joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000831a8
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get startup folder

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1000cc510]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x50], rdx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov word [rsp + 0x60], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call sub.msvcrt.dll_memset
mov qword [rsi + 0x20], 7
mov qword [rsi + 0x18], r12
lea rbx, [rsi + 8]
mov word [rbx], r12w
xor r8d, r8d
lea rdx, [0x1000a69fc]
mov rcx, rsi
call fcn.100013f9c
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [r12 + 0x1a]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, r12d
je 0x100083367
xor eax, eax
or r13, 0xffffffffffffffff
mov rcx, r13
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.100013f9c
lea rdx, str.Microsoft_
mov rcx, rsi
call fcn.1000184a0
mov r9, r13
xor r8d, r8d
lea rdx, [rbp + 0x28]
mov rcx, rsi
call fcn.100013a30
lea rdx, [0x1000ae8a8]
mov rcx, rsi
call fcn.1000184a0
cmp qword [rsi + 0x20], 8
jb 0x1000832b0
mov rcx, qword [rbx]
jmp 0x1000832b3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100083316
cmp qword [rsi + 0x20], 8
jb 0x1000832ca
mov rdx, qword [rbx]
jmp 0x1000832cd
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp eax, r12d
je 0x100083316
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r12w
mov r9, r13
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.100014140
nop
cmp qword [rsp + 0x48], 8
jb 0x100083367
mov rcx, qword [rsp + 0x30]
call fcn.100001218
jmp 0x100083367
cmp qword [rbp + 0x48], 8
jb 0x100083323
mov rdx, qword [rbp + 0x30]
jmp 0x100083327
lea rdx, [rbp + 0x30]
cmp qword [rsi + 0x20], 8
jb 0x100083331
mov rbx, qword [rbx]
lea r9, [rsp + 0x270]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor r8d, r8d
lea rdx, [0x1000a69fc]
mov rcx, rsi
call fcn.100013f9c
lea rdx, [rsp + 0x270]
mov rcx, rsi
call fcn.1000184a0
mov rax, rsi
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1000010a0
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x490
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x10008a7c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rbx, rcx
movzx ecx, word [rcx + 6]
mov ebp, 0x7ff
shr cx, 4
mov esi, edx
and cx, bp
cmp cx, bp
jne 0x10008a829
test byte [rbx + 6], 0xf
jne 0x10008a81a
xor edi, edi
cmp word [rbx + 4], di
jne 0x10008a81a
cmp word [rbx + 2], di
jne 0x10008a81a
cmp word [rbx], di
jne 0x10008a81a
lea r10d, [rdi + 1]
jmp 0x10008a820
mov r10d, 2
mov ax, r10w
jmp 0x10008aa47
xor edi, edi
cmp cx, di
jne 0x10008a844
mov rcx, rbx
call fcn.10008ae0c
cmp di, ax
mov cx, ax
jl 0x10008aa44
cmp esi, edi
jle 0x10008a87a
movsx eax, cx
sub ebp, eax
cmp ebp, esi
jg 0x10008a87a
movsd xmm0, qword [0x1000d2318]
mov ebp, 0x8000
test word [rbx + 6], bp
je 0x10008a86c
xorpd xmm0, xmmword [0x1000a9600]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x10008aa47
movsx edx, cx
mov eax, edx
neg eax
cmp eax, esi
jge 0x10008a8a1
add si, cx
mov eax, 0x800f
and word [rbx + 6], ax
shl si, 4
or word [rbx + 6], si
or eax, 0xffffffff
jmp 0x10008aa47
movzx ecx, word [rbx + 6]
lea r11d, [rsi + rdx - 1]
mov r14d, 0x10
movzx r12d, cx
and cx, 0xf
lea eax, [r11 + 0x35]
or cx, r14w
mov ebp, 0x8000
and r12w, bp
mov word [rbx + 6], cx
cmp eax, 0x34
ja 0x10008aa34
cmp r11w, 0xfff0
movzx esi, di
lea r10d, [r14 - 0xf]
jg 0x10008a947
movzx edx, word [rbx + 2]
movzx r8d, word [rbx]
mov eax, 0xfff0
sub ax, r11w
mov r13w, cx
movzx ecx, word [rbx + 4]
shr ax, 4
add ax, r10w
movzx r9d, ax
movzx eax, r9w
shl ax, 4
add r11w, ax
cmp si, di
mov eax, edi
setne al
mov si, ax
or si, r8w
sub r9, r10
mov r8w, dx
mov dx, cx
mov cx, r13w
mov r13d, edi
jne 0x10008a915
mov word [rbx + 6], di
mov word [rbx + 4], cx
mov word [rbx + 2], dx
mov word [rbx], r8w
neg r11w
je 0x10008a9d6
movzx r8d, word [rbx]
mov eax, edi
movsx r9d, r11w
sub r14d, r9d
movzx edx, r8w
mov ecx, r14d
shl dx, cl
cmp si, di
movzx ecx, r11w
setne al
shr r8w, cl
mov si, dx
movzx edx, word [rbx + 2]
or si, ax
mov ecx, r14d
movzx eax, dx
shl ax, cl
movzx ecx, r11w
or r8w, ax
shr dx, cl
mov ecx, r14d
mov word [rbx], r8w
movzx r8d, word [rbx + 4]
movzx eax, r8w
shl ax, cl
movzx ecx, r11w
or dx, ax
shr r8w, cl
mov ecx, r14d
mov word [rbx + 2], dx
movzx edx, word [rbx + 6]
movzx eax, dx
shl ax, cl
mov ecx, r9d
or r8w, ax
shr dx, cl
mov word [rbx + 6], dx
mov word [rbx + 4], r8w
or word [rbx + 6], r12w
movzx eax, word [rbx + 6]
cmp bp, si
jb 0x10008a9eb
jne 0x10008aa0c
test byte [rbx], r10b
je 0x10008aa0c
add word [rbx], r10w
jne 0x10008aa0c
add word [rbx + 2], r10w
jne 0x10008aa0c
add word [rbx + 4], r10w
jne 0x10008aa0c
add ax, r10w
mov word [rbx + 6], ax
jmp 0x10008a899
cmp ax, r12w
jne 0x10008a899
cmp word [rbx + 4], di
jne 0x10008a899
cmp word [rbx + 2], di
jne 0x10008a899
cmp word [rbx], di
je 0x10008aa44
jmp 0x10008a899
mov word [rbx + 6], r12w
mov word [rbx + 4], di
mov word [rbx + 2], di
mov word [rbx], di
mov ax, di
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x10008b060
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x10008b0cb
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x10008b0eb
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x1000ac928]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x180003370
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1800033a1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x18000341b
mov rdi, r14
mov rcx, rbx
call fcn.180004710
test rax, rax
jle 0x1800033f3
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.180032cc0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18000340b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180003413
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1800033b5
sub r14, rdi
jmp 0x1800034ff
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x180003432
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180003434
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180003466
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.180032cc0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1800034fc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800034a1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1800034dd
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.18001c9d0
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1800034fc
cmp rbp, rax
ja 0x1800034b0
test rbp, rbp
je 0x1800034fc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.18001c9d0
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180006650
Capabilities:
Hide thread from debugger

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x180041488]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtSetInformationThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180006696
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
mov rcx, rbx
call rax
test eax, eax
jne 0x180006692
mov al, 1
jmp 0x180006696
jmp 0x180006696
add rsp, 0x20
pop rbx
ret
Function at 0x18000c230
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x18000c270
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x18004c6c0]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x18000c2ae
cmp rsi, r14
jb 0x18000c2a6
cmp rsi, r15
jae 0x18000c2a6
cmp qword [rsi + 8], 0
jne 0x18000c477
mov rsi, qword [rsi]
test rsi, rsi
jne 0x18000c291
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x18000c342
nop dword [rax]
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x18000c339
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000c339
cmp dword [rsp + 0x70], 0x10000
je 0x18000c3bb
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x18000c339
sub rbx, rbp
cmp rbx, r14
jae 0x18000c300
test rsi, rsi
jne 0x18000c420
cmp rdi, r15
ja 0x18000c45f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18000c45f
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000c45f
cmp dword [rsp + 0x70], 0x10000
je 0x18000c3f1
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x18000c372
jmp 0x18000c45f
test rbx, rbx
je 0x18000c339
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18000c420
cmp rbx, r14
jae 0x18000c2e0
jmp 0x18000c342
test rdi, rdi
je 0x18000c45f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18000c420
cmp rdi, r15
jbe 0x18000c350
jmp 0x18000c45f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x18000c430
mov rax, qword [0x18004c6c0]
mov qword [rsi], rax
mov qword [0x18004c6c0], rsi
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x18000ce60
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov r14d, edx
xor edx, edx
mov qword [rcx], r15
mov rbx, rcx
mov qword [rcx + 8], r15
mov ebp, r8d
mov esi, r15d
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000d018
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18000cfa9
lea esi, [r15 + 1]
nop dword [rax + rax]
cmp dword [rsp + 0x20], 0x10
jb 0x18000cf63
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18000cf63
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x18000cf63
mov rdx, qword [rbx]
test rdx, rdx
jne 0x18000cf22
mov rcx, qword [0x18004c5c8]
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x18000cf8c
jmp 0x18000cf53
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x18000cf53
mov rcx, qword [0x18004c5c8]
add eax, eax
mov r9d, eax
mov r8, rdx
shl r9, 2
xor edx, edx
mov dword [rbx + 8], eax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x18000cf8c
mov qword [rbx], rax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
lea eax, [rcx + 1]
mov dword [rbx + 0xc], eax
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x18000ced0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x18000cfa9
mov r8, qword [rbx]
mov esi, r15d
test r8, r8
je 0x18000cfa9
mov rcx, qword [0x18004c5c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x18000d018
cmp qword [rbx], r15
je 0x18000d013
mov edi, r15d
cmp dword [rbx + 0xc], r15d
jbe 0x18000d013
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx]
xor edx, edx
mov eax, edi
lea ecx, [rdx + 0x5a]
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18000d00c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.18000ccd0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x18000cfd0
mov eax, r15d
jmp 0x18000d01d
mov eax, 9
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18000d040
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x30]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x18004c6b0]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18000d0a4
mov eax, 0xa
jmp 0x18000d137
test esi, esi
je 0x18000d0c6
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18000d0e9
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18000d0e9
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x18000d0e2
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18000d0e9
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18000d150
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov edx, dword [0x18004c6bc]
xor ebx, ebx
test edx, edx
je 0x18000d17f
mov rcx, qword [0x18004c6b0]
add rcx, 0x20
nop dword [rax]
test byte [rcx], 2
je 0x18000d187
inc ebx
add rcx, 0x38
cmp ebx, edx
jb 0x18000d170
xor eax, eax
add rsp, 0x30
pop rbx
ret
cmp ebx, 0xffffffff
je 0x18000d17f
mov edx, 0xffffffff
mov qword [rsp + 0x50], rdi
mov r8d, 1
lea rcx, [rsp + 0x20]
call fcn.18000ce60
mov edi, eax
test eax, eax
jne 0x18000d272
mov r8d, dword [0x18004c6bc]
cmp ebx, r8d
jae 0x18000d1f4
nop dword [rax]
mov ecx, ebx
imul rdx, rcx, 0x38
mov rcx, qword [0x18004c6b0]
test byte [rdx + rcx + 0x20], 2
jne 0x18000d1ed
mov edx, 1
mov ecx, ebx
call fcn.18000d040
mov edi, eax
test eax, eax
jne 0x18000d1f4
mov r8d, dword [0x18004c6bc]
inc ebx
cmp ebx, r8d
jb 0x18000d1c0
cmp qword [rsp + 0x20], 0
je 0x18000d270
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18000d25c
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
mov qword [rsp + 0x48], rsi
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18000d248
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x18000d220
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18004c5c8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
Function at 0x18000d560
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov rdi, qword [0x18004c5f8]
xor r12d, r12d
mov r14d, r12d
mov ebx, r12d
xor eax, eax
mov esi, 1
lock cmpxchg dword [0x18004c448], esi
je 0x18000d5b5
cmp rbx, 0x20
jae 0x18000d59e
xor ecx, ecx
jmp 0x18000d5a0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x18004c448], esi
jne 0x18000d594
cmp qword [0x18004c5c8], r12
mov qword [rsp + 0x58], r13
je 0x18000d748
mov ecx, dword [0x18004c6bc]
mov ebx, r12d
test ecx, ecx
je 0x18000d5ef
mov rdx, qword [0x18004c6b0]
mov rax, rdx
nop
cmp rdi, qword [rax]
je 0x18000d5fa
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18000d5e0
mov r14d, 4
jmp 0x18000d74e
cmp ebx, 0xffffffff
je 0x18000d5ef
mov eax, ebx
imul r13, rax, 0x38
test byte [rdx + r13 + 0x20], 2
je 0x18000d6ad
xor r8d, r8d
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.18000ce60
mov r14d, eax
test eax, eax
jne 0x18000d74e
xor edx, edx
mov ecx, ebx
call fcn.18000d040
mov r14d, eax
cmp qword [rsp + 0x20], r12
je 0x18000d69d
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18000d689
mov rdi, qword [rsp + 0x20]
mov qword [rsp + 0x50], rbp
mov ebp, eax
mov r8d, dword [rdi]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18000d67a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
sub rbp, 1
jne 0x18000d652
mov rbp, qword [rsp + 0x50]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18004c5c8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14d, r14d
jne 0x18000d74e
mov rdx, qword [0x18004c6b0]
mov rcx, qword [rdx + r13 + 0x10]
call fcn.18000c490
mov edx, dword [0x18004c6bc]
dec edx
cmp ebx, edx
jae 0x18000d6fc
mov eax, edx
imul rcx, rax, 0x38
mov rax, qword [0x18004c6b0]
movups xmm0, xmmword [rcx + rax]
movups xmmword [rax + r13], xmm0
movups xmm1, xmmword [rcx + rax + 0x10]
movups xmmword [rax + r13 + 0x10], xmm1
movups xmm0, xmmword [rcx + rax + 0x20]
movups xmmword [rax + r13 + 0x20], xmm0
movsd xmm1, qword [rcx + rax + 0x30]
movsd qword [rax + r13 + 0x30], xmm1
mov ecx, dword [0x18004c6b8]
mov eax, ecx
mov dword [0x18004c6bc], edx
shr eax, 1
cmp eax, 0x20
jb 0x18000d74e
cmp eax, edx
jb 0x18000d74e
mov r8, qword [0x18004c6b0]
mov eax, ecx
mov rcx, qword [0x18004c5c8]
xor edx, edx
shr rax, 1
imul r9, rax, 0x38
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x18000d74e
shr dword [0x18004c6b8], 1
mov qword [0x18004c6b0], rax
jmp 0x18000d74e
mov r14d, 2
xchg dword [0x18004c448], r12d
mov r13, qword [rsp + 0x58]
mov eax, r14d
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
Function at 0x18000d780
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov rdi, rcx
mov ebx, r15d
xor eax, eax
mov esi, 1
lock cmpxchg dword [0x18004c448], esi
je 0x18000d7d5
cmp rbx, 0x20
jae 0x18000d7be
xor ecx, ecx
jmp 0x18000d7c0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x18004c448], esi
jne 0x18000d7b4
cmp qword [0x18004c5c8], r15
je 0x18000d8c1
test rdi, rdi
jne 0x18000d7f3
call fcn.18000d150
mov ebp, eax
jmp 0x18000d8c6
mov ecx, dword [0x18004c6bc]
mov ebx, r15d
test ecx, ecx
je 0x18000d81f
mov rdx, qword [0x18004c6b0]
mov rax, rdx
nop word [rax + rax]
cmp rdi, qword [rax]
je 0x18000d829
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18000d810
mov ebp, 4
jmp 0x18000d8c6
cmp ebx, 0xffffffff
je 0x18000d81f
mov eax, ebx
imul r8, rax, 0x38
test byte [r8 + rdx + 0x20], 2
jne 0x18000d8ba
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.18000ce60
mov ebp, eax
test eax, eax
jne 0x18000d8c6
mov edx, esi
mov ecx, ebx
call fcn.18000d040
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x18000d8c6
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18000d8a4
mov rbx, qword [rsp + 0x20]
mov esi, eax
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18000d89a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x18000d872
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18004c5c8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000d8c6
mov ebp, 5
jmp 0x18000d8c6
mov ebp, 2
xchg dword [0x18004c448], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret