joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x491550
jb 0x4915af
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.00491360
aeskeygenassist xmm1, xmm0, 1
call fcn.00491380
aeskeygenassist xmm1, xmm2, 2
call fcn.00491360
aeskeygenassist xmm1, xmm0, 2
call fcn.00491380
aeskeygenassist xmm1, xmm2, 4
call fcn.00491360
aeskeygenassist xmm1, xmm0, 4
call fcn.00491380
aeskeygenassist xmm1, xmm2, 8
call fcn.00491360
aeskeygenassist xmm1, xmm0, 8
call fcn.00491380
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00491360
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00491380
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00491360
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00491380
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00491360
jmp 0x49161d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004912c0
aeskeygenassist xmm1, xmm2, 2
call fcn.00491320
aeskeygenassist xmm1, xmm2, 4
call fcn.004912c0
aeskeygenassist xmm1, xmm2, 8
call fcn.00491320
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004912c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00491320
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004912c0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00491320
jmp 0x49161d
aeskeygenassist xmm1, xmm0, 1
call fcn.00491280
aeskeygenassist xmm1, xmm0, 2
call fcn.00491280
aeskeygenassist xmm1, xmm0, 4
call fcn.00491280
aeskeygenassist xmm1, xmm0, 8
call fcn.00491280
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00491280
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00491280
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00491280
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00491280
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00491280
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00491280
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x49162a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x18000d040
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov rcx, qword [rsp + 0x28]
cmp word [rcx], 0x5a4d
je 0x18000d06b
xor al, al
jmp 0x18000d0a9
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x18000d07c
xor al, al
jmp 0x18000d0a9
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x18000d0a3
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x18000d0a3
mov al, 1
jmp 0x18000d0a9
xor al, al
jmp 0x18000d0a9
add rsp, 0x50
pop rbx
ret
Function at 0x18000db70
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
cmp dword [0x1800705f8], 0
je 0x18000db87
mov eax, 0x10dd
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r11d, eax
xor eax, eax
lock cmpxchg dword [0x1800705f8], r11d
jne 0x18000db7d
mov qword [rsp + 0x38], rbx
mov rbx, qword [0x1800705e0]
mov qword [rsp + 0x20], rdi
xor edi, edi
test rbx, rbx
mov qword [0x180070610], rdi
mov qword [0x180070608], rdi
mov qword [0x180070600], rdi
je 0x18000dc00
nop
nop
lea r9, [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18000dbf8
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x18000dbd0
jmp 0x18000dc00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rsp + 0x38]
mov dword [0x1800705fc], edi
mov eax, edi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x18000dc20
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1800705f8], eax
je 0x18000dc3c
mov eax, 0x10dd
add rsp, 0x28
ret
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x20], rdi
mov rdi, qword [0x180070610]
xor ebp, ebp
test rdi, rdi
je 0x18000dcc9
mov qword [rsp + 0x48], rsi
nop
mov rax, qword [rdi + 0x20]
mov r8d, dword [rdi + 0x28]
mov rcx, qword [rdi + 0x18]
movzx edx, byte [rax + 0x3e]
lea r9, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [rdi + 8], ebp
jne 0x18000dcb1
mov rsi, qword [rdi + 0x20]
test rsi, rsi
je 0x18000dcb1
xor edx, edx
mov rbx, rsi
mov rcx, rsi
lea r8d, [rdx + 0x60]
and rbx, 0xffffffffffff0000
call sub.MSVCR80.dll_memset
mov rax, qword [rbx + 0x10]
mov qword [rsi + 0x48], rax
mov qword [rbx + 0x10], rsi
mov qword [rdi + 0x20], rbp
mov rbx, qword [rdi]
mov rcx, rdi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
test rbx, rbx
mov rdi, rbx
jne 0x18000dc60
mov rsi, qword [rsp + 0x48]
mov qword [0x180070610], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, qword [0x1800705e0]
test rbx, rbx
mov rdi, rax
je 0x18000dd24
nop
nop
nop
lea r9, [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, 0x10000
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x18000dcf0
mov rdi, qword [0x180070608]
test rdi, rdi
je 0x18000dd4d
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rdi]
mov rcx, rdi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
test rbx, rbx
mov rdi, rbx
jne 0x18000dd30
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x38]
mov qword [0x180070608], rbp
mov dword [0x1800705f8], ebp
mov rbp, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x28
ret
Function at 0x18000e220
Capabilities:
Suspend thread

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x1800705fc]
mov rbx, rcx
test eax, eax
jne 0x18000e2be
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rbx, rax
jne 0x18000e24a
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rdi
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov rdi, rax
jne 0x18000e266
lea ebx, [rax + 8]
jmp 0x18000e284
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x18000e2a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov rdi, qword [rsp + 0x30]
mov dword [0x1800705fc], ebx
mov qword [0x180070600], 0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov rax, qword [0x180070608]
mov qword [rdi + 8], rbx
mov qword [0x180070608], rdi
mov qword [rdi], rax
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x18000e700
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1800705f8], eax
je 0x18000e72e
mov eax, 0x10dd
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov eax, dword [0x1800705fc]
test eax, eax
jne 0x18000e870
test rdi, rdi
jne 0x18000e74f
lea eax, [rdi + 0x57]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
test rsi, rsi
je 0x18000e76b
cmp qword [rsi], 0
jne 0x18000e77b
mov dword [0x1800705fc], 6
mov qword [0x180070600], rsi
mov eax, 6
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x30
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov rbx, rax
jne 0x18000e79f
lea edi, [rax + 8]
jmp 0x18000e84a
mov rcx, qword [rsi]
xor edx, edx
call fcn.18000dad0
xor edx, edx
mov rcx, rdi
mov rbp, rax
call fcn.18000dad0
movzx ecx, byte [rbp + 0x3e]
mov rdi, qword [rbp + 0x48]
mov rdx, rcx
sub rdi, rcx
test ecx, ecx
je 0x18000e83c
cmp ecx, 0x1e
ja 0x18000e83c
cmp qword [rbp + 0x50], rax
je 0x18000e7e3
cmp dword [0x1800705f0], 0
mov edi, 9
jne 0x18000e850
jmp 0x18000e84a
lea r9, [rsp + 0x40]
mov r8d, 0x40
mov rcx, rdi
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18000e80d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x18000e84a
mov dword [rbx + 8], 1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x20], rbp
mov qword [rbx + 0x18], rdi
mov eax, dword [rsp + 0x40]
mov dword [rbx + 0x28], eax
mov rax, qword [0x180070610]
mov qword [0x180070610], rbx
mov qword [rbx], rax
xor eax, eax
jmp 0x18000e866
cmp dword [0x1800705f0], 0
mov edi, 9
jne 0x18000e850
mov dword [0x1800705fc], edi
test rbx, rbx
je 0x18000e85d
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [0x180070600], rsi
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x18000e880
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, r9
mov rbp, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rdi, rax
xor eax, eax
lea r9d, [rax + 0x30]
mov rcx, rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x18000e90d
test byte [rsp + 0x54], 0xf0
mov r9d, 0x40
mov ecx, 4
setne al
mov r8, rbp
mov rdx, rbx
test al, al
mov qword [rsp + 0x20], rsi
cmove r9d, ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x180010040
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x18006e168]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1800030c0
nop
mov edx, 0x24
lea rcx, [rsp + 0x28]
call fcn.18000e930
lea rcx, [rsp + 0x28]
call fcn.180003110
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800100a3
test al, 0x10
jne 0x1800100a3
lea rcx, [rsp + 0x28]
call fcn.180001570
mov al, 1
jmp 0x1800100af
lea rcx, [rsp + 0x28]
call fcn.180001570
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18003f5f0
add rsp, 0x68
ret
Function at 0x180013550
Capabilities:
Resume thread
Terminate process

Disassembly:
sub rsp, 0x88
mov r10d, dword [rsp + 0xb8]
mov r11, qword [rsp + 0xe8]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xd0]
or r10d, 4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xc8]
test r11, r11
cmove r11, qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], eax
call r11
mov rdx, qword [rsp + 0xd8]
test rdx, rdx
je 0x1800135e2
lea r8, [rsp + 0x60]
mov rcx, qword [r8]
mov qword [rdx], rcx
mov rcx, qword [r8 + 8]
mov qword [rdx + 8], rcx
mov rcx, qword [r8 + 0x10]
mov qword [rdx + 0x10], rcx
test eax, eax
je 0x180013622
mov rax, qword [rsp + 0xe0]
xor r8d, r8d
test rax, rax
je 0x180013601
mov qword [rsp + 0x50], rax
mov r8d, 1
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x50]
call fcn.180012f20
test eax, eax
jne 0x18001362c
mov rcx, qword [rsp + 0x60]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
add rsp, 0x88
ret
test byte [rsp + 0xb8], 4
jne 0x180013641
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
add rsp, 0x88
ret
Function at 0x180013970
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180070620]
test rax, rax
jne 0x18001398c
mov ebx, 0x26b1
jmp 0x180013acb
mov r8d, dword [rax + 4]
xor edx, edx
mov ecx, 0x1f0fff
mov qword [rsp + 0x28], r12
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov r12, rax
jne 0x1800139b4
mov ebx, 0x26ad
jmp 0x180013ac6
mov rax, qword [0x180070620]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov ecx, dword [rax + 8]
mov eax, 8
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], r13
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rsi, qword [0x180070620]
xor ebx, ebx
cmp dword [rsi + 8], ebx
mov r13d, dword [rsi]
mov r10d, ebx
mov rbp, rax
mov r11d, ebx
jbe 0x180013a8c
mov r9, rax
nop
mov eax, r10d
lea edx, [r13 - 0x10]
lea rdi, [rax + rsi + 0xc]
sub edx, r10d
test rdi, rdi
je 0x180013a68
cmp rdx, 0x7fffffff
ja 0x180013a68
test rdx, rdx
mov rcx, rdx
mov rax, rdi
mov r8d, ebx
je 0x180013a4e
nop
nop
cmp byte [rax], bl
je 0x180013a5e
add rax, 1
sub rcx, 1
jne 0x180013a40
mov r8d, 0x80070057
mov rdx, rbx
test r8d, r8d
jns 0x180013a76
jmp 0x180013a6e
test rcx, rcx
je 0x180013a4e
sub rdx, rcx
jmp 0x180013a57
mov r8d, 0x80070057
test r8d, r8d
mov rdx, rbx
js 0x180013ad4
mov qword [r9], rdi
add r11d, 1
add r9, 8
cmp r11d, dword [rsi + 8]
lea r10d, [r10 + rdx + 1]
jb 0x180013a10
mov r8d, dword [rsi + 8]
mov rdx, rbp
mov rcx, r12
call fcn.180012f20
mov ecx, 0x26af
test eax, eax
cmove ebx, ecx
test rbp, rbp
mov r13, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
je 0x180013ac1
mov rcx, rbp
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov rbp, qword [rsp + 0x40]
mov r12, qword [rsp + 0x28]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ebx, 0x26ae
jmp 0x180013aa5
Function at 0x180013df0
Capabilities:
Query environment variable
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x510
mov rax, qword [0x18006e168]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov edx, ecx
mov rsi, r9
mov r9, r8
mov ebp, 1
lea rcx, [rsp + 0x50]
xor ebx, ebx
mov r8d, ebp
mov qword [rsp + 0x50], rbx
call fcn.180013ba0
mov rdi, qword [rsp + 0x50]
test eax, eax
