joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003c770
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003c7ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003c7ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003c7ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003c7ba
cmp dword [rcx + 0x84], 0xe
jbe 0x14003c7ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003c7bc
xor al, al
add rsp, 0x28
ret
Function at 0x1400111f4
Capabilities:
Terminate process

Disassembly:
jmp 0x140012dd0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011271
Capabilities:
Get file size
Read file on windows

Disassembly:
jmp 0x1400117d0
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x14002309f]
call fcn.14001137a
nop
lea rax, str.._sgn.bin
mov qword [rbp + 0x68], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xffffffffffffffff
jne 0x14001185c
xor eax, eax
jmp 0x1400118e5
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp + 4], eax
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rbp + 0x88], rax
mov eax, dword [rbp + 4]
mov r8d, eax
xor edx, edx
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0xa8], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 4]
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor r9d, r9d
mov r8, qword [rbp + 0xa8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.GDI32.dll_EnumFontsW]
nop
jmp 0x1400118e3
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001ac00]
call fcn.140011316
mov rax, rdi
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.1400111a9
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret

Function at 0x14001127b
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014120
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014140
xor al, al
jmp 0x1400141c1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014153
xor al, al
jmp 0x1400141c1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001417d
xor al, al
jmp 0x1400141c1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014191
xor al, al
jmp 0x1400141c1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400141a3
xor al, al
jmp 0x1400141c1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400141bf
xor al, al
jmp 0x1400141c1
mov al, 1
add rsp, 0x38
ret
Function at 0x140012000
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113a2
movzx eax, al
test eax, eax
jne 0x140012020
mov ecx, 7
call fcn.140011320
nop
mov byte [rsp + 0x20], 0
call fcn.140011334
mov byte [rsp + 0x21], al
cmp dword [0x14001d868], 1
jne 0x140012044
mov ecx, 7
call fcn.140011320
nop
jmp 0x14001209c
cmp dword [0x14001d868], 0
jne 0x140012097
mov dword [0x14001d868], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.140011195
test eax, eax
je 0x140012078
mov eax, 0xff
jmp 0x1400121a1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.14001132a
mov dword [0x14001d868], 2
jmp 0x14001209c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001130c
call fcn.14001129e
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400120f9
mov rcx, qword [rsp + 0x30]
call fcn.140011154
movzx eax, al
test eax, eax
je 0x1400120f9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140024020]
nop
call fcn.1400112d0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001212d
mov rcx, qword [rsp + 0x38]
call fcn.140011154
movzx eax, al
test eax, eax
je 0x14001212d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011361
nop
call fcn.140012250
mov dword [rsp + 0x28], eax
call fcn.14001127b
movzx eax, al
test eax, eax
jne 0x14001214c
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001215b
call fcn.14001136b
nop
xor edx, edx
mov cl, 1
call fcn.140011145
mov eax, dword [rsp + 0x28]
jmp 0x1400121a1
add rsp, 0x68
ret
Function at 0x1400021dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140004650], rbx
je 0x140002228
cmp rax, rbx
jne 0x14000221b
mov ebx, 1
mov esi, ebx
jmp 0x14000222d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002200
mov ebx, 1
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x140002243
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400022a8
mov eax, dword [0x140004658]
test eax, eax
jne 0x1400022a2
mov dword [0x140004658], ebx
lea r15, [0x1400033b0]
lea rdi, [0x140003398]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140002294
test eax, eax
jne 0x140002298
cmp qword [rdi], 0
je 0x140002289
mov rax, qword [rdi]
mov rcx, qword [0x140003378]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000226a
test eax, eax
je 0x1400022a8
mov eax, 0xff
jmp 0x140002384
mov dword [0x140004064], ebx
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x1400022cf
lea rdx, [0x140003390]
lea rcx, [0x140003380]
call sub.msvcrt.dll__initterm
mov dword [0x140004658], 2
test esi, esi
jne 0x1400022dc
xor eax, eax
xchg qword [0x140004650], rax
cmp qword [0x140004660], 0
je 0x140002310
lea rcx, [0x140004660]
call fcn.140002540
test eax, eax
je 0x140002310
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140004660]
mov r9, qword [0x140003378]
call r9
mov r8, qword [0x140004078]
mov rdx, qword [0x140004070]
mov ecx, dword [0x140004068]
call fcn.140001800
mov dword [0x140004060], eax
cmp dword [0x140004080], 0
jne 0x140002340
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140004064], 0
jne 0x140002355
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140004060]
jmp 0x140002384
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140130000
add rsp, 0x28
jmp 0x1400021dc

Function at 0x140002450
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000249c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002494
cmp dword [rcx + 0x3c], edx
jl 0x140002494
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140002494
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000249c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001570
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140015c60], rbx
je 0x1400015d7
cmp rax, rbx
jne 0x1400015ca
mov ebx, 1
mov esi, ebx
jmp 0x1400015dc
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400015af
mov ebx, 1
mov eax, dword [0x140015c68]
cmp eax, ebx
jne 0x1400015f4
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000166a
mov eax, dword [0x140015c68]
test eax, eax
jne 0x14000165f
mov dword [0x140015c68], ebx
lea r15, [0x140010bf8]
lea rdi, [0x140010be0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x140001651
test eax, eax
jne 0x140001655
cmp qword [rdi], r14
je 0x140001646
movabs r10, 0xd30527475e523070
mov rax, qword [rdi]
mov rcx, qword [0x140010b90]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000161e
test eax, eax
je 0x140001665
mov eax, 0xff
jmp 0x1400017ca
mov dword [0x1400153e4], ebx
mov edi, 0x1f
mov eax, dword [0x140015c68]
cmp eax, ebx
jne 0x140001691
lea rdx, [0x140010bd8]
lea rcx, [0x140010ba0]
call sub.msvcrt.dll__initterm
mov dword [0x140015c68], 2
test esi, esi
jne 0x14000169f
mov rax, r14
xchg qword [0x140015c60], rax
cmp qword [0x140015c80], r14
je 0x1400016dc
lea rcx, [0x140015c80]
call fcn.140001c70
test eax, eax
je 0x1400016dc
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140015c80]
mov r9, qword [0x140010b90]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x1400016f5
mov eax, 0xff
jmp 0x1400017ca
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000177b
test ax, ax
je 0x140001710
test edx, edx
jne 0x14000177b
sub ax, bx
cmp ax, di
ja 0x140001726
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x140001710
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140006fbc
mov dword [0x1400153e0], eax
cmp dword [0x140015400], r14d
jne 0x140001764
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400153e4], r14d
jne 0x140001779
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400153e0]
jmp 0x1400017ca
cmp ax, 0x22
jne 0x14000178f
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400016fe
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14012e000
add rsp, 0x28
jmp 0x140001570
Function at 0x1800057bc
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
xor ebx, ebx
call fcn.1800062c8
mov rcx, qword [rsi]
call fcn.180006094
mov rdi, rax
test rax, rax
je 0x180005889
mov edx, dword [rax + 8]
mov rcx, qword [rax]
call fcn.180005d04
