joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18012e9b0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [0x18020e330], 0
je 0x18012e9cf
mov al, 1
jmp 0x18012ea77
cmp qword [rsp + 0x58], 0
jne 0x18012e9de
xor al, al
jmp 0x18012ea77
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
sub rax, 0x10000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0
jmp 0x18012ea25
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x2800
jge 0x18012ea75
imul eax, dword [rsp + 0x20], 0x10000
cdqe
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x18020e330], rax
cmp qword [0x18020e330], 0
je 0x18012ea73
mov al, 1
jmp 0x18012ea77
jmp 0x18012ea1b
xor al, al
add rsp, 0x48
ret
Function at 0x180133d80
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x108
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov byte [rsp + 0x30], 0
mov dword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
mov r8d, 0x40
mov rdx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180133ec3
call fcn.1800bbb60
mov qword [rsp + 0x48], rax
mov edx, 2
mov rcx, qword [rsp + 0x48]
call fcn.1800bc4a0
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jbe 0x180133ebe
lea rcx, [rsp + 0x90]
call fcn.180003c60
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x5c], eax
mov r8d, dword [rsp + 0x5c]
lea rdx, [0x1801992e0]
lea rcx, [rsp + 0x90]
call fcn.1800bc9a0
mov dword [rsp + 0x28], 0x52d
lea rax, str.RC::RCSearchEngineLock::ModifyPageMemory
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safewebmon_src_rcsearchenginelock.cpp
lea r8, [rsp + 0x90]
mov edx, 2
mov rcx, qword [rsp + 0x48]
call fcn.1800bc500
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x48]
call fcn.180082c70
cmp dword [rsp + 0x34], 1
jbe 0x180133ea3
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x48]
call fcn.1800bc860
nop
lea rcx, [rsp + 0x90]
call fcn.180003f40
nop
lea rax, [rsp + 0x90]
mov qword [rsp + 0x78], rax
jmp 0x180133fea
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x130]
mov r8, qword [rsp + 0x128]
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x180133fdb
call fcn.1800bbb60
mov qword [rsp + 0x50], rax
mov edx, 2
mov rcx, qword [rsp + 0x50]
call fcn.1800bc4a0
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jbe 0x180133fd9
lea rcx, [rsp + 0xb0]
call fcn.180003c60
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
mov r8d, dword [rsp + 0x60]
lea rdx, [0x1801993d8]
lea rcx, [rsp + 0xb0]
call fcn.1800bc9a0
mov dword [rsp + 0x28], 0x534
lea rax, str.RC::RCSearchEngineLock::ModifyPageMemory
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safewebmon_src_rcsearchenginelock.cpp
lea r8, [rsp + 0xb0]
mov edx, 2
mov rcx, qword [rsp + 0x50]
call fcn.1800bc500
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x50]
call fcn.180082c70
cmp dword [rsp + 0x38], 1
jbe 0x180133fbb
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x50]
call fcn.1800bc860
nop
lea rcx, [rsp + 0xb0]
call fcn.180003f40
nop
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x80], rax
jmp 0x180133fea
mov byte [rsp + 0x30], 1
xor eax, eax
test eax, eax
jne 0x180133dbb
jmp 0x180133fec
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1800d8050
add rsp, 0x108
ret
Function at 0x180134010
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0x30], 0
mov dword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
mov r8d, 0x40
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1801340b2
mov rdi, qword [rsp + 0xe8]
xor eax, eax
mov rcx, qword [rsp + 0xf8]
rep stosb byte [rdi], al
mov rdi, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xf8]
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x30], 1
jmp 0x18013416f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x54], eax
call fcn.1800bbb60
mov qword [rsp + 0x48], rax
mov edx, 2
mov rcx, qword [rsp + 0x48]
call fcn.1800bc4a0
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jbe 0x18013416f
lea rcx, [rsp + 0x70]
call fcn.180003c60
nop
mov r8d, dword [rsp + 0x54]
lea rdx, [0x1801992e0]
lea rcx, [rsp + 0x70]
call fcn.1800bc9a0
mov dword [rsp + 0x28], 0x517
lea rax, str.RC::RCSearchEngineLock::ModifyMemory
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safewebmon_src_rcsearchenginelock.cpp
lea r8, [rsp + 0x70]
mov edx, 2
mov rcx, qword [rsp + 0x48]
call fcn.1800bc500
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call fcn.180082c70
cmp dword [rsp + 0x34], 1
jbe 0x18013415a
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call fcn.1800bc860
nop
lea rcx, [rsp + 0x70]
call fcn.180003f40
nop
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
jmp 0x180134171
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800d8050
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x18013f710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0xffffffff
mov qword [rsp + 0x30], 5
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x40], 0x48
mov byte [rsp + 0x41], 0x89
mov byte [rsp + 0x42], 0x5c
mov byte [rsp + 0x43], 0x24
mov byte [rsp + 0x44], 8
mov byte [rsp + 0x45], 0x48
mov byte [rsp + 0x46], 0xb8
mov byte [rsp + 0x47], 0x88
mov byte [rsp + 0x48], 0x77
mov byte [rsp + 0x49], 0x66
mov byte [rsp + 0x4a], 0x55
mov byte [rsp + 0x4b], 0x44
mov byte [rsp + 0x4c], 0x33
mov byte [rsp + 0x4d], 0x22
mov byte [rsp + 0x4e], 0x11
mov byte [rsp + 0x4f], 0xff
mov byte [rsp + 0x50], 0xe0
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
mov r8d, 0x40
mov edx, 0x11
lea rcx, [rsp + 0x40]
call fcn.18013ff20
test eax, eax
je 0x18013f83e
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax]
cmp eax, 0xe9
jne 0x18013f81a
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x47], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call qword [rsp + 0x38]
mov dword [rsp + 0x20], eax
jmp 0x18013f83e
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call qword [rax + 0x28]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800d8050
add rsp, 0x68
ret
Function at 0x180140ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x180140b0f
jmp 0x180140cf2
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x48]
cmp dword [rcx + rax + 0x88], 0
jne 0x180140b45
jmp 0x180140cf2
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0
je 0x180140cf2
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cdqe
mov r8, rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
call fcn.18010d920
test eax, eax
jne 0x180140cdf
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
add rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x10]
add rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
cmp qword [rax], 0
je 0x180140cdf
mov rax, qword [rsp + 0x28]
movabs rcx, 0x8000000000000000
mov rax, qword [rax]
and rax, rcx
test rax, rax
jne 0x180140c73
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
add rax, 2
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call fcn.180101844
test eax, eax
jne 0x180140c71
mov dword [rsp + 0x40], 0
mov rax, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov r8d, 0x40
mov edx, 8
mov rcx, rax
call fcn.18013ff20
test eax, eax
je 0x180140c71
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x88]
mov qword [rax], rcx
jmp 0x180140cbe
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
cmp qword [rax], rcx
jne 0x180140cbe
mov dword [rsp + 0x44], 0
mov rax, qword [rsp + 0x30]
lea r9, [rsp + 0x44]
mov r8d, 0x40
mov edx, 8
mov rcx, rax
call fcn.18013ff20
test eax, eax
je 0x180140cbe
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x88]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x30], rax
jmp 0x180140bda
mov rax, qword [rsp + 0x38]
add rax, 0x14
mov qword [rsp + 0x38], rax
jmp 0x180140b6a
add rsp, 0x68
ret
Function at 0x180144ae0
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2f0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x68]
call fcn.180003c60
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x30], eax
mov ecx, dword [rsp + 0x30]
call fcn.1800269d0
mov dword [rsp + 0x34], eax
mov r8d, dword [rsp + 0x34]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180144c1e
lea rax, [rsp + 0xd0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x180144c0a
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x88]
call fcn.180003bb0
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xa8]
call fcn.1800998d0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.180005c40
nop
lea rcx, [rsp + 0xa8]
call fcn.180003f40
nop
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x88]
call fcn.180003f40
nop
lea rax, [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x300]
call fcn.180005630
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x68]
call fcn.180003f40
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x300]
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1800d8050
add rsp, 0x2f0
pop rdi
ret
Function at 0x180144fa0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x180208090]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x48]
call fcn.180144ae0
nop
lea rdx, [0x180197af8]
lea rcx, [rsp + 0x48]
call fcn.18008d780
movzx eax, al
test eax, eax
je 0x18014500a
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.180144c80
movzx eax, al
test eax, eax
jne 0x18014500a
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x180145065
lea rcx, str.chrome.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180145053
call fcn.18013c050
mov rdx, qword [rsp + 0x28]
mov rcx, rax
call fcn.18013a220
call fcn.180131970
mov rdx, qword [rsp + 0x28]
mov rcx, rax
call fcn.1801311c0
jmp 0x180145058
call fcn.18013e3e0
call fcn.18013c050
mov rcx, rax
call fcn.18013a7b0
call fcn.18013c050
mov rcx, rax
call fcn.18013aeb0
movzx eax, al
test eax, eax
jne 0x180145086
mov rcx, qword [rsp + 0x80]
call fcn.180144950
mov byte [rsp + 0x21], 1
lea rcx, [rsp + 0x48]
call fcn.180003f40
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
movzx eax, byte [rsp + 0x21]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800d8050
add rsp, 0x78
ret
Function at 0x1801470b0
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov qword [rsp + 0x48], 0xffffffffffffffff
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x18014716f
jmp 0x180147306
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x50], 0
jne 0x18014719b
mov eax, dword [rsp + 0x54]
cmp rax, 0x148
ja 0x18014719b
jmp 0x180147306
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x1801471d4
jmp 0x180147306
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x180147205
jmp 0x180147306
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180147223
jmp 0x180147306
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
add rax, 0x88
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x40]
mov eax, dword [rdx + rax]
mov dword [rcx], eax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x40]
mov eax, dword [rdx + rax + 4]
mov dword [rcx + 4], eax
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0x40]
mov eax, dword [rdx + rax]
mov dword [rcx], eax
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0x40]
mov eax, dword [rdx + rax + 4]
mov dword [rcx + 4], eax
mov eax, 8
imul rax, rax, 0xb
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0x40]
mov eax, dword [rdx + rax]
mov dword [rcx], eax
mov eax, 8
imul rax, rax, 0xb
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0x40]
mov eax, dword [rdx + rax + 4]
mov dword [rcx + 4], eax
mov dword [rsp + 0x58], 1
xor eax, eax
test eax, eax
jne 0x180147128
cmp qword [rsp + 0x60], 0
je 0x180147319
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp qword [rsp + 0x68], 0
je 0x18014732c
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x48], 0xffffffffffffffff
je 0x18014733f
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x58]
add rsp, 0x98
ret
Function at 0x180147920
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x88]
call fcn.1801474f0
nop
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jbe 0x180147b38
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1801479c4
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0x88]
call fcn.180003f40
nop
lea rax, [rsp + 0x88]
mov qword [rsp + 0xb0], rax
movzx eax, byte [rsp + 0x21]
jmp 0x180147b64
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x18], 0
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call fcn.180009710
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.180147350
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180147b38
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.180147720
movzx eax, al
test eax, eax
je 0x180147b1e
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x100]
sub rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.180147650
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180147b1e
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov r8, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x100]
mov rcx, rax
call fcn.1800f7a50
test eax, eax
je 0x180147b1e
mov dword [rsp + 0x38], 0
lea r9, [rsp + 0x38]
mov r8d, 0x40
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180147b1e
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rdi, qword [rsp + 0x100]
mov rsi, rax
mov rcx, qword [rsp + 0x108]
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x20], 1
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
call fcn.1800d80b0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x22], al
lea rcx, [rsp + 0x88]
call fcn.180003f40
nop
lea rax, [rsp + 0x88]
mov qword [rsp + 0xb8], rax
movzx eax, byte [rsp + 0x22]
add rsp, 0xe8
pop rdi
pop rsi
ret
Function at 0x180147c80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x48
mov byte [rsp + 0x20], 0
mov rax, qword [rsp + 0x60]
mov edx, 1
mov rcx, rax
call fcn.1800219a0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180147e5a
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 0x30]
test eax, eax
jne 0x180147daa
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
call qword [rax]
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x28], rcx
movzx eax, byte [rsp + 0x78]
test eax, eax
je 0x180147d2a
mov edx, 0x14
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x18]
call fcn.180147920
mov rax, qword [rsp + 0x60]
add rax, 8
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rcx
mov rdx, rax
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov dl, 1
mov rcx, qword [rsp + 0x28]
call qword [rax + 0x18]
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x180147da5
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0x60]
lea rdi, [rcx + 0x38]
mov rsi, rax
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x60]
mov byte [rax + 0x30], 1
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x20]
mov qword [rax], rcx
jmp 0x180147e41
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
cmp qword [rax + 0x18], rcx
jne 0x180147e41
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
cmp qword [rax + 0x28], rcx
jne 0x180147e41
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
mov r8d, 0x40
mov edx, 5
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180147e41
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x18]
movzx eax, byte [rax]
cmp eax, 0xe9
jne 0x180147e41
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x20]
mov qword [rax], rcx
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0x60]
mov rdi, rax
lea rsi, [rcx + 0x38]
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x20], 1
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 8
mov rcx, qword [rsp + 0x38]
call fcn.1800d80b0
movzx eax, byte [rsp + 0x20]
add rsp, 0x48
pop rdi
pop rsi
ret