joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003bae0
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r13, qword gs:[0x60]
mov rbx, rcx
mov r12, qword [rsp + 0xc0]
xor eax, eax
xor ecx, ecx
mov r8d, 0x14d0
mov r14, r9
mov rbp, rdx
mov rdi, qword [r13 + 0x68]
mov sil, 1
mov byte [r12], al
call fcn.18003bc9c
lea rax, [rbx + 0x58]
mov rdx, rbp
neg rbx
lea r9, [rsp + 0xb0]
mov rcx, rdi
sbb r8, r8
and r8, rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.18003bcf0
movzx edi, word [rsp + 0x50]
mov ebx, eax
mov r15b, byte [rsp + 0xb0]
test eax, eax
js 0x18003bb7a
test r15b, r15b
jne 0x18003bc16
mov eax, 0x14d3
movzx r8d, ax
mov rdx, rbp
xor ecx, ecx
call fcn.18003bc9c
test r15b, r15b
jne 0x18003bc25
xor r15d, r15d
mov eax, ebx
not eax
test eax, eax
jns 0x18003bbf6
test sil, sil
je 0x18003bbf6
cmp byte [0x18015c298], r15b
jne 0x18003bbf6
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], r15
lea r8, [0x180110320]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov rdx, rbp
mov qword [rsp + 0x20], rax
lea ecx, [r9 + 1]
call sym.ntdll.dll_RtlDosApplyFileIsolationRedirection_Ustr
mov edi, eax
test eax, eax
jns 0x18003bc78
cmp edi, 0xc0150008
cmovne ebx, edi
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
test di, di
je 0x18003bc64
mov eax, 0x14d1
jmp 0x18003bb7f
xor r15d, r15d
test di, di
je 0x18003bc6e
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.18003be00
mov ebx, eax
test eax, eax
js 0x18003bb99
mov rax, qword [r13 + 0x20]
test rax, rax
je 0x18003bc59
test dword [rax + 8], 0x1000
mov sil, 1
jne 0x18003bc5c
mov sil, r15b
mov rbp, r14
jmp 0x18003bb99
mov eax, 0x14d2
jmp 0x18003bb7f
mov ebx, 0xc0000481
jmp 0x18003bb99
mov rdx, r14
mov byte [r12], 1
lea rcx, [rsp + 0x60]
call fcn.18003fb24
lea rcx, [rsp + 0x60]
call fcn.180042420
jmp 0x18003bbed
Function at 0x18003c960
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r10, qword gs:[0x30]
xor r12d, r12d
mov rbx, r9
mov edi, r8d
mov rsi, rdx
mov r15d, ecx
mov rax, qword [r10 + 0x60]
cmp qword [rax + 0x2f8], r12
je 0x18003ca76
mov r14, qword [rbp + 0x40]
mov qword [rsp + 0x20], r14
mov dword [rbp - 0x3c], r12d
call fcn.18003f2ec
test eax, eax
js 0x18003ca55
lea r9, [rbp - 0x30]
mov qword [rbp - 0x28], 0x20
lea r8, [rbp - 0x3c]
mov qword [rbp - 0x20], rsi
lea rdx, [rbp - 0x38]
mov dword [rbp - 0x18], edi
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x14], r12
mov qword [rbp - 0x30], r12
call fcn.18003efcc
test eax, eax
cmovns eax, r12d
test eax, eax
js 0x18003ca55
mov esi, dword [rbp - 0x3c]
cmp esi, 0x28
jb 0x1800b1130
mov rdi, qword [rbp - 0x38]
cmp dword [rdi], 0x64487347
jne 0x1800b1134
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call fcn.18003f5c0
test eax, eax
jns 0x18003ca9a
cmp eax, 0xc0150008
jne 0x18003ca55
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x3c]
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x28]
call fcn.18003efcc
test eax, eax
jns 0x18003c9fb
cmp eax, 0xc0150001
jne 0x18003ca55
mov eax, 0xc0150008
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
cmp qword [rax + 0x308], r12
jne 0x18003c9ab
mov rax, qword [r10 + 0x2c8]
cmp qword [rax], r12
jne 0x18003c9ab
mov eax, 0xc0150001
jmp 0x18003ca55
mov rbx, qword [rbp - 0x30]
lea rax, [rbx - 1]
or rax, 7
cmp rax, 0xffffffffffffffff
je 0x18003cac1
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x18003cac1
test byte [rbx + 0x30], 8
je 0x18003caff
test byte [rbx + 0x50], 8
je 0x18003caff
test r14, r14
je 0x18003caf7
mov eax, dword [rdi + 0x24]
lea r9, [rbp - 0x28]
mov dword [rsp + 0x38], esi
mov r8, rbx
mov dword [rsp + 0x30], eax
mov rdx, r14
mov eax, dword [rdi + 0x20]
mov ecx, r15d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call fcn.18007ee6c
test eax, eax
js 0x18003ca55
mov eax, r12d
jmp 0x18003ca55
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x40], r12b
mov r9, qword [rbx + 0x28]
mov rdx, rbx
mov r8, qword [rbx + 0x18]
mov qword [rsp + 0x28], rcx
mov ecx, 3
mov qword [rsp + 0x20], r12
call qword [section..00cfg]
or dword [rbx + 0x30], 8
cmp byte [rbp - 0x40], r12b
je 0x18003cac1
or dword [rbx + 0x50], 8
jmp 0x18003cac1
mov rdi, qword [rbp - 0x38]
xor edx, edx
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, str.RtlFindActivationContextSectionGuid___found_section_at__p__length__lu__which_is_not_a_GUID_section_n
lea ecx, [rdx + 0x33]
call sym.ntdll.dll_DbgPrintEx
mov eax, 0xc0150003
jmp 0x18003ca55
Function at 0x18003efcc
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, qword gs:[0x30]
mov r12, r8
xor r8d, r8d
mov r14, r9
mov rbp, rcx
mov edi, r8d
mov ebx, r8d
mov r15, qword [r13 + 0x60]
test r9, r9
je 0x18003f013
mov qword [r9], r8
mov ecx, dword [rcx + 0x14]
mov esi, 2
mov eax, ecx
test eax, eax
jne 0x18003f04d
mov rax, qword [r13 + 0x2c8]
test rax, rax
je 0x18003f039
mov rbx, qword [rax]
test rbx, rbx
jne 0x18003f118
mov rdi, qword [r15 + 0x2f8]
mov rbx, r8
test rdi, rdi
je 0x18003f05b
mov dword [rbp + 0x14], esi
jmp 0x18003f079
sub eax, 1
je 0x18003f039
cmp eax, 1
jne 0x18003f103
mov rdi, qword [r15 + 0x308]
mov rbx, 0xfffffffffffffffc
test rdi, rdi
je 0x18003f103
mov dword [rbp + 0x14], 3
test rdi, rdi
je 0x18003f111
mov r8d, dword [rbp + 0x10]
mov r9, rdx
mov rdx, qword [rbp + 8]
mov rcx, rdi
mov qword [rsp + 0x20], r12
call fcn.18003f160
xor r8d, r8d
test eax, eax
js 0x18003f0ea
cmp rbx, 0xfffffffffffffffc
mov eax, r8d
cmovne esi, r8d
test rbx, rbx
sete al
or esi, eax
mov dword [rbp + 0x18], esi
test r14, r14
je 0x18003f0ca
cmp rbx, 0xfffffffffffffffc
mov eax, r8d
cmovne rax, rbx
mov qword [r14], rax
mov eax, r8d
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp eax, 0xc0150001
jne 0x18003f0cd
mov ecx, dword [rbp + 0x14]
cmp ecx, 3
je 0x18003f0cd
mov rdx, qword [rsp + 0x68]
jmp 0x18003f01b
cmp ecx, 3
jbe 0x18003f079
jmp 0x1800b1888
mov eax, 0xc0150001
jmp 0x18003f0cd
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x18003f136
test rdi, rdi
je 0x18003f039
mov dword [rbp + 0x14], 1
jmp 0x18003f079
cmp rbx, 0xfffffffffffffffc
je 0x18003f148
cmp rbx, 0xfffffffffffffffd
je 0x18003f151
mov rdi, qword [rbx + 0x18]
jmp 0x18003f121
mov rdi, qword [r15 + 0x308]
jmp 0x18003f121
lea rdi, str.Actx
jmp 0x18003f12a
mov eax, 0xc00000e5
jmp 0x18003f0cd

Function at 0x18003fad0
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
sub rsp, 0x28
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
jne 0x1800b1d04
mov eax, 0x7ffe0030
add rsp, 0x28
ret
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x90]
add rax, 0x1e
jmp 0x18003fae6
Function at 0x1800445f0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rdx
test rcx, rcx
je 0x1800b340e
test r8, r8
je 0x1800b340e
mov eax, dword [r8]
mov dword [r8], 0x20
cmp eax, 0x20
jb 0x1800446f8
mov rdx, rcx
mov r8b, 1
lea rcx, [rbp - 0x39]
call sym.ntdll.dll_RtlUpcaseUnicodeString
test eax, eax
js 0x1800446db
movzx r8d, word [rbp - 0x39]
lea rcx, [rbp - 0x29]
mov rdx, qword [rbp - 0x31]
and dword [rbp + 0x2b], 0
and dword [rbp + 0x2f], 0
mov dword [rbp + 0x17], 0x67452301
mov dword [rbp + 0x1b], 0xefcdab89
mov dword [rbp + 0x1f], 0x98badcfe
mov dword [rbp + 0x23], 0x10325476
mov dword [rbp + 0x27], 0xc3d2e1f0
call sym.ntdll.dll_A_SHAUpdate
lea rdx, [rbp + 0x37]
lea rcx, [rbp - 0x29]
call sym.ntdll.dll_A_SHAFinal
lea rcx, [rbp - 0x39]
call sym.ntdll.dll_RtlFreeAnsiString
mov r8b, 6
lea rdx, [0x180114790]
mov rcx, rbx
call sym.ntdll.dll_RtlInitializeSid
mov eax, dword [rbp + 0x37]
mov dword [rbx + 8], 0x50
mov dword [rbx + 0xc], eax
mov eax, dword [rbp + 0x3b]
mov dword [rbx + 0x10], eax
mov eax, dword [rbp + 0x3f]
mov dword [rbx + 0x14], eax
mov eax, dword [rbp + 0x43]
mov dword [rbx + 0x18], eax
mov eax, dword [rbp + 0x47]
mov dword [rbx + 0x1c], eax
xor eax, eax
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.18008b0e0
mov rbx, qword [rsp + 0xd8]
add rsp, 0xb0
pop rbp
ret
mov eax, 0xc0000023
jmp 0x1800446db
mov eax, 0xc000000d
jmp 0x1800446db

Function at 0x180044710
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov edi, dword [rcx + 0x58]
mov rsi, rdx
mov eax, edi
mov edx, 0x40
and eax, 0x3f
mov rbp, rcx
sub edx, eax
lea rcx, [rsp + 0x30]
cmp edx, 8
lea eax, [rdx + 0x40]
cmova eax, edx
xor edx, edx
mov ebx, eax
lea r8d, [rax - 8]
call sym.ntdll.dll_memset
mov ecx, dword [rbp + 0x54]
lea rdx, [rsp + 0x20]
shl ecx, 3
mov eax, edi
shr eax, 0x1d
mov r8d, 2
or ecx, eax
mov byte [rsp + 0x30], 0x80
mov eax, edi
mov dword [rsp + 0x20], ecx
shl eax, 3
lea rcx, [rsp + rbx + 0x28]
mov dword [rsp + 0x24], eax
call fcn.180044934
mov r8d, ebx
lea rdx, [rsp + 0x30]
mov rcx, rbp
call sym.ntdll.dll_A_SHAUpdate
mov r8d, 5
lea rdx, [rbp + 0x40]
mov rcx, rsi
call fcn.180044934
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 0x40]
call sym.ntdll.dll_memset
and dword [rbp + 0x54], 0
and dword [rbp + 0x58], 0
mov dword [rbp + 0x40], 0x67452301
mov dword [rbp + 0x44], 0xefcdab89
mov dword [rbp + 0x48], 0x98badcfe
mov dword [rbp + 0x4c], 0x10325476
mov dword [rbp + 0x50], 0xc3d2e1f0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18008b0e0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x180044814
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov ebx, dword [rcx + 0x24]
mov rsi, rdx
mov eax, ebx
mov edx, 0x40
and eax, 0x3f
mov r14, rcx
sub edx, eax
lea rcx, [rsp + 0x30]
cmp edx, 8
lea eax, [rdx + 0x40]
cmova eax, edx
xor edx, edx
mov edi, eax
lea r8d, [rax - 8]
call sym.ntdll.dll_memset
mov edx, dword [r14 + 0x20]
lea rcx, [rsp + rdi + 0x28]
shl edx, 3
mov eax, ebx
shr eax, 0x1d
mov r8d, 2
or edx, eax
mov byte [rsp + 0x30], 0x80
mov eax, ebx
mov dword [rsp + 0x20], edx
shl eax, 3
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], eax
call fcn.180044934
mov r8d, edi
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.180044954
mov r8d, 8
mov rdx, r14
mov rcx, rsi
call fcn.180044934
and dword [r14 + 0x20], 0
lea rdi, [r14 + 0x28]
and dword [r14 + 0x24], 0
xor eax, eax
mov dword [r14], 0x6a09e667
mov dword [r14 + 4], 0xbb67ae85
mov dword [r14 + 8], 0x3c6ef372
mov dword [r14 + 0xc], 0xa54ff53a
lea ecx, [rax + 0x40]
mov dword [r14 + 0x10], 0x510e527f
mov dword [r14 + 0x14], 0x9b05688c
mov dword [r14 + 0x18], 0x1f83d9ab
mov dword [r14 + 0x1c], 0x5be0cd19
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18008b0e0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop r14
pop rdi
pop rsi
ret
Function at 0x180047030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rdi, rdx
mov rbx, rcx
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
jne 0x1800b36ca
mov ecx, 0x7ffe0386
cmp byte [rcx], 0
jne 0x180047102
and qword [rsp + 0x38], 0
xorps xmm0, xmm0
and qword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x60], 0
and dword [rsp + 0x68], 0
mov dword [rsp + 0x30], 3
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x6c], 1
mov dword [rsp + 0x70], 0x48
test rdi, rdi
jne 0x1800470b1
test byte [rbx + 0x30], 0xc0
lea ecx, [rdi + 2]
mov eax, edi
cmovne eax, ecx
mov dword [rsp + 0x68], eax
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x30]
call fcn.180047138
mov rcx, qword [rbx + 0x28]
test rcx, rcx
jne 0x180047120
mov rcx, qword [rbx + 0x48]
cmp rcx, 0xffffffffffffffff
jne 0x180047127
mov rcx, qword [rbx + 0x50]
test rcx, rcx
jne 0x18004712e
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
jmp sym.ntdll.dll_RtlFreeHeap
mov rax, qword [rbx + 0x60]
mov rdx, rbx
mov r9, qword [rbx + 0x40]
mov r8, qword [rbx + 0x38]
mov qword [rsp + 0x20], rax
call fcn.180002aec
jmp 0x18004705e
call sym.ntdll.dll_NtClose
jmp 0x1800470c8
call sym.ntdll.dll_RtlReleaseActivationContext
jmp 0x1800470d2
call sym.ntdll.dll_LdrUnloadDll
jmp 0x1800470db
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22c
jmp 0x180047055
Function at 0x180047e60
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0xf0
mov rbx, qword gs:[0x30]
mov rdi, qword [rbx + 0x60]
xor r14d, r14d
cmp byte [0x18015c3a8], r14b
jne 0x180047fad
mov rax, qword [rdi + 0x20]
movups xmm0, xmmword [rax + 0x70]
movdqu xmmword [rsp + 0x40], xmm0
mov rax, qword [rdi + 0x20]
test byte [rax + 8], 1
je 0x1800b3974
test byte [0x180156a70], 5
jne 0x1800b397e
mov rax, qword [rbx + 0x48]
mov qword [0x18015c3b0], rax
mov byte [0x18015c3a8], 1
cmp byte [0x18015cfb4], r14b
jne 0x180048027
mov rcx, qword [rbx + 0x17c8]
test rcx, rcx
je 0x180047eee
call sym.ntdll.dll_RtlProcessFlsData
test byte [0x1801596d4], 2
je 0x18004805c
mov rdi, qword [0x18015c398]
lea rax, [0x18015c390]
cmp rdi, rax
je 0x180047f95
lea rbx, [rdi - 0x20]
mov rdi, qword [rdi + 8]
mov rsi, qword [rbx + 0x38]
test rsi, rsi
je 0x180047f02
test dword [rbx + 0x68], 0x80000
je 0x180047f02
mov qword [rsp + 0x50], 0x48
mov dword [rsp + 0x58], 1
xor edx, edx
lea r8d, [rdx + 0x38]
lea rcx, [rsp + 0x60]
call sym.ntdll.dll_memset
mov rdx, qword [rbx + 0x88]
lea rcx, [rsp + 0x50]
call sym.ntdll.dll_RtlActivateActivationContextUnsafeFast
nop
cmp word [rbx + 0x6e], r14w
je 0x180047f70
mov rdx, rbx
xor ecx, ecx
call fcn.18003b5f8
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbx + 0x30]
mov rcx, rsi
call fcn.18003b518
nop
lea rcx, [rsp + 0x50]
call sym.ntdll.dll_RtlDeactivateActivationContextUnsafeFast
jmp 0x180047f02
mov rbx, qword [0x18015bf88]
cmp word [rbx + 0x6e], r14w
jne 0x180047fc7
call sym.ntdll.dll_RtlDetectHeapLeaks
call fcn.1800483f8
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
mov qword [rsp + 0xa0], 0x48
mov dword [rsp + 0xa8], 1
xor edx, edx
lea r8d, [rdx + 0x38]
lea rcx, [rsp + 0xb0]
call sym.ntdll.dll_memset
mov rdx, qword [rbx + 0x88]
lea rcx, [rsp + 0xa0]
call sym.ntdll.dll_RtlActivateActivationContextUnsafeFast
nop
mov rdx, qword [0x18015bf88]
xor ecx, ecx
call fcn.18003b5f8
nop
lea rcx, [rsp + 0xa0]
call sym.ntdll.dll_RtlDeactivateActivationContextUnsafeFast
jmp 0x180047fa3
mov r8d, dword [0x7ffe0330]
mov ecx, r8d
and ecx, 0x3f
mov eax, 0x40
sub eax, ecx
mov cl, al
mov rdx, qword [0x18016f200]
ror rdx, cl
mov eax, r8d
xor rax, rdx
mov rcx, qword [section..00cfg]
call rcx
jmp 0x180047edd
mov rax, qword [rdi + 0x20]
test dword [rax + 8], 0x40000000
sete cl
test byte [0x18016f29c], 1
sete al
test al, cl
jne 0x180047fa8
jmp 0x180047efb
add qword [rsp + 0x48], rax
jmp 0x180047eb1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x40]
mov qword [rsp + 0x28], rax
lea rax, str.Process_0x_p___wZ__exiting_n
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [0x180125120]
mov edx, 0x171b
lea rcx, [0x180118390]
call fcn.1800ca394
nop
jmp 0x180047ebe
Function at 0x180048090
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, qword gs:[0x60]