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, dword [rdi + 8]
mov rdx, qword [rdi]
mov rbp, rax
lea rax, [rsp + 0x48]
lea r9d, [rbx + 0x40]
mov rcx, rbp
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x180005884
mov rdx, qword [rdi]
cmp dword [rdi + 8], ebx
jbe 0x180005840
mov ecx, ebx
inc ebx
mov al, byte [rcx + rdi + 0x58]
mov byte [rcx + rdx], al
cmp ebx, dword [rdi + 8]
jb 0x180005830
mov r8d, dword [rdi + 8]
mov rdx, qword [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov r8d, dword [rdi + 8]
mov r9d, dword [rsp + 0x48]
mov rdx, qword [rdi]
lea rax, [rsp + 0x48]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
mov qword [rsi], rax
mov ebx, 1
call fcn.180006048
call fcn.180005ebc
lea rcx, [0x1800334e0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800058b4
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rbx, qword [rcx]
xor r14d, r14d
mov rdi, rdx
mov esi, r14d
mov r13, rcx
call fcn.1800062c8
mov rcx, rbx
call fcn.180006270
mov rcx, rdi
mov r15, rax
call fcn.180006270
lea r8d, [r14 + 0x50]
lea rcx, [rbp - 0x31]
xor edx, edx
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x41], rax
call sub.ntdll.dll_memset
lea r8, [rbp - 0x39]
mov rcx, r15
call fcn.180005b14
mov ebx, eax
cmp eax, 5
jb 0x180005ada
mov edx, ebx
mov rcx, r15
call fcn.180005d04
mov r8, qword [rbp - 0x31]
mov rdx, qword [rbp - 0x39]
mov rcx, r15
call fcn.1800060cc
mov rsi, rax
test rax, rax
je 0x180005ad5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r14 + 0x40]
mov r8d, ebx
mov rdi, rax
lea rax, [rbp + 0x7f]
mov rdx, r15
mov rcx, rdi
mov dword [rbp + 0x7f], r14d
mov dword [rbp + 0x77], r14d
mov qword [rsp + 0x20], rax
mov r12d, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x180005ab6
lea rax, [rbp + 0x77]
lea r9d, [r14 + 0x40]
lea r8d, [r14 + 0x78]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x180005a8b
lea r13, [rsi + 0x38]
test ebx, ebx
je 0x1800059d9
mov rdx, r15
mov r8, rsi
mov rcx, r13
sub rdx, r13
sub r8, r13
mov r9d, ebx
mov al, byte [rdx + rcx]
mov byte [rcx], al
mov byte [r8 + rcx + 0x58], al
inc rcx
dec r9
jne 0x1800059c7
lea rdx, [rbx + r15]
lea rcx, [rbx + r13]
call fcn.180006224
lea r8, [rbp - 0x39]
mov rdx, r15
mov rcx, r13
call fcn.180005cd0
mov rdx, qword [rbp - 0x41]
mov rcx, r15
sub rcx, rdx
mov rax, rdx
sub rax, r15
cmp rdx, r15
cmovb rax, rcx
cmp rax, 0x7fff0000
jbe 0x180005a43
lea rbx, [rsi + 0x18]
mov rcx, rbx
call fcn.180006224
mov rdx, rbx
mov rcx, rdi
sub rax, rsi
lea r8, [rax - 0x18]
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rdx, rbx
mov rcx, r15
call fcn.180006224
mov ebx, r12d
jmp 0x180005a4b
mov rcx, r15
call fcn.180006224
mov rax, qword [rbp - 0x41]
mov r8, r12
mov rdx, r13
mov rcx, rdi
mov dword [rsi + 8], ebx
mov qword [rsi], r15
mov qword [rsi + 0x10], rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov r9d, dword [rbp + 0x77]
lea rax, [rbp + 0x77]
mov r8d, 0x78
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r13, qword [rbp + 0x67]
mov r8, r12
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov r9d, dword [rbp + 0x7f]
lea rax, [rbp + 0x7f]
mov r8, r12
mov rdx, r15
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp qword [rsi], r14
je 0x180005ac5
lea rax, [rsi + 0x38]
mov qword [r13], rax
jmp 0x180005ad5
mov edx, 1
mov rcx, rsi
call fcn.180006048
mov rsi, r14
call fcn.180005ebc
lea rcx, [0x1800334e0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0xe8]
test rsi, rsi
setne r14b
mov eax, r14d
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180005d04
Capabilities:
Enumerate threads

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r15d, edx
mov r12, rcx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea edx, [rdi + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [rdi + 4]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x180005e7a
lea rdx, [rbp - 0x20]
mov rcx, rsi
mov dword [rbp - 0x20], 0x1c
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180005e71
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp - 0x14], eax
jne 0x180005da6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbp - 0x18], eax
je 0x180005da6
inc ebx
lea rdx, [rbp - 0x20]
mov rcx, rsi
mov dword [rbp - 0x20], 0x1c
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180005d8e
test ebx, ebx
je 0x180005e71
shl rbx, 3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x1800333d0], rax
test rax, rax
je 0x180005e71
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
lea rdx, [rbp - 0x20]
mov rcx, rsi
xor ebx, ebx
mov dword [rbp - 0x20], 0x1c
call qword [sym.imp.KERNEL32.dll_Thread32First]
jmp 0x180005e64
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp - 0x14], eax
jne 0x180005e50
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [rbp - 0x18]
cmp ecx, eax
je 0x180005e50
mov r8d, r15d
mov rdx, r12
call fcn.180005f74
mov rdx, rax
mov rax, qword [0x1800333d0]
mov qword [rax + rbx*8], rdx
lea rax, [rdx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180005e50
inc ebx
lea rdx, [rbp - 0x20]
mov rcx, rsi
mov dword [rbp - 0x20], 0x1c
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180005e13
mov dword [0x1800333d8], ebx
lea edi, [rax + 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test edi, edi
jne 0x180005e95
call fcn.180005ebc
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x78]
mov eax, edi
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x180005ebc
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor edi, edi
cmp dword [0x1800333d8], edi
jbe 0x180005f26
mov rcx, qword [0x1800333d0]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [0x1800333d0]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [0x1800333d8]
jb 0x180005efa
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [0x1800333d0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [0x1800333d0], 0
and dword [0x1800333d8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, esi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetThreadPriority]

Function at 0x180005f74
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x4f0
mov ebp, r8d
mov rsi, rdx
mov r8d, ecx
mov ecx, 0x1f03ff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180006026
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
cmp eax, 0xffffffff
je 0x18000601e
mov dword [rsp + 0x50], 0x100001
xor edi, edi
jmp 0x18000600a
cmp qword [rsp + 0x118], rsi
jb 0x180006026
lea rax, [rsi + rbp]
cmp qword [rsp + 0x118], rax
jae 0x180006026
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp edi, 3
jge 0x18000601b
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
inc edi
mov rcx, rbx
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x180005fcb
jmp 0x180006026
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
lea r11, [rsp + 0x4f0]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1800060cc
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x80
xor edi, edi
cmp dword [0x1800333c8], 0x20
jae 0x1800061fc
lea rbx, [rcx + rdx]
add rcx, r8
mov rbp, 0xfffffffffff80000
lea rax, [rcx + 0x7ff80000]
cmp rcx, 0xffffffff80000000
lea r8d, [rdi + 0x2c]
cmovb rbp, rax
and dword [rsp + 0x50], edi
lea rcx, [r11 - 0x34]
xor edx, edx
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, 0x80000000
lea rsi, [rbx - 0x7fff0000]
cmp rbx, rax
lea r14d, [rdi + 1]
cmovb rsi, r14
cmp rsi, rbp
jae 0x1800061fc
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800061cc
cmp dword [rsp + 0x40], 0x10000
jne 0x1800061ba
mov rax, qword [rsp + 0x38]
cmp rax, 0x78
jb 0x1800061bf
mov edx, dword [rsp + 0x78]
mov ecx, edx
cmp rax, rdx
jb 0x1800061bf
lea eax, [rdx - 1]
xor edx, edx
mov r8d, 0x3000
add rax, rsi
div rcx
mov edx, 0x78
lea r9d, [rdx - 0x58]
imul rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x1800061d1
mov rax, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x20]
add rsi, rax
cmp rsi, rbp
jb 0x180006155
test rdi, rdi
je 0x1800061fc
lea rdx, [0x1800333e0]
xor eax, eax
mov rcx, rdx
cmp qword [rcx], 0
je 0x1800061f1
add eax, r14d
add rcx, 8
cmp eax, 0x20
jb 0x1800061dd
jmp 0x1800061fc
add dword [0x1800333c8], r14d
mov qword [rdx + rax*8], rdi
lea r11, [rsp + 0x80]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret