dword [rax], r15d
jl 0x1800cad59
mov eax, 1
jmp 0x1800cad72
cmp byte [rbp + 0x2c], 0
je 0x1800cad70
cmp esi, dword [rbp + 8]
jne 0x1800cad70
mov r8d, edi
call fcn.1800caac0
test eax, eax
je 0x1800cad52
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800e49d0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x150
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
mov rax, qword [rdx]
xor edi, edi
mov r9d, edi
test rax, rax
sete r9b
test rax, rax
je 0x1800e4afb
lea edx, [rdi + 2]
lea r8d, [rdi + 1]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_int____ptr64]
nop
call qword [sym.imp.MSVCP90.dll_public:_static_class_std::locale_const____ptr64___cdecl_std::locale::classic_void_]
mov r8, rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rcx, [rsp + rcx + 0x60]
lea rdx, [rsp + 0x168]
call qword [sym.imp.MSVCP90.dll_public:_class_std::locale___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::imbue_class_std::locale_const____ptr64____ptr64]
lea rcx, [rsp + 0x168]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::locale::destructor_void____ptr64]
call fcn.1800e7670
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.1800e7c30
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.1800e7ce0
xor ecx, ecx
call fcn.1800e7810
test eax, eax
sete dil
lea rax, str._hooked_successfully_n
lea rbx, str._hook_failed_n
test edi, edi
cmovne rbx, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.18000fa60
mov rcx, rax
mov rdx, rbx
call fcn.18000fcd0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::str_void____ptr64]
cmp qword [rax + 0x20], 8
jb 0x1800e4ad6
mov rcx, qword [rax + 8]
jmp 0x1800e4ada
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x38]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::vbase_dtor_void____ptr64]
mov eax, edi
jmp 0x1800e4afe
mov eax, r9d
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800e6b80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
test rcx, rcx
jne 0x1800e6b96
mov ebx, 0x10000
jmp 0x1800e6b9d
lea rbx, [rcx + 0x10000]
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov edi, 0x5a4d
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800e6c20
cmp dword [rsp + 0x40], 0x1000
jne 0x1800e6c22
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x1800e6c22
bt eax, 8
jb 0x1800e6c22
cmp word [rbx], di
jne 0x1800e6c17
mov eax, dword [rbx + 0x3c]
cmp rax, qword [rsp + 0x38]
ja 0x1800e6c17
cmp eax, 0x40
jb 0x1800e6c17
cdqe
cmp dword [rax + rbx], 0x4550
jne 0x1800e6c22
mov rax, rbx
jmp 0x1800e6c20
jmp 0x1800e6c22
jmp 0x1800e6c31
mov rcx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x38]
add rbx, rcx
jmp 0x1800e6bc2
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1800e6c40
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rsi
push rdi
sub rsp, 0x30
mov r9, rcx
test rcx, rcx
jne 0x1800e6c5b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9, rax
mov eax, 0x5a4d
cmp word [r9], ax
je 0x1800e6c78
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800e6d45
movsxd r10, dword [r9 + 0x3c]
add r10, r9
cmp dword [r10], 0x4550
je 0x1800e6c9a
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800e6d45
movzx eax, word [r10 + 0x14]
test ax, ax
jne 0x1800e6cb6
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800e6d45
movzx eax, ax
lea r11, [rax + r10 + 0x18]
xor edx, edx
mov dword [rsp + 0x20], edx
movzx eax, word [r10 + 6]
cmp edx, eax
jae 0x1800e6d29
lea rcx, [rdx + rdx*4]
lea r8, [r11 + rcx*8]
lea rdi, str..detour
mov rsi, r8
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
jne 0x1800e6d21
mov eax, dword [r8 + 0xc]
test eax, eax
je 0x1800e6d29
cmp dword [r8 + 0x10], 0
je 0x1800e6d29
lea rdi, [r9 + rax]
mov eax, dword [rdi]
cmp eax, 0x40
jb 0x1800e6d29
cmp dword [rdi + 4], 0x727444
jne 0x1800e6d29
cmp dword [rdi + 8], 0
jne 0x1800e6d14
mov dword [rdi + 8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
jmp 0x1800e6d45
inc edx
mov dword [rsp + 0x20], edx
jmp 0x1800e6cc4
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800e6d45
mov rsi, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800e6fc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx], 0x688
mov rbx, rcx
jne 0x1800e6f9f
cmp edx, 0x688
jb 0x1800e6f9f
mov edx, dword [rcx + 4]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x48], rdi
xor edi, edi
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0xffffffff
lea r8d, [rdi + 0x40]
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x40], 0xffffffff
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800e6f92
mov edx, dword [rbx + 8]
mov rcx, qword [rbx + 0x18]
lea r9, [rsp + 0x50]
lea r8d, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800e6f7b
mov r8d, dword [rbx + 4]
mov rcx, qword [rbx + 0x10]
lea rdx, [rbx + 0x28]
call sub.MSVCR90.dll_memcpy
mov r8d, dword [rbx + 8]
mov rcx, qword [rbx + 0x18]
lea rdx, [rbx + 0x68]
call sub.MSVCR90.dll_memcpy
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1800e6f5f
mov edx, dword [rbx + 0xc]
lea r9, [rsp + 0x40]
lea r8d, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800e6f64
mov r8d, dword [rbx + 0xc]
mov rcx, qword [rbx + 0x20]
lea rdx, [rbx + 0x670]
call sub.MSVCR90.dll_memcpy
mov edx, dword [rbx + 0xc]
mov r8d, dword [rsp + 0x40]
mov rcx, qword [rbx + 0x20]
lea r9, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, 1
jmp 0x1800e6f64
mov edi, 1
mov edx, dword [rbx + 8]
mov r8d, dword [rsp + 0x50]
mov rcx, qword [rbx + 0x18]
lea r9, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [rbx + 4]
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x30
pop rbx
ret
push rbx
sub rsp, 0x20
xor ecx, ecx
call fcn.1800e6b80
mov rbx, rax
test rax, rax
je 0x1800e7009
nop word [rax + rax]
lea r8, [rsp + 0x30]
lea rdx, [0x180129d40]
mov rcx, rbx
call fcn.1800e6d50
test rax, rax
jne 0x1800e7027
mov rcx, rbx
call fcn.1800e6b80
mov rbx, rax
test rax, rax
jne 0x1800e6fe0
mov ecx, 0x7e
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x7e
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x1800e7014
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x1800e6e70

Function at 0x1800e7040
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x1800e706e
xor al, al
jmp 0x1800e70ac
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x1800e707f
xor al, al
jmp 0x1800e70ac
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x1800e70a6
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x1800e70a6
mov al, 1
jmp 0x1800e70ac
xor al, al
jmp 0x1800e70ac
add rsp, 0x50
pop rbx
ret
Function at 0x1800e7160
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x1800e7180
lea rbx, [rax + rcx - 0x10000]
mov qword [rsp + 0x60], rsi
cmp rbx, rdx
jae 0x1800e724f
mov esi, 0x80010000
nop word [rax + rax]
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x1800e71b7
mov rbx, rsi
jmp 0x1800e7246
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
lea r8d, [rax + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800e724f
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x1800e722e
cmp rcx, 0x10000
jb 0x1800e722e
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1800e7251
add rbx, 0x10000
jmp 0x1800e7246
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx eax, bx
test rax, rax
je 0x1800e7246
lea rbx, [rbx + rax - 0x10000]
cmp rbx, rdi
jb 0x1800e71a0
xor eax, eax
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1800e7270
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
lea rbx, [rdx - 0x10000]
mov rdi, rcx
movzx eax, bx
test rax, rax
je 0x1800e728f
sub rbx, rax
cmp rbx, rcx
jbe 0x1800e734d
nop dword [rax + rax]
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x1800e72b9
mov ebx, 0x4fff0000
jmp 0x1800e7344
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
lea r8d, [rax + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800e734d
cmp dword [rsp + 0x40], 0x10000
jne 0x1800e732d
cmp qword [rsp + 0x38], 0x10000
jb 0x1800e732d
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1800e734f
sub rbx, 0x10000
jmp 0x1800e7344
mov rbx, qword [rsp + 0x28]
add rbx, 0xffffffffffff0000
movzx eax, bx
test rax, rax
je 0x1800e7344
sub rbx, rax
cmp rbx, rdi
ja 0x1800e72a0
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1800e7360
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
cmp rcx, 0x7ff80000
jbe 0x1800e737f
lea rsi, [rcx - 0x7ff80000]
jmp 0x1800e7384
mov esi, 0x10000
mov qword [rsp + 0x38], rdi
cmp rcx, 0xffffffff80000000
jae 0x1800e739b
lea rdi, [rcx + 0x7ff80000]
jmp 0x1800e73a2
mov rdi, 0xfffffffffff80000
mov rdx, qword [0x180179658]
mov rax, qword [0x180179650]
mov qword [rsp + 0x30], rbp
test rdx, rdx
jne 0x1800e73c9
test rax, rax
je 0x1800e73e0
mov rdx, rax
mov qword [0x180179658], rax
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x1800e73e0
cmp rcx, rsi
jb 0x1800e73e0
cmp rcx, rdi
jbe 0x1800e7518
mov rdx, rax
mov qword [0x180179658], rax
test rax, rax
je 0x1800e741c
nop
test rdx, rdx
je 0x1800e740c
mov rax, qword [rdx + 0x10]
test rax, rax
je 0x1800e740c
cmp rax, rsi
jb 0x1800e740c
cmp rax, rdi
jbe 0x1800e7518
mov rdx, qword [rdx + 8]
mov qword [0x180179658], rdx
test rdx, rdx
jne 0x1800e73f0
movzx eax, bx
sub rbx, rax
cmp rbx, 0x40000000
jbe 0x1800e7459
lea rcx, [rbx - 0x40000000]
mov rdx, rbx
call fcn.1800e7160
mov rdx, rax
test rax, rax
jne 0x1800e74c0
lea rdx, [rbx - 0x40000000]
mov rcx, rsi
call fcn.1800e7270
mov rdx, rax
test rax, rax
jne 0x1800e74c0
movabs rax, 0xffffffff40000000
cmp rbx, rax
jae 0x1800e7496
lea rdx, [rbx + 0x40000000]
mov rcx, rbx
call fcn.1800e7270
mov rdx, rax
test rax, rax
jne 0x1800e74c0
lea rcx, [rbx + 0x40000000]
mov rdx, rdi
call fcn.1800e7160
mov rdx, rax
test rax, rax
jne 0x1800e74c0
mov rdx, rbx
mov rcx, rsi
call fcn.1800e7270
mov rdx, rax
test rax, rax
jne 0x1800e74c0
mov rdx, rdi
mov rcx, rbx
call fcn.1800e7160
mov rdx, rax
test rax, rax
je 0x1800e7544
mov dword [rdx], 0x52727464
xor r8d, r8d
mov qword [0x180179658], rdx
mov qword [rdx + 0x10], r8
mov rax, qword [0x180179650]
lea rcx, [rdx + 0xffa8]
mov qword [rdx + 8], rax
mov qword [0x180179650], rdx
lea rax, [rdx + 0xff60]
mov r9d, 0x2a7
nop word [rax + rax]
mov qword [rcx], r8
mov r8, rax
sub rcx, 0x60
sub rax, 0x60
sub r9, 1
jne 0x1800e7500
mov qword [rdx + 0x10], r8
mov rbx, qword [rdx + 0x10]
cmp rbx, rsi
jb 0x1800e7544
cmp rbx, rdi
ja 0x1800e7544
mov rcx, qword [rbx + 0x48]
mov qword [rdx + 0x10], rcx
mov edx, 0xcc
mov rcx, rbx
lea r8d, [rdx - 0x6c]
call sub.MSVCR90.dll_memset
mov rax, rbx
jmp 0x1800e7546
xor eax, eax
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret