joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800c94c0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
jne 0x1800c94dd
test byte [0x7ffe02d4], 2
je 0x1800c950d
mov rax, qword gs:[0x30]
test byte [rax + 0x17ee], 0x20
jne 0x1800c950d
cmp dword [0x18015c290], 0
je 0x1800c9506
mov rax, qword [0x18016f258]
test rax, rax
je 0x1800c9506
call rax
call sym.ntdll.dll_DbgBreakPoint
jmp 0x1800c950d
xor ecx, ecx
call sym.ntdll.dll_RtlExitUserThread
nop
int3

Function at 0x1800c9540
Capabilities:
Execute syscall

Disassembly:
mov rdx, qword gs:[0x30]
mov rdx, qword [rdx + 0x16a8]
jmp sym.ntdll.dll_NtRemoveProcessDebug

Function at 0x1800c9560
Capabilities:
Execute syscall

Disassembly:
mov rax, qword gs:[0x30]
mov r9, rcx
mov r8, rdx
mov dl, 1
mov rcx, qword [rax + 0x16a8]
jmp sym.ntdll.dll_NtWaitForDebugEvent

Function at 0x1800cc020
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15, rcx
mov ebp, r9d
mov rcx, qword gs:[0x60]
mov r14, rdx
mov edx, dword [0x18015c294]
mov ebx, r8d
add edx, 0x180000
lea esi, [rbp + 0x36]
mov rcx, qword [rcx + 0x30]
mov r8d, esi
call sym.ntdll.dll_RtlAllocateHeap
xor r12d, r12d
mov rdi, rax
test rax, rax
je 0x1800cc10c
lea eax, [rbx - 5]
cmp eax, 1
mov eax, 0x14b0
ja 0x1800cc08e
mov eax, 0x14b1
mov rdx, qword [rsp + 0x60]
lea rcx, [rdi + 0x34]
mov word [rdi + 6], ax
mov r8, rbp
mov dword [rdi + 0x30], ebx
mov rbx, rbp
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r14
call sym.ntdll.dll_RtlCopyMemory
shr rbx, 1
mov word [rdi + rbx*2 + 0x34], r12w
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800cc0dc
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22a
jmp 0x1800cc0e1
mov ecx, 0x7ffe0384
movzx ecx, byte [rcx]
lea r8d, [rsi - 0x20]
mov r9, rdi
mov edx, 0x403
call sym.ntdll.dll_NtTraceEvent
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1800d0698
Capabilities:
Execute syscall

Disassembly:
sub rsp, 0x28
test ecx, ecx
je 0x1800d0718
mov rax, qword gs:[0x30]
mov r8d, 0xfffffffe
mov rcx, qword [rax + 0x48]
lea edx, [r8 + 3]
and qword [0x18015c258], 0
mov qword [0x18015c250], rcx
mov dword [0x18015c24c], edx
mov dword [0x18015c248], r8d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x48]
and qword [0x1801565c8], 0
mov qword [0x1801565c0], rcx
mov dword [0x1801565b8], r8d
mov dword [0x1801565bc], edx
call fcn.18005ce48
test eax, eax
jns 0x1800d0710
mov edx, eax
or rcx, 0xffffffffffffffff
call sym.ntdll.dll_NtTerminateProcess
and qword [0x18015c1f0], 0
lea rcx, [0x18015c240]
call sym.ntdll.dll_RtlLeaveCriticalSection
xor r8d, r8d
lea edx, [r8 + 0xd]
call fcn.180046f60
add rsp, 0x28
jmp fcn.180047b2c

Function at 0x1800d0804
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword gs:[0x60]
lea rdi, [0x18015d210]
mov r14d, ecx
lea rbp, [0x18015d218]
mov esi, 0xf
mov r15, qword [rax + 0x30]
test r14d, r14d
je 0x1800d086d
mov r8, qword [rdi]
test r8, r8
je 0x1800d0865
mov rbx, qword [r8 + 8]
xor edx, edx
mov rcx, r15
call sym.ntdll.dll_RtlFreeHeap
mov r8, rbx
test rbx, rbx
jne 0x1800d084c
and qword [rdi], rbx
mov qword [rdi + 8], 1
mov rcx, rbp
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
sub rbp, 0x10
sub rdi, 0x10
sub esi, 1
jns 0x1800d083f
test r14d, r14d
je 0x1800d089c
mov dword [0x18015c1c0], 1
mov qword [0x18015d118], 0x11
lea rcx, [0x18015d118]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp sym.ntdll.dll_RtlReleaseSRWLockShared

Function at 0x1800d1ce8
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, qword gs:[0x60]
mov ebp, ecx
cmp qword [rdi + 0x320], 0
je 0x1800d1d4c
mov ebx, 0x7f0
mov esi, 0x7f
test ebp, ebp
je 0x1800d1d2f
mov rax, qword [rdi + 0x320]
mov qword [rbx + rax + 8], 1
mov rcx, qword [rdi + 0x320]
add rcx, 8
add rcx, rbx
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
sub rbx, 0x10
sub rsi, 1
jne 0x1800d1d1b
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800d4dfc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub rsp, 0x28
mov r8d, dword [0x18015b300]
xor r9d, r9d
test r8d, 0x8001
je 0x1800d4e23
call fcn.1800d4d98
test al, al
mov ecx, 0xc0000001
cmove r9d, ecx
test r8b, 4
je 0x1800d4e38
call fcn.1800d4d28
mov r8d, dword [0x18015b300]
mov r9d, eax
test r8b, 8
je 0x1800d4e80
mov rcx, qword gs:[0x60]
cmp byte [rcx + 2], 0
jne 0x1800d4e57
cmp byte [0x7ffe02d4], 0
je 0x1800d4e79
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0xbc]
mov rax, qword gs:[0x60]
bts ecx, 0x10
mov dword [rax + 0xbc], ecx
mov r8d, dword [0x18015b300]
movzx eax, byte [0x18015d42a]
bt r8d, 0x12
mov ecx, 1
cmovb eax, ecx
mov byte [0x18015d42a], al
mov eax, r9d
add rsp, 0x28
ret

Function at 0x1800d5368
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov r12d, 0x48
mov r8d, r12d
xor edx, edx
mov rbp, qword [rax + 0x30]
mov rcx, rbp
call sym.ntdll.dll_RtlAllocateHeap
xor r14d, r14d
mov rbx, rax
test rax, rax
jne 0x1800d53ba
mov eax, 0xc0000017
jmp 0x1800d54d4
mov r8, r12
xor edx, edx
mov rcx, rbx
call sym.ntdll.dll_memset
movups xmm0, xmmword [0x180111318]
lea r15, [0x18015b590]
movdqu xmmword [rbx + 0x10], xmm0
mov rax, qword [0x18015b598]
cmp qword [rax], r15
je 0x1800d53ed
mov ecx, 3
int 0x29
cmp dword [0x18015c290], r14d
mov qword [rbx], r15
mov qword [rbx + 8], rax
mov qword [rax], rbx
mov qword [0x18015b598], rbx
jne 0x1800d54d2
cmp word [0x18015b320], r14w
lea rbx, [0x18015b320]
je 0x1800d54d2
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1800d542f
cmp ax, 9
jne 0x1800d5435
add rbx, 2
jmp 0x1800d5420
mov rsi, rbx
test ax, ax
je 0x1800d54d2
cmp ax, 0x20
je 0x1800d5459
cmp ax, 9
je 0x1800d5459
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x1800d5441
cmp rsi, rbx
je 0x1800d54d2
lea rdx, str.verifier.dll
mov word [rbx], r14w
mov rcx, rsi
call sym.ntdll.dll__wcsicmp
test eax, eax
je 0x1800d54c4
mov r8, r12
xor edx, edx
mov rcx, rbp
call sym.ntdll.dll_RtlAllocateHeap
mov rdi, rax
test rax, rax
je 0x1800d53b0
mov r8, r12
xor edx, edx
mov rcx, rax
call sym.ntdll.dll_memset
lea rcx, [rdi + 0x10]
mov rdx, rsi
call sym.ntdll.dll_RtlInitUnicodeString
mov rax, qword [0x18015b598]
cmp qword [rax], r15
jne 0x1800d54f3
mov qword [rdi], r15
mov qword [rdi + 8], rax
mov qword [rax], rdi
mov qword [0x18015b598], rdi
add rbx, 2
cmp word [rbx], r14w
jne 0x1800d5420
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
mov ecx, 3
int 0x29
int3

Function at 0x1800d63a0
Capabilities:
Execute syscall

Disassembly:
neg rdx
shl rdx, 2
jmp sym.ntdll.dll_NtQueueApcThread

Function at 0x1800d6510
Capabilities:
Execute syscall

Disassembly:
mov r8, rdx
mov r9d, 0x2cc
mov edx, 0x1d
jmp sym.ntdll.dll_NtSetInformationThread
Function at 0x1800da4d0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
and dword [rsp + 0x20], 0
mov rsi, rdx
and dword [rsp + 0x24], 0
mov rbx, rcx
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
test rcx, rcx
je 0x1800da577
mov rdi, qword [rbx + 0x10]
or r8, 0xffffffffffffffff
mov rdx, qword [rbx + 8]
inc r8
cmp byte [rdx + r8], 0
jne 0x1800da535
lea rcx, [rsp + 0x20]
call sym.ntdll.dll_MD5Update
jmp 0x1800da56a
mov rdx, qword [rdi + 8]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1800da553
lea rcx, [rsp + 0x20]
call sym.ntdll.dll_MD5Update
mov rdi, qword [rdi]
test rdi, rdi
jne 0x1800da54b
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1800da529
lea rcx, [rsp + 0x20]
call sym.ntdll.dll_MD5Final
movups xmm0, xmmword [rsp + 0x78]
xor eax, eax
movdqu xmmword [rsi], xmm0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18008b0e0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800dac60
Capabilities:
Execute syscall

Disassembly:
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 7]
jmp sym.ntdll.dll_NtAlpcSetInformation
Function at 0x1800e0408
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword gs:[0x60]
mov r14d, r9d
mov rbx, qword [rsp + 0xe0]
mov r15, r8
mov r12d, edx
mov r13, rcx
xor ebp, ebp
mov rsi, qword [rax + 0x30]
mov eax, 0x400
mov dword [rsp + 0x60], eax
mov r8d, eax
xor edx, edx
mov rcx, rsi
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rbx], rax
test rax, rax
je 0x1800e0513
mov rcx, qword [rsp + 0xe8]
mov r9d, r14d
mov qword [rsp + 0x50], rcx
mov r8, r15
mov qword [rsp + 0x48], rax
mov edx, r12d
lea rax, [rsp + 0x60]
mov rcx, r13
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
call fcn.1800e0538
mov edi, eax
test eax, eax
jns 0x1800e04f7
mov r8, qword [rbx]
xor edx, edx
mov rcx, rsi
call sym.ntdll.dll_RtlFreeHeap
and qword [rbx], 0
cmp edi, 0xc0000023
jne 0x1800e050f
inc ebp
cmp ebp, 2
jae 0x1800e050f
mov eax, dword [rsp + 0x60]
jmp 0x1800e0450
cmp dword [rsp + 0x60], 0
jne 0x1800e050f
mov r8, qword [rbx]
xor edx, edx
mov rcx, rsi
call sym.ntdll.dll_RtlFreeHeap
and qword [rbx], 0
mov eax, edi
jmp 0x1800e0518
mov eax, 0xc0000017
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1800e1f40
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub rsp, 0x38
mov r10, rcx
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
xor r9d, r9d
cmp byte [r8 + 0x48], r9b
je 0x1800e1f84
lea rax, [0x1801565b0]
cmp rcx, rax
jne 0x1800e2014
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x48]
cmp qword [r8 + 0x50], rdx
je 0x1800e2014
cmp dword [0x18015c290], r9d
je 0x1800e1fbc
mov rcx, qword gs:[0x30]
movsxd rax, dword [rcx + 0x180c]
test eax, eax
jne 0x1800e1fa6
mov rcx, r9
jmp 0x1800e1fab
js 0x1800e1fab
add rcx, rax
mov eax, dword [rcx + 0x30]
mov ecx, dword [rax + 0xc]
test rcx, rcx
je 0x1800e1fbc
cmp byte [rcx + 0x28], r9b
jne 0x1800e2014
mov rax, qword gs:[0x60]
cmp byte [rax + 2], r9b
je 0x1800e1ff8
mov r9, qword gs:[0x30]
mov rax, qword [r10 + 0x10]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r10
mov r9, qword [r9 + 0x48]
lea r8, str.NTDLL:_Calling_thread___p__not_owner_of_CritSect:__p__Owner_ThreadId:__p_n
xor edx, edx
lea ecx, [rdx + 0x65]
call sym.ntdll.dll_DbgPrintEx
int3
mov rcx, qword [0x18015c2f0]
call sym.ntdll.dll_RtlDecodePointer
mov qword [rsp + 0x40], rax
mov ecx, 0xc0000264
call sym.ntdll.dll_RtlRaiseStatus
nop
add rsp, 0x38
ret
Function at 0x1800e4760
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov r15b, r8b
mov rcx, rdx
mov rbp, rdx
call sym.ntdll.dll_RtlValidSid
test al, al
je 0x1800c4f18
movzx eax, byte [rbp + 1]
mov rsi, qword [r14]
lea edi, [rax*4 + 0x17]
mov ecx, dword [rsi + 8]
and edi, 0xfffffff8
add ecx, edi
cmp ecx, edi
jb 0x1800c4f22
mov r8d, ecx
mov edx, 8
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov rbx, rax
test rax, rax
je 0x1800c4f2c
mov r8d, dword [rsi + 8]
mov rdx, rsi
mov rcx, rax
call sym.ntdll.dll_RtlCopyMemory
mov ecx, dword [rsi + 8]
mov rdx, rbp
add ecx, edi
mov dword [rbx + 8], ecx
mov eax, dword [rsi + 4]
inc eax
mov dword [rbx + 4], eax
mov ecx, dword [rsi + 8]
add rcx, rbx
neg r15b
sbb eax, eax
neg eax
mov dword [rcx + 4], edi
add eax, 2
mov dword [rcx], eax
add rcx, 8
movzx eax, byte [rbp + 1]
lea r8d, [rax*4 + 8]
call sym.ntdll.dll_RtlCopyMemory
mov rcx, rbx
call fcn.18007e568
mov rcx, qword gs:[0x60]
xor edx, edx
test eax, eax
mov edi, eax
setns dl
mov rcx, qword [rcx + 0x30]
test edx, edx
je 0x1800c4f36
mov r8, rsi
xor edx, edx
call sym.ntdll.dll_RtlFreeHeap
xor eax, eax
mov qword [r14], rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov eax, 0xc000000d
jmp 0x18007f4ce
mov eax, 0xc0000173
jmp 0x18007f4ce
mov eax, 0xc000009a
jmp 0x18007f4ce
mov r8, rbx
xor edx, edx
call sym.ntdll.dll_RtlFreeHeap
mov eax, edi
jmp 0x18007f4ce
mov r8b, 1
jmp 0x18007f3d8

Function at 0x1800e92c4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov rsi, rcx
mov qword [rbp - 0x18], rbx
mov r14, r8
mov dword [rbp + 0x38], ebx
mov r8d, 0x208
mov dword [rbp - 0x20], r8d
mov r15, rdx
mov qword [rbp - 0x10], rbx
lea edx, [rbx + 8]
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rbp - 0x18], rax
mov r8, rax
test rax, rax
je 0x1800e939a
mov rdx, qword [rsi + 0x18]
mov eax, ebx
mov dword [rbp + 0x38], ebx
mov edi, ebx
mov qword [rbp - 0x10], rbx
cmp bx, word [rdx + 6]
jae 0x1800e9383
mov eax, edi
imul r9, rax, 0x1c
mov eax, 0x1000
add r9, qword [rdx + 0x10]
test word [r9], ax
jne 0x1800e936e
lea rax, [rbp - 0x10]
mov word [rsp + 0x30], bx
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x38]
mov qword [rsp + 0x20], rsi
lea rcx, [rbp - 0x18]
call fcn.1800e80c0
mov rdx, qword [rsi + 0x18]
inc edi
movzx eax, word [rdx + 6]
cmp edi, eax
jb 0x1800e9335
mov r8, qword [rbp - 0x18]
mov eax, dword [rbp + 0x38]
mov ecx, eax
mov word [r8 + rcx*2], bx
mov bl, 1
mov rcx, qword [rbp - 0x18]
mov qword [r15], rcx
mov rcx, qword [rbp - 0x10]
mov qword [r14], rcx
lea r11, [rsp + 0x60]
mov al, bl
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1800eb150
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, qword gs:[0x60]
lea rcx, [0x18015aac0]
call sym.ntdll.dll_RtlEnterCriticalSection
lea r8, [rsp + 0x20]
mov edx, 1
lea rcx, [0x18015d838]
call fcn.18005ef2c
xor ebx, ebx
mov esi, ebx
cmp dword [r14 + 0xe8], ebx
jbe 0x1800eb229
mov rax, qword [r14 + 0xf0]
mov ecx, esi
mov rdi, qword [rax + rcx*8]
cmp dword [rdi + 0x10], 0xddeeddee
jne 0x1800eb1e7
test byte [rdi + 0x14], 1
jne 0x1800eb25d
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.180022e4c
lea rcx, [rdi + 0x168]
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
lea rcx, [rdi + 0x200]
xor edx, edx
call fcn.180104c94
jmp 0x1800eb25d
test byte [rdi + 0x70], 1
jne 0x1800eb25d
mov ebp, ebx
mov qword [rsp + 0x58], 0xfffffffffffc2f70
mov rcx, qword [rdi + 0x160]
call sym.ntdll.dll_RtlTryEnterCriticalSection
test eax, eax
jne 0x1800eb23e
lea rdx, [rsp + 0x58]
xor ecx, ecx
call sym.ntdll.dll_NtDelayExecution
inc ebp
cmp ebp, 0x64
jb 0x1800eb1f8
mov edx, esi
xor ecx, ecx
mov ebx, 0xc0000194
call fcn.1800ecf7c
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
cmp byte [rdi + 0x182], 2
jne 0x1800eb250
mov rcx, qword [rdi + 0x178]
jmp 0x1800eb253
mov rcx, rbx
test rcx, rcx
je 0x1800eb25d
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
inc esi
cmp esi, dword [r14 + 0xe8]
jb 0x1800eb19e
jmp 0x1800eb229
Function at 0x1800ecf7c
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r15, qword gs:[0x60]
xor r12d, r12d
mov edi, ecx
mov r13d, 1
test edx, edx
je 0x1800ed089
mov r14d, r12d
mov ebp, edx
mov rax, qword [r15 + 0xf0]
mov rbx, qword [r14 + rax]
cmp dword [rbx + 0x10], 0xddeeddee
jne 0x1800ed011
test byte [rbx + 0x14], r13b
jne 0x1800ed07c
lea rsi, [rbx + 0x168]
test edi, edi
je 0x1800ecfe5
mov qword [rsi], r13
mov eax, edi
lea rcx, [rbx + 0x200]
neg eax
sbb edx, edx
and edx, 2
add edx, r13d
call fcn.180104c94
mov rcx, rsi
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
mov edx, edi
mov rcx, rbx
call fcn.180048f40
jmp 0x1800ed07c
test byte [rbx + 0x70], r13b
jne 0x1800ed07c
cmp byte [rbx + 0x182], 2
jne 0x1800ed029
mov rcx, qword [rbx + 0x178]
jmp 0x1800ed02c
mov rcx, r12
test rcx, rcx
je 0x1800ed03d
test edi, edi
je 0x1800ed038
mov qword [rcx], r13
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
test edi, edi
je 0x1800ed070
mov rdx, qword [rbx + 0x160]
mov word [rbx + 0x180], r12w
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x48]
mov qword [rdx + 0x10], rcx
mov dword [rdx + 8], 0xfffffffe
mov dword [rdx + 0xc], r13d
mov qword [rdx + 0x18], r12
mov rcx, qword [rbx + 0x160]
call sym.ntdll.dll_RtlLeaveCriticalSection
add r14, 8
sub rbp, r13
jne 0x1800ecfb9
test edi, edi
je 0x1800ed0c8
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x48]
or qword [0x18015d860], 0xffffffffffffffff
mov qword [0x18015aad0], rcx
mov dword [0x18015aac8], 0xfffffffe
mov dword [0x18015aacc], r13d
mov qword [0x18015aad8], r12
mov qword [0x18015d858], r13
lea rax, [0x18015d838]
mov dword [rsp + 0x20], r13d
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x24], 0xff
call fcn.18005ee34
lea rcx, [0x18015aac0]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp sym.ntdll.dll_RtlLeaveCriticalSection
Function at 0x1800ee850
Capabilities:
Encode data using xor

Disassembly:
lea r9, [0x180111430]
jmp 0x18007dda0
Function at 0x1800eee04
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rbx, rdx
mov rdx, rcx
mov cl, byte [rbx + 0xf]
cmp cl, 1
je 0x1800ef019
cmp cl, 4
jne 0x1800eee66
cmp dword [rdx + 0x7c], 0
je 0x1800eee53
mov eax, dword [rbx + 8]
mov dword [rsp + 0x28], eax
test dword [rdx + 0x7c], eax
je 0x1800eee4c
xor eax, dword [rdx + 0x88]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x28]
jmp 0x1800eee57
movzx eax, word [rbx + 8]
mov rdi, qword [rbx - 0x10]
movzx eax, ax
sub rdi, rax
jmp 0x1800eef72
test cl, cl
jns 0x1800eee99
mov rcx, rbx
shr rcx, 4
xor ecx, edx
xor ecx, dword [0x18015d458]
xor ecx, dword [rbx + 8]
test cx, cx
je 0x1800eee85
xor eax, eax
jmp 0x1800eee92
shr rcx, 0xc
mov rax, rbx
sub rax, rcx
mov rax, qword [rax]
movzx r8d, word [rax + 0x24]
jmp 0x1800eeec2
cmp dword [rdx + 0x7c], 0
je 0x1800eeebd
mov eax, dword [rbx + 8]
mov dword [rsp + 0x28], eax
test dword [rdx + 0x7c], eax
je 0x1800eeeb5
xor eax, dword [rdx + 0x88]
mov dword [rsp + 0x28], eax
movzx r8d, word [rsp + 0x28]
jmp 0x1800eeec2
movzx r8d, word [rbx + 8]
mov cl, byte [rbx + 0xf]
cmp cl, 5
jne 0x1800eeedd
movzx ecx, word [rdx + 0x8c]
movzx eax, word [rbx + 0xc]
xor rcx, rax
jmp 0x1800eef67
test cl, 0x40
je 0x1800eeef3
movzx eax, cl
and eax, 0x3f
shl rax, 4
movzx ecx, word [rax + rbx + 0xc]
jmp 0x1800eef67
mov al, cl
and al, 0x3f
cmp al, 0x3f
je 0x1800eef03
movzx ecx, cl
and ecx, 0x3f
jmp 0x1800eef67
test cl, cl
jns 0x1800eef35
mov rcx, rbx
shr rcx, 4
xor ecx, edx
xor ecx, dword [0x18015d458]
xor ecx, dword [rbx + 8]
test cx, cx
je 0x1800eef22
xor eax, eax
jmp 0x1800eef2f
shr rcx, 0xc
mov rax, rbx
sub rax, rcx
mov rax, qword [rax]
movzx eax, word [rax + 0x24]
jmp 0x1800eef5c
cmp dword [rdx + 0x7c], 0
je 0x1800eef58
mov eax, dword [rbx + 8]
mov dword [rsp + 0x28], eax
test dword [rdx + 0x7c], eax
je 0x1800eef51
xor eax, dword [rdx + 0x88]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x28]
jmp 0x1800eef5c
movzx eax, word [rbx + 8]
movzx eax, ax
shl rax, 4
mov rcx, qword [rax + rbx]
movzx edi, r8w
shl rdi, 4
sub rdi, rcx
mov al, byte [rbx + 0xf]
cmp al, 5
jne 0x1800eef83
movzx eax, byte [rbx + 0xe]
shl ax, 4
jmp 0x1800eef90
test al, 0x40
je 0x1800eef8e
and al, 0x3f
movzx eax, al
jmp 0x1800eef7d
xor eax, eax
movzx eax, ax
lea rsi, [rbx + 0x10]
add rdi, rax
lea rdx, [0x180118ef8]
add rsi, rdi
mov r8d, 0x10
mov rcx, rsi
call sym.ntdll.dll_RtlCompareMemory
mov r14, rax
cmp rax, 0x10
je 0x1800ef019
mov rcx, qword gs:[0x60]
cmp qword [rcx + 0x18], 0
je 0x1800eefee
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
lea rcx, str.HEAP__wZ_:
mov rdx, qword [rdx + 0x10]
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800eeffa
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea r8, [r14 + rsi]
mov r9, rdi
mov rdx, rbx
lea rcx, str.Heap_block_at__p_modified_at__p_past_requested_size_of__Ix_n
call sym.ntdll.dll_DbgPrint
call fcn.18010109c
xor al, al
jmp 0x1800ef01b
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x1800ef280
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rdi, rcx
and qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xc000000d
mov rcx, qword gs:[0x60]
mov edx, 8
lea r8d, [rdx + 0x18]
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1800ef2ca
mov eax, 0xc0000017
jmp 0x1800ef322
mov dword [rsp + 0x40], 0x30
and qword [rsp + 0x48], 0
and dword [rsp + 0x58], 0
and qword [rsp + 0x50], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
lea rcx, [rax + 8]
mov byte [rsp + 0x20], 0
mov r9d, 1
lea r8, [rsp + 0x40]
mov edx, 0x1f0003
call sym.ntdll.dll_NtCreateEvent
mov dword [rsp + 0x30], eax
test eax, eax
js 0x1800ef326
lea rax, [rbx + 0x18]
mov qword [rbx], rax
and qword [rax], 0
mov qword [rdi], rbx
xor eax, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x1800ef34c
test rbx, rbx
je 0x1800ef34c
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x1800f1798
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rdi
xor r10d, r10d
lea rbp, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
xor edi, edi
mov r11, r8
mov rbx, rcx
movzx edx, byte [rbx]
inc edi
movzx r9d, byte [rbx + 1]
mov eax, edx
movzx r8d, byte [rbx + 2]
lea rbx, [rbx + 3]
shr rax, 2
and dl, 3
shl dl, 4
movzx ecx, dl
mov edx, r8d
and edx, 0x3f
mov al, byte [rax + rbp]
mov byte [r10 + r11], al
mov eax, r9d
shr rax, 4
lea r10, [r10 + 4]
or rcx, rax
and r9b, 0xf
shl r9b, 2
mov al, byte [rcx + rbp]
mov byte [r10 + r11 - 3], al
mov eax, r8d
shr rax, 6
movzx ecx, r9b
or rcx, rax
mov al, byte [rcx + rbp]
mov byte [r10 + r11 - 2], al
mov al, byte [rdx + rbp]
mov byte [r10 + r11 - 1], al
cmp edi, 5
jb 0x1800f17b9
movzx ecx, byte [rbx]
mov eax, ecx
and cl, 3
shr rax, 2
shl cl, 4
mov al, byte [rax + rbp]
mov byte [r10 + r11], al
movzx eax, cl
mov al, byte [rax + rbp]
mov byte [r10 + r11 + 1], al
mov word [r10 + r11 + 2], 0x3d3d
mov byte [r10 + r11 + 4], 0
mov rbx, qword [rsp + 8]
xor eax, eax
mov rbp, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x1800f4708
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
mov al, byte [rax + 2]
test al, al
jne 0x1800f4726
mov al, byte [0x7ffe02d4]
and al, 3
cmp al, 3
sete al
ret