mov rbx, rcx
test rcx, rcx
jne 0x180048155
mov rdi, qword gs:[0x30]
mov r8d, 0x410
mov rcx, qword gs:[0x60]
mov edx, dword [0x18015c294]
add edx, 0x2c0000
or edx, 8
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov rbx, rax
test rax, rax
je 0x1800b39c2
lea rcx, [0x18015d260]
mov qword [rdi + 0x17c8], rax
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
lea rax, [rsi + 0x328]
mov rcx, qword [rax + 8]
cmp qword [rcx], rax
jne 0x1800b39cc
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov qword [rax + 8], rbx
lea rcx, [0x18015d260]
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov ebp, dword [rsi + 0x350]
mov edi, 1
cmp ebp, edi
jb 0x1800481c6
mov r14d, edi
lea r15, [rbx + r14*8]
cmp qword [r15 + 0x10], 0
je 0x1800481c0
mov rcx, qword [rsi + 0x320]
add rcx, 8
shl r14, 4
add rcx, r14
call sym.ntdll.dll_RtlAcquireSRWLockShared
mov rdx, qword [rsi + 0x320]
mov rax, qword [r14 + rdx]
test rax, rax
je 0x1800481b4
mov rcx, qword [r15 + 0x10]
test rcx, rcx
je 0x1800481b4
call qword [section..00cfg]
and qword [r15 + 0x10], 0
mov rdx, qword [rsi + 0x320]
lea rcx, [rdx + 8]
add rcx, r14
call sym.ntdll.dll_RtlReleaseSRWLockShared
inc edi
cmp edi, ebp
jbe 0x180048164
lea rcx, [0x18015d260]
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov rcx, qword [rbx]
cmp qword [rcx + 8], rbx
jne 0x1800481f0
mov rax, qword [rbx + 8]
cmp qword [rax], rbx
jne 0x1800481f0
mov qword [rax], rcx
mov qword [rcx + 8], rax
jmp 0x18004812e
mov ecx, 3
int 0x29
int3
mov eax, 0xc0000017
jmp 0x18004813c
mov ecx, 3
int 0x29
int3
Function at 0x180048460
Capabilities:
Access peb ldr_data

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword gs:[0x60]
test dword [rax + 0xbc], 0x100
jne 0x1800484af
mov rax, qword gs:[0x60]
test dword [rax + 0xbc], 0x2000000
jne 0x1800484af
cmp qword [0x18015abc8], 0
mov ecx, 3
jne 0x1800b3ac8
test byte [0x18015d430], cl
jne 0x1800b3ac8
add rsp, 0x30
pop rbx
ret
and qword [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
xor r8d, r8d
and dword [0x18015d780], 0
xor edx, edx
call sym.ntdll.dll_RtlCreateHeap
mov qword [0x18015aa70], rax
test rax, rax
je 0x1800484af
mov rbx, qword gs:[0x60]
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], 0
je 0x1800b3b34
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
lea rcx, str.HEAP__wZ_:
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800b3b40
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea rcx, str.Inspecting_leaks_at_process_shutdown_..._n
call sym.ntdll.dll_DbgPrint
call fcn.1800f0374
test al, al
jne 0x1800b3b67
mov rcx, qword [0x18015aa70]
call sym.ntdll.dll_RtlDestroyHeap
nop
jmp 0x1800484af
mov ecx, dword [rbx + 0xe8]
mov rax, qword [rbx + 0xf0]
dec ecx
mov rcx, qword [rax + rcx*8]
mov qword [0x18015d778], rcx
call fcn.1800f0738
call fcn.1800f09f0
mov rcx, qword [0x18015aa70]
call sym.ntdll.dll_RtlDestroyHeap
and qword [0x18015aa70], 0
mov rax, qword gs:[0x60]
cmp dword [0x18015d780], 0
je 0x1800b3c0c
cmp qword [rax + 0x18], 0
je 0x1800b3bdb
mov rax, qword gs:[0x60]
lea rcx, str.HEAP__wZ_:
mov rdx, qword [rax + 0x18]
mov rdx, qword [rdx + 0x10]
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800b3be7
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
mov edx, dword [0x18015d780]
lea rcx, str._ld_leaks_detected._n
call sym.ntdll.dll_DbgPrint
test byte [0x18015d430], 2
je 0x1800484af
int3
cmp qword [rax + 0x18], 0
je 0x1800b3c36
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
lea rcx, str.HEAP__wZ_:
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800b3c42
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea rcx, str.No_leaks_detected._n
call sym.ntdll.dll_DbgPrint
nop
jmp 0x1800484af
Function at 0x180048564
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r8d, edx
mov r14, r9
mov r10, rcx
test rcx, rcx
je 0x1800b3c8c
cmp dword [rcx + 0x48], 0
jne 0x1800b3c8c
mov rbx, qword [rcx + 0xb8]
test rbx, rbx
je 0x180048647
mov rbx, qword [rbx + 0x90]
test rbx, rbx
je 0x1800b3c91
cmp qword [0x18015d398], rbx
je 0x1800b3c82
or edi, 0xffffffff
lock xadd dword [rbx + 0x1a0], edi
dec edi
mov esi, 1
lock xadd dword [rbx + 0x1a4], esi
inc esi
prefetchw byte [rbx + 8]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x40], rax
lea ecx, [rax + 1]
xor ecx, eax
movzx edx, cx
xor edx, eax
mov dword [rsp + 0x40], edx
mov rcx, qword [rsp + 0x40]
lock cmpxchg qword [rbx + 8], rcx
mov qword [rsp + 0x40], rax
jne 0x1800485ec
or dword [r10 + 0x90], 0x10
mov rcx, qword [r10 + 0x88]
mov dword [r10 + 0x48], r8d
test rcx, rcx
jne 0x180048653
mov rax, qword [rsp + 0x60]
mov qword [r15], rbx
mov dword [r14], edi
mov dword [rax], esi
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov rbx, qword [rcx + 0x80]
jmp 0x1800485ad
call fcn.180107e34
jmp 0x180048624
mov eax, 0xc00000bb
jmp 0x180048633
call fcn.180108578
mov eax, 0xc000000d
jmp 0x180048633

Function at 0x180048d60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x18015d2c8]
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
mov rcx, rbx
call fcn.180048f08
xor edi, edi
mov rbx, rax
test rax, rax
je 0x180048df1
add dword [rax + 0x20], 0xffffffff
jne 0x180048dd8
mov rax, qword [rax]
cmp qword [rax + 8], rbx
jne 0x180048df8
mov rcx, qword [rbx + 8]
cmp qword [rcx], rbx
jne 0x180048df8
mov qword [rcx], rax
lea r8, [rbx + 0x18]
mov qword [rax + 8], rcx
lea rdx, [rbx + 0x10]
or rcx, 0xffffffffffffffff
lea r9d, [rdi + 1]
call sym.ntdll.dll_NtUnlockVirtualMemory
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov edi, eax
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
lea rcx, [0x18015d2c8]
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
mov rbx, qword [rsp + 0x30]
mov eax, edi
add rsp, 0x20
pop rdi
ret
mov edi, 0xc000002a
jmp 0x180048dd8
mov ecx, 3
int 0x29
int3