je 0x180014035
lea rdx, [rsp + 0xe0]
lea rcx, str.WINDIR
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x180014035
cmp eax, 0x104
jae 0x180014035
mov ecx, 0x104
lea rax, [rsp + 0xe0]
nop
nop
cmp word [rax], bx
je 0x180013e93
add rax, 2
sub rcx, rbp
jne 0x180013e80
jmp 0x180014035
test rcx, rcx
je 0x180014035
mov eax, 0x104
mov edx, 0x104
mov r9d, ebx
sub rax, rcx
sub rdx, rax
lea rcx, [rsp + rax*2 + 0xe0]
je 0x180014035
lea r8, str._syswow64_rundll32.exe
sub r8, rcx
nop
nop
nop
movzx eax, word [r8 + rcx]
test ax, ax
je 0x180013ee8
mov word [rcx], ax
add rcx, 2
sub rdx, rbp
jne 0x180013ed0
jmp 0x180013eed
test rdx, rdx
jne 0x180013ef7
sub rcx, 2
mov r9d, 0x8007007a
test r9d, r9d
mov word [rcx], bx
js 0x180014035
lea r9, [rdi + 0xc]
lea r8, str.rundll32.exe___hs__1
lea rcx, [rsp + 0x2f0]
mov edx, 0x104
call fcn.180012090
test eax, eax
js 0x180014035
xor eax, eax
lea rcx, [rsp + 0x70]
xor edx, edx
lea r8d, [rax + 0x68]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call sub.MSVCR80.dll_memset
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
lea rdx, [rsp + 0x2f0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0x20], ebx
call rsi
test eax, eax
je 0x180014035
mov r9d, dword [rdi]
mov rcx, qword [rsp + 0x58]
lea rdx, [0x180053ea8]
mov r8, rdi
call fcn.180013650
test eax, eax
jne 0x180013fdc
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180014035
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x1f4
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x50], ebx
cmove ebx, ebp
test rdi, rdi
je 0x180014042
mov rcx, rdi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, ebx
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.18003f5f0
mov rbx, qword [rsp + 0x530]
add rsp, 0x510
pop rdi
pop rsi
pop rbp
ret
Function at 0x180014070
Capabilities:
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rdi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xc8]
mov r10, rcx
test rdi, rdi
cmove rdi, qword [sym.imp.KERNEL32.dll_CreateProcessW]
test rbx, rbx
jne 0x1800140b3
xor eax, eax
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xc0]
mov ecx, dword [rsp + 0xa8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb8]
or ecx, 4
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x28], ecx
mov rcx, r10
mov dword [rsp + 0x20], eax
call rdi
test eax, eax
jne 0x18001410f
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rcx, qword [rbx]
mov qword [rsp + 0x80], rsi
mov rsi, qword [rsp + 0xd0]
lea rdx, [rsp + 0xd8]
mov r8d, 1
mov qword [rsp + 0xd8], rsi
call fcn.180012f20
test eax, eax
jne 0x180014186
mov ecx, dword [rbx + 0x10]
lea r8, [rsp + 0xd8]
lea edx, [rax + 1]
mov r9, rdi
mov qword [rsp + 0xd8], rsi
call fcn.180013df0
test eax, eax
jne 0x180014186
mov rcx, qword [rbx]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1800141bc
test byte [rsp + 0xa8], 4
jne 0x18001419a
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rcx, [rsp + 0x50]
cmp rbx, rcx
jne 0x1800141b7
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x1800141e0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp dword [0x1800706e0], 0
je 0x1800141f4
xor eax, eax
add rsp, 0x28
ret
mov rax, qword [0x1800706d8]
test rax, rax
jne 0x18001441b
mov qword [0x180070710], rax
mov qword [0x180070718], rax
mov qword [0x180070720], rax
mov qword [0x180070728], rax
mov qword [0x180070730], rax
mov qword [0x180070738], rax
mov qword [0x180070740], rax
mov qword [0x180070748], rax
mov qword [0x180070750], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, str.dbghelp.dll
xor r8d, r8d
xor edx, edx
mov qword [0x180070710], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov qword [0x180070718], rax
je 0x1800143d0
lea rdx, str.ImagehlpApiVersionEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180070718]
lea rdx, str.SymInitialize
mov qword [0x180070720], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180070718]
lea rdx, str.SymSetOptions
mov qword [0x180070728], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180070718]
lea rdx, str.SymGetOptions
mov qword [0x180070730], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180070718]
lea rdx, str.SymLoadModule64
mov qword [0x180070738], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180070718]
lea rdx, str.SymGetModuleInfo64
mov qword [0x180070740], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180070718]
lea rdx, str.SymFromName
mov qword [0x180070748], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [0x180070720]
xor ecx, ecx
test rdx, rdx
mov qword [rsp + 0x30], rcx
mov word [rsp + 0x30], 9
mov qword [0x180070750], rax
je 0x1800143c9
cmp qword [0x180070728], rcx
je 0x1800143c9
cmp qword [0x180070740], rcx
je 0x1800143c9
cmp qword [0x180070748], rcx
je 0x1800143c9
test rax, rax
je 0x1800143c9
lea rcx, [rsp + 0x30]
call rdx
cmp word [rsp + 0x30], 9
jb 0x1800143c9
mov rcx, qword [0x180070710]
xor r8d, r8d
xor edx, edx
call qword [0x180070728]
test eax, eax
je 0x1800143c9
mov rax, qword [0x180070738]
test rax, rax
je 0x1800143b6
cmp qword [0x180070730], 0
je 0x1800143b6
call rax
and eax, 0xfffffffc
or eax, 0x2704
mov ecx, eax
call qword [0x180070730]
lea rax, [0x180070710]
mov qword [0x1800706d8], rax
add rsp, 0x28
ret
mov rax, qword [0x180070718]
test rax, rax
mov dword [0x1800706e0], 1
je 0x1800143e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov qword [0x180070720], rax
mov qword [0x180070728], rax
mov qword [0x180070730], rax
mov qword [0x180070738], rax
mov qword [0x180070740], rax
mov qword [0x180070748], rax
mov qword [0x180070750], rax
add rsp, 0x28
ret
Function at 0x180014660
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
lea rbx, [rcx + 0x10000]
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
nop
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800146eb
cmp dword [rsp + 0x40], 0x1000
jne 0x1800146ed
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x1800146ed
bt eax, 8
jb 0x1800146ed
cmp word [rbx], 0x5a4d
jne 0x1800146e7
mov eax, dword [rbx + 0x3c]
cmp rax, qword [rsp + 0x38]
ja 0x1800146e7
cmp eax, 0x40
jb 0x1800146e7
cdqe
cmp dword [rax + rbx], 0x4550
jne 0x1800146ed
mov rax, rbx
jmp 0x1800146eb
jmp 0x1800146ed
jmp 0x1800146fc
mov rcx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x38]
add rbx, rcx
jmp 0x180014690
add rsp, 0x50
pop rbx
ret

Function at 0x180014740
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rsi
push rdi
sub rsp, 0x30
mov r9, rcx
test rcx, rcx
jne 0x18001475b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9, rax
cmp word [r9], 0x5a4d
je 0x180014775
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180014843
movsxd r10, dword [r9 + 0x3c]
add r10, r9
cmp dword [r10], 0x4550
je 0x180014797
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180014843
movzx eax, word [r10 + 0x14]
test ax, ax
jne 0x1800147b3
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180014843
movzx eax, ax
lea r11, [rax + r10 + 0x18]
xor edx, edx
mov dword [rsp + 0x20], edx
movzx eax, word [r10 + 6]
cmp edx, eax
jae 0x180014827
lea rcx, [rdx + rdx*4]
lea r8, [r11 + rcx*8]
lea rdi, str..detour
mov rsi, r8
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
jne 0x18001481e
mov eax, dword [r8 + 0xc]
test eax, eax
je 0x180014827
cmp dword [r8 + 0x10], 0
je 0x180014827
lea rdi, [r9 + rax]
mov eax, dword [rdi]
cmp eax, 0x40
jb 0x180014827
cmp dword [rdi + 4], 0x727444
jne 0x180014827
cmp dword [rdi + 8], 0
jne 0x180014811
mov dword [rdi + 8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
jmp 0x180014843
add edx, 1
mov dword [rsp + 0x20], edx
jmp 0x1800147c1
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180014843
mov rsi, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret