joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400015a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rcx + 2]
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], rbp
nop word [rax + rax]
movzx r9d, byte [rbp - 1]
movzx edx, byte [rbp - 2]
movzx ebx, r9b
movzx r8d, byte [rbp]
movzx eax, dl
shr al, 7
movzx r10d, r8b
movzx eax, al
add r10b, r10b
imul eax, eax, 0x1b
add bl, bl
movzx ecx, byte [rbp + 1]
mov byte [rsp], dl
add dl, dl
mov byte [rsp + 0x80], r9b
mov byte [rsp + 0x88], r8b
xor dl, al
mov dword [rsp + 8], eax
movzx eax, dl
movzx esi, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
movzx eax, r9b
shr al, 7
movzx eax, al
imul r14d, eax, 0x1b
xor bl, r14b
movzx eax, bl
movzx r9d, bl
shr al, 7
add r9b, r9b
movzx eax, al
imul eax, eax, 0x1b
xor r9b, al
mov dword [rsp + 0xc], eax
movzx eax, r8b
shr al, 7
movzx eax, al
imul r12d, eax, 0x1b
xor r10b, r12b
movzx eax, r10b
movzx r8d, r10b
shr al, 7
xor r10b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
movzx eax, cl
shr al, 7
add cl, cl
movzx eax, al
imul r13d, eax, 0x1b
xor r8b, bpl
xor cl, r13b
mov dword [rsp + 0x10], r13d
movzx eax, cl
shr al, 7
movzx eax, al
imul r15d, eax, 0x1b
movzx eax, cl
add al, al
xor al, r15b
xor r10b, al
mov byte [rsp + 0x78], al
shr al, 7
xor r10b, r8b
movzx eax, al
xor r10b, r9b
imul edi, eax, 0x1b
xor r10b, sil
movzx eax, r8b
mov byte [rsp + 1], r10b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
movzx eax, r9b
shr al, 7
movzx eax, al
imul r10d, eax, 0x1b
movzx eax, sil
xor byte [rsp + 0x78], cl
shr al, 7
movzx eax, al
imul edx, eax, 0x1b
mov r13, qword [rsp + 0x18]
movzx eax, byte [rsp + 1]
xor al, byte [rsp + 0x80]
xor al, byte [rsp]
add al, al
movzx ecx, byte [rsp + 0x78]
xor al, dl
xor cl, r8b
xor al, r10b
mov r8d, dword [rsp + 0xc]
xor al, r11b
xor cl, r9b
xor al, dil
movzx r9d, byte [r13 + 1]
xor al, bpl
xor cl, bl
xor al, r14b
movzx ebx, byte [rsp + 0x88]
xor al, byte [rsp + 4]
xor cl, sil
xor al, byte [rsp + 8]
xor al, byte [r13 + 1]
xor al, byte [rsp + 0x88]
xor al, byte [rsp + 0x80]
movzx esi, byte [rsp + 0x80]
mov byte [r13 - 2], al
movzx eax, cl
xor al, bl
xor cl, r9b
xor al, sil
add al, al
xor al, dl
xor al, r10b
xor al, r11b
xor al, dil
xor al, r15b
xor al, r12b
xor al, r8b
xor al, r14b
mov r14, r13
movzx r14d, byte [rsp]
xor al, r9b
xor al, bl
xor cl, r14b
xor al, r14b
add cl, cl
mov byte [r13 - 1], al
xor cl, dl
mov r13d, dword [rsp + 0x10]
xor cl, r10b
movzx eax, byte [rsp + 1]
xor cl, r11b
xor al, r9b
xor cl, dil
xor al, bl
xor cl, r15b
add al, al
xor cl, r13b
xor al, dl
xor cl, r8b
xor cl, byte [rsp + 8]
xor al, r10b
xor al, r11b
xor al, dil
xor al, r13b
xor al, bpl
mov rbp, qword [rsp + 0x18]
xor al, r12b
xor al, byte [rsp + 4]
xor al, r9b
xor al, sil
xor al, r14b
mov byte [rbp], al
xor cl, bl
xor cl, sil
xor cl, r14b
mov byte [rbp + 1], cl
add rbp, 4
sub qword [rsp + 0x20], 1
mov qword [rsp + 0x18], rbp
jne 0x1400015d0
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002598
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400025e2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400025e2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400025e2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400025e2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400025e2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400025e4
xor al, al
add rsp, 0x28
ret
Function at 0x14001121c
Capabilities:
Terminate process

Disassembly:
jmp 0x1400143e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112c1
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015730
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015750
xor al, al
jmp 0x1400157d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015763
xor al, al
jmp 0x1400157d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001578d
xor al, al
jmp 0x1400157d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400157a1
xor al, al
jmp 0x1400157d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400157b3
xor al, al
jmp 0x1400157d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400157cf
xor al, al
jmp 0x1400157d1
mov al, 1
add rsp, 0x38
ret
Function at 0x180001170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1800011e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1800011e8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1800011d5
nop
cmp rbx, rcx
jae 0x1800011e8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1800011c0
cmp rbx, rcx
jae 0x1800011e8
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x1800011ea
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180001200
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x180093010]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rcx, qword [0x180094838]
test rcx, rcx
jne 0x18000125e
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180001283
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180094838], rax
jmp 0x180001267
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rbx, rax
test rbx, rbx
je 0x180001283
xor edx, edx
lea rcx, [0x180082050]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x1800012ed
mov edx, 0x105
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [rax - 1]
cmp ecx, 0x103
ja 0x1800012eb
dec eax
cmp word [rsp + rax*2 + 0x20], 0x5c
je 0x1800012c3
lea r8, [0x18008204c]
mov edx, 0x105
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
test eax, eax
jne 0x1800012eb
lea r8, [0x180082050]
mov edx, 0x105
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
test eax, eax
jne 0x1800012eb
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1800012ed
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800250a0
add rsp, 0x240
pop rbx
ret
Function at 0x180004630
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, [0x1800821f8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rcx, str.kernel32.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtOpenFile
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
xor edx, edx
call fcn.18001b5a0
lea rdx, str.NtClose
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
xor edx, edx
call fcn.18001b5a0
lea rdx, str.NtCreateSection
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
xor edx, edx
call fcn.18001b5a0
lea rdx, str.NtQueryAttributesFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
xor edx, edx
call fcn.18001b5a0
lea rdx, [0x180082250]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
xor edx, edx
call fcn.18001b5a0
lea rdx, [0x180082260]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
xor edx, edx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18001b5a0

Function at 0x180006a10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180093010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180006ae3
cmp byte [rcx + 0x71], 0
je 0x180006ae3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x180006adf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180006aa4
sub eax, 1
je 0x180006aa8
cmp eax, 2
jne 0x180006adf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800250a0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180006ad6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180006adf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180006a8c
xor al, al
jmp 0x180006a8c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800250a0
add rsp, 0x60
pop rbx
ret
Function at 0x180009120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov esi, edx
mov r14, rcx
xor edx, edx
lea rcx, [0x180093de0]
call fcn.180025008
mov r15d, 1
mov rdi, rax
mov ebx, r15d
test rax, rax
je 0x1800091b3
mov ebp, esi
shr ebp, 4
lea eax, [rbp + 1]
movzx r12d, ax
nop
xor r9d, r9d
mov r8, r12
mov rcx, rdi
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x18000919b
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call fcn.180001170
test rax, rax
jne 0x1800091d4
mov edx, ebx
lea rcx, [0x180093de0]
inc ebx
call fcn.180025008
mov rdi, rax
test rax, rax
jne 0x180009170
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
test rdi, rdi
je 0x1800091b3
inc bp
mov r8d, 6
movzx edx, bp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x1800092cb
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1800092cb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1800092cb
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and esi, 0xf
jbe 0x180009259
nop word [rax + rax]
cmp rbx, rcx
jae 0x1800092cb
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add esi, 0xffffffff
jne 0x180009240
cmp rbx, rcx
jae 0x1800092cb
cmp word [rbx], 0
je 0x1800092cb
mov rax, qword [r14]
mov edx, r15d
movzx edi, word [rbx]
mov ecx, dword [rax - 0xc]
sub edx, dword [rax - 8]
sub ecx, edi
or edx, ecx
jge 0x180009283
mov edx, edi
mov rcx, r14
call fcn.180007090
movzx r9d, word [rbx]
lea r8, [rbx + 2]
mov rcx, qword [r14]
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wmemcpy_s]
test eax, eax
je 0x1800092af
cmp eax, 0xc
je 0x1800092ed
cmp eax, 0x16
je 0x1800092d7
cmp eax, 0x22
je 0x1800092d7
cmp eax, 0x50
jne 0x1800092e2
mov rax, qword [r14]
cmp edi, dword [rax - 0xc]
jg 0x1800092d7
mov dword [rax - 0x10], edi
xor ecx, ecx
mov rax, qword [r14]
mov word [rax + rdi*2], cx
mov eax, r15d
jmp 0x1800091b5
xor ecx, ecx
mov r15d, ecx
mov eax, ecx
jmp 0x1800091b5
mov ecx, 0x80070057
call fcn.180001110
int3
mov ecx, 0x80004005
call fcn.180001110
int3
mov ecx, 0x8007000e
call fcn.180001110
int3
Function at 0x180011aa0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x50], 0
lea r8, [rcx + 0x50]
mov rdx, rcx
mov rax, rcx
jne 0x180011b47
xor r10d, r10d
cmp rcx, r8
ja 0x180011b20
lea r9, [rcx + 0x52]
movsx ecx, word [rcx + 0x52]
movd xmm1, ecx
lea rcx, [rax + 0x4e]
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
cmp rax, r9
ja 0x180011adf
cmp rcx, r9
jae 0x180011b20
nop
movdqu xmm0, xmmword [rax]
add r10, 0x20
xorps xmm0, xmm1
movdqu xmmword [rax], xmm0
movdqu xmm0, xmmword [rax + 0x10]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [rax + 0x20]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x20], xmm0
movdqu xmm0, xmmword [rax + 0x30]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x30], xmm0
add rax, 0x40
cmp r10, 0x20
jne 0x180011ae0
cmp rax, r8
je 0x180011b40
nop word [rax + rax]
movzx ecx, word [rdx + 0x52]
xor word [rax], cx
add rax, 2
cmp rax, r8
jne 0x180011b30
mov byte [r8], 1
mov rax, rdx
ret

Function at 0x180011b50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
lea r8, [rcx + 0x58]
mov rdx, rcx
mov rax, rcx
jne 0x180011bf7
xor r10d, r10d
cmp rcx, r8
ja 0x180011bd0
lea r9, [rcx + 0x5a]
movsx ecx, word [rcx + 0x5a]
movd xmm1, ecx
lea rcx, [rax + 0x56]
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
cmp rax, r9
ja 0x180011b8f
cmp rcx, r9
jae 0x180011bd0
nop
movdqu xmm0, xmmword [rax]
add r10, 0x20
xorps xmm0, xmm1
movdqu xmmword [rax], xmm0
movdqu xmm0, xmmword [rax + 0x10]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [rax + 0x20]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x20], xmm0
movdqu xmm0, xmmword [rax + 0x30]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x30], xmm0
add rax, 0x40
cmp r10, 0x20
jne 0x180011b90
cmp rax, r8
je 0x180011bf0
nop word [rax + rax]
movzx ecx, word [rdx + 0x5a]
xor word [rax], cx
add rax, 2
cmp rax, r8
jne 0x180011be0
mov byte [r8], 1
mov rax, rdx
ret

Function at 0x180011c70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
lea r8, [rcx + 0x4a]
mov rdx, rcx
mov rax, rcx
jne 0x180011d17
xor r10d, r10d
cmp rcx, r8
ja 0x180011cf0
lea r9, [rcx + 0x4c]
movsx ecx, word [rcx + 0x4c]
movd xmm1, ecx
lea rcx, [rax + 0x48]
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
cmp rax, r9
ja 0x180011caf
cmp rcx, r9
jae 0x180011cf0
nop
movdqu xmm0, xmmword [rax]
add r10, 0x20
xorps xmm0, xmm1
movdqu xmmword [rax], xmm0
movdqu xmm0, xmmword [rax + 0x10]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [rax + 0x20]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x20], xmm0
movdqu xmm0, xmmword [rax + 0x30]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x30], xmm0
add rax, 0x40
cmp r10, 0x20
jne 0x180011cb0
cmp rax, r8
je 0x180011d10
nop word [rax + rax]
movzx ecx, word [rdx + 0x4c]
xor word [rax], cx
add rax, 2
cmp rax, r8
jne 0x180011d00
mov byte [r8], 1
mov rax, rdx
ret

Function at 0x180011d20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3a], 0
lea r8, [rcx + 0x3a]
mov rdx, rcx
mov rax, rcx
jne 0x180011d57
cmp rcx, r8
je 0x180011d50
nop word [rax + rax]
movzx ecx, word [rdx + 0x3c]
xor word [rax], cx
add rax, 2
cmp rax, r8
jne 0x180011d40
mov byte [r8], 1
mov rax, rdx
ret
Function at 0x18001a0e0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x180093010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp rdi, 0x40000000
jbe 0x18001a12f
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x180094970]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x18001a16d
cmp rsi, r14
jb 0x18001a165
cmp rsi, r15
jae 0x18001a165
cmp qword [rsi + 8], 0
jne 0x18001a337
mov rsi, qword [rsi]
test rsi, rsi
jne 0x18001a150
mov qword [rsp + 0xc8], rbx
mov rbx, rdi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x90], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x18001a202
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x18001a1f9
nop word [rax + rax]
mov r8d, Ordinal_50
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18001a1f9
cmp dword [rsp + 0x40], 0x10000
je 0x18001a27b
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x18001a1f9
sub rbx, rbp
cmp rbx, r14
jae 0x18001a1c0
test rsi, rsi
jne 0x18001a2e0
cmp rdi, r15
ja 0x18001a31f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18001a31f
mov r8d, Ordinal_50
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18001a31f
cmp dword [rsp + 0x40], 0x10000
je 0x18001a2b1
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x18001a232
jmp 0x18001a31f
test rbx, rbx
je 0x18001a1f9
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18001a2e0
cmp rbx, r14
jae 0x18001a1a0
jmp 0x18001a202
test rdi, rdi
je 0x18001a31f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18001a2e0
cmp rdi, r15
jbe 0x18001a210
jmp 0x18001a31f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x18001a2f0
mov rax, qword [0x180094970]
mov qword [rsi], rax
mov qword [0x180094970], rsi
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800250a0
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
ret
Function at 0x18001ad50
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180093010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
xor esi, esi
xor edx, edx
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18001ae9f
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_32
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18001ae96
mov esi, 1
mov qword [rsp + 0x68], rbx
cmp dword [rsp + 0x20], 0x10
jb 0x18001ae4c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18001ae4c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x18001ae4c
mov rdx, qword [rdi]
test rdx, rdx
jne 0x18001ae0d
mov rcx, qword [0x1800947c8]
mov r8d, 0x200
mov dword [rdi + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
mov rdx, rax
test rax, rax
je 0x18001ae75
lea rbx, [rdi + 0xc]
jmp 0x18001ae41
mov eax, dword [rdi + 8]
lea rbx, [rdi + 0xc]
cmp dword [rbx], eax
jb 0x18001ae41
mov rcx, qword [0x1800947c8]
add eax, eax
mov r9d, eax
mov r8, rdx
shl r9, 2
xor edx, edx
mov dword [rdi + 8], eax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x18001ae75
mov qword [rdi], rax
mov ecx, dword [rbx]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_32
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x18001adb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x18001ae91
mov r8, qword [rdi]
xor esi, esi
test r8, r8
je 0x18001ae91
mov rcx, qword [0x1800947c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], rsi
mov rbx, qword [rsp + 0x68]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800250a0
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x18001aec0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov ebp, r8d
mov qword [rcx], 0
mov r14d, edx
mov qword [rcx + 8], 0
mov rdi, rcx
call fcn.18001ad50
test eax, eax
jne 0x18001af07
mov eax, 9
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rdi], 0
je 0x18001af7e
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rdi + 0xc], ebx
jbe 0x18001af66
mov qword [rsp + 0x38], rsi
nop
mov r8, qword [rdi]
xor edx, edx
mov r8d, dword [r8 + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18001af5a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.18001aba0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x18001af20
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbp, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18001afa0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180093010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x180094960]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18001b013
mov eax, 0xa
jmp 0x18001b0a6
test esi, esi
je 0x18001b035
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18001b058
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18001b058
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x18001b051
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18001b058
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800250a0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret