joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005c470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [0x1803394f8]
mov r10, rcx
mov r9, qword [rcx + 0x188]
movsxd rax, edx
imul rbx, rax, 0x70
add rbx, qword [rcx + 0x18]
mov dword [rcx + 0x74], edx
test dword [rbx], 0x10000
vmovss xmm3, dword [rbx + 0x34]
je 0x18005c4b3
vaddss xmm3, xmm3, dword [rcx + 0x90]
lea rsi, [r9 + 0x110]
vmovss dword [rsi], xmm3
vmovss xmm0, dword [rcx + 0x88]
vaddss xmm2, xmm0, dword [rcx + 0x7c]
vsubss xmm0, xmm3, dword [r9 + 0x28]
vsubss xmm1, xmm0, dword [r9 + 0x154]
vmovss dword [r9 + 0x158], xmm1
vmovss dword [r9 + 0x114], xmm2
vmovss dword [r9 + 0x128], xmm3
vmovss dword [r9 + 0x118], xmm3
mov eax, dword [rcx + 0x8c]
mov dword [r9 + 0x148], eax
movsx eax, byte [rbx + 0x6a]
mov dword [r9 + 0x168], eax
vmovss dword [r9 + 0x22c], xmm2
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x228], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x230], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1cc], eax
movzx eax, byte [rbx + 0x68]
mov byte [r9 + 0xc3], al
cmp byte [rbx + 0x68], 0
je 0x18005c55c
xor eax, eax
mov dword [rdi + 0x4978], eax
mov dword [rdi + 0x4980], eax
test dword [rcx + 4], 0x100000
je 0x18005c570
mov r8d, 2
jmp 0x18005c5f4
vmovss xmm4, dword [rbx + 0x20]
vmovss xmm3, dword [rbx + 0x24]
vmovss xmm2, dword [rbx + 0x28]
vmovss xmm1, dword [rbx + 0x2c]
vmovups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x2a8]
vmovups xmmword [r9 + 0x248], xmm0
vmovss dword [rsp + 0x20], xmm4
vmovss dword [rsp + 0x24], xmm3
vmovss dword [rsp + 0x28], xmm2
vmovss dword [rsp + 0x2c], xmm1
vmovss dword [rax + 0x88], xmm4
vmovss dword [rax + 0x8c], xmm3
vmovss dword [rax + 0x90], xmm2
vmovss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2a8]
vmovups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
vmovups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, word [rbx + 0x5c]
mov rdx, qword [r9 + 0x2a8]
mov rcx, qword [r10 + 0x1a0]
call fcn.1800501d0
cmp byte [rdi + 0x5fa8], 0
je 0x18005c632
cmp byte [rbx + 0x68], 0
jne 0x18005c632
xor r8d, r8d
lea rdx, [0x1800e1550]
mov rcx, rsi
call fcn.180042a50
mov dword [rdi + 0x5fd8], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18005caa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1803394f8]
mov rcx, qword [rax + 0x4dc8]
mov r9, qword [rax + 0x4008]
vmovups xmm0, xmmword [r9 + 0x248]
vmovups xmmword [rcx + 0x170], xmm0
vmovss xmm4, dword [rcx + 0x150]
vmovss xmm3, dword [rcx + 0x154]
vmovss xmm2, dword [rcx + 0x158]
vmovss xmm1, dword [rcx + 0x15c]
vmovups xmm0, xmmword [rcx + 0x150]
mov rax, qword [r9 + 0x2a8]
vmovups xmmword [r9 + 0x248], xmm0
vmovss dword [rsp + 0x20], xmm4
vmovss dword [rsp + 0x24], xmm3
vmovss dword [rsp + 0x28], xmm2
vmovss dword [rsp + 0x2c], xmm1
vmovss dword [rax + 0x88], xmm4
vmovss dword [rax + 0x8c], xmm3
vmovss dword [rax + 0x90], xmm2
vmovss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2a8]
vmovups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
vmovups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [rcx + 0x232]
mov rcx, qword [rcx + 0x1a0]
mov rdx, qword [r9 + 0x2a8]
add rsp, 0x38
jmp fcn.1800501d0

Function at 0x18005cb80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1803394f8]
mov rcx, qword [rax + 0x4dc8]
mov r10, qword [rax + 0x4008]
movsxd rax, dword [rcx + 0x74]
vmovss xmm4, dword [rcx + 0x170]
vmovss xmm3, dword [rcx + 0x174]
vmovss xmm2, dword [rcx + 0x178]
vmovss xmm1, dword [rcx + 0x17c]
vmovups xmm0, xmmword [rcx + 0x170]
vmovss dword [rsp + 0x20], xmm4
vmovss dword [rsp + 0x24], xmm3
vmovss dword [rsp + 0x28], xmm2
vmovss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x70
mov rax, qword [r10 + 0x2a8]
add r9, qword [rcx + 0x18]
vmovups xmmword [r10 + 0x248], xmm0
vmovss dword [rax + 0x88], xmm4
vmovss dword [rax + 0x8c], xmm3
vmovss dword [rax + 0x90], xmm2
vmovss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2a8]
vmovups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
vmovups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [r9 + 0x5c]
mov rdx, qword [r10 + 0x2a8]
mov rcx, qword [rcx + 0x1a0]
add rsp, 0x38
jmp fcn.1800501d0

Function at 0x18005ee40
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [0x1803394f8]
mov rdx, qword [rax + 0x4dc8]
cmp ecx, 0xffffffff
jne 0x18005ee5a
cmp dword [rdx + 0x74], ecx
cmovne ecx, dword [rdx + 0x74]
cmp ecx, dword [rdx + 0x6c]
mov eax, 0xffffffff
cmove ecx, eax
test byte [rdx + 4], 7
je 0x18005eed7
mov r10d, dword [rdx]
lea r8, [0x1800e1541]
movzx eax, word [rdx + 0x78]
lea r11, [0x1800dc1a0]
not r10d
mov word [rdx + 0x224], cx
mov ecx, r10d
mov byte [rdx + 0x23b], 1
mov word [rdx + 0x7a], ax
mov r9b, 0x23
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x18005eeb3
cmp byte [r8], r9b
jne 0x18005eeb3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18005eea0
not ecx
jmp fcn.18003dc40
ret
Function at 0x180064270
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push r14
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rbx, qword [0x1803394f8]
mov r14, rdx
movsxd r9, dword [rbx + 0x4ab0]
cmp dword [rbx + 0x4aa0], r9d
jle 0x1800644f8
mov rax, qword [rbx + 0x4aa8]
imul r8, r9, 0x38
cmp dword [r8 + rax], ecx
jne 0x1800644f8
vmovss xmm0, dword [rdx + 8]
mov eax, dword [rbx + 0x49c8]
xor esi, esi
mov qword [r11 + 8], rdi
vsubss xmm2, xmm0, dword [rdx]
vmovaps xmmword [r11 - 0x28], xmm6
vxorps xmm6, xmm6, xmm6
test al, 0x10
je 0x1800642f2
vmovss xmm0, dword [rbx + 0x4a08]
vmaxss xmm1, xmm0, xmm2
vmovss dword [rbx + 0x4a08], xmm1
jmp 0x180064346
vxorps xmm1, xmm1, xmm1
test al, 2
je 0x180064304
vcomiss xmm6, dword [rbx + 0x49e8]
jb 0x180064308
vmovaps xmm1, xmm2
vinsertps xmm1, xmm1, xmm6, 0x10
vinsertps xmm1, xmm1, dword [0x1800e1af0], 0x20
vinsertps xmm1, xmm1, dword [0x1800e1af0], 0x30
or eax, 0x10
mov qword [rbx + 0x4a18], rsi
vmovups xmmword [rbp - 1], xmm1
vmovups xmmword [rbx + 0x4a08], xmm1
mov dword [rbx + 0x49c8], eax
mov qword [rbx + 0x4a20], rsi
lea r8, str.Combo__02d
mov edx, 0x10
lea rcx, [rbp + 0xf]
call fcn.18002bf80
movzx r9d, byte [rbp + 0xf]
lea r8, [rbp + 0x10]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1800643b0
lea r11, [0x1800dc1a0]
nop dword [rax]
cmp r9b, 0x23
jne 0x180064393
cmp byte [r8], r9b
jne 0x180064393
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180064380
not ecx
call fcn.180033eb0
mov rdi, rax
test rax, rax
je 0x18006448f
cmp byte [rax + 0xbf], sil
je 0x18006448f
lea r8, [rbp + 0x7f]
mov rcx, rax
lea rdx, [rbp - 1]
vmovss dword [rbp + 0x7f], xmm6
vmovss dword [rbp + 0x83], xmm6
call fcn.180034630
mov rdx, rcx
lea r8, [rbp + 0x7f]
lea rcx, [rbp - 9]
call fcn.180034750
lea r8, [rbp - 9]
mov rdx, rdi
lea rcx, [rbp - 1]
call fcn.1800344c0
lea r9, [rdi + 0xe0]
lea rcx, [rbp + 0x1f]
mov dword [r9], 3
call fcn.18003e480
vmovss xmm0, dword [r14]
vmovss xmm1, dword [r14 + 0xc]
lea rax, [rbp + 0x1f]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], r14
lea r8, [rbp - 1]
lea rdx, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 9]
vmovss dword [rbp + 0x7f], xmm0
vmovss dword [rbp + 0x83], xmm1
call fcn.18003e160
mov rax, qword [0x1803394f8]
vmovsd xmm0, qword [rbp - 9]
or dword [rax + 0x49c8], 1
vmovsd qword [rax + 0x49d8], xmm0
mov qword [rax + 0x49e0], rsi
mov dword [rax + 0x49cc], 1
vmovss xmm0, dword [rbx + 0x392c]
vmovss xmm1, dword [rbx + 0x38fc]
lea rdx, [rbp + 0x7f]
mov ecx, 2
vmovss dword [rbp + 0x7f], xmm0
vmovss dword [rbp + 0x83], xmm1
call fcn.18002d2c0
xor edx, edx
lea rcx, [rbp + 0xf]
mov r8d, 0x4000147
call fcn.1800368f0
mov ecx, 1
movzx ebx, al
call fcn.18002d350
mov rdi, qword [rsp + 0xb0]
vmovaps xmm6, xmmword [rsp + 0x80]
test bl, bl
jne 0x1800644f4
call fcn.18003e0f0
jmp 0x180064500
mov al, 1
jmp 0x180064502
xor esi, esi
mov dword [rbx + 0x49c8], esi
xor al, al
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop r14
pop rsi
pop rbp
ret
Function at 0x18006e4b0
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x18006e53c
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18006e510
lea r11, [0x1800dc1a0]
nop
cmp r9b, 0x23
jne 0x18006e4f3
cmp byte [r8], r9b
jne 0x18006e4f3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18006e4e0
mov rcx, qword [0x1803394f8]
not eax
cmp dword [rcx + 0x406c], eax
jne 0x18006e527
mov dword [rcx + 0x4070], eax
cmp dword [rcx + 0x4098], eax
jne 0x18006e599
mov byte [rcx + 0x409c], 1
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1803394f8]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov rcx, rdi
mov qword [rsp + 0x38], rsi
mov rbx, qword [rax + 0x4008]
movsxd rax, dword [rbx + 0x100]
mov r8, qword [rbx + 0x108]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.18002c190
mov rcx, qword [rbx]
mov esi, eax
mov rbx, qword [rsp + 0x30]
cmp dword [rcx + 0x4054], eax
jne 0x18006e592
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.180044310
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800735a0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r11d, 0xffffffff
mov r10, rcx
mov eax, r11d
test r9b, r9b
je 0x1800735fb
mov qword [rsp], rbx
lea rbx, [0x1800dc1a0]
cmp r9b, 0x23
jne 0x1800735db
cmp byte [r8], r9b
jne 0x1800735db
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1800735c8
mov rbx, qword [rsp]
movsxd rdx, dword [r10 + 0x90]
not eax
mov r9, qword [r10 + 0x98]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x180073651
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x180073649
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18007364c
mov rdx, r8
test rdx, rdx
jne 0x180073620
cmp r9, r10
je 0x180073664
cmp dword [r9], eax
jne 0x180073664
mov eax, dword [r9 + 8]
add rsp, 8
ret
mov eax, 0xffffffff
add rsp, 8
ret

Function at 0x180075340
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180075590
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18007545a
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800753a4
mov rax, qword [0x1800f5008]
cmp qword [rsp + 0x20], rax
ja 0x1800753a4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180075366
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1800a5830
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x1800753d5
jmp 0x18007545a
cmp dword [rsp + 0x50], 0x10000
jne 0x18007543d
cmp qword [rsp + 0x48], 0x10000
jb 0x18007543d
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18007541b
mov rax, qword [rsp + 0x28]
jmp 0x18007545c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x18007542b
xor eax, eax
jmp 0x18007545c
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180075455
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180075590
mov qword [rsp + 0x20], rax
jmp 0x180075366
xor eax, eax
add rsp, 0x68
ret
Function at 0x180075470
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800755d0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180075586
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800754cb
mov rax, qword [0x1800f5008]
cmp qword [rsp + 0x20], rax
ja 0x1800754cb
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18007548d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1800a5830
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x1800754fc
jmp 0x180075586
cmp dword [rsp + 0x50], 0x10000
jne 0x180075564
cmp qword [rsp + 0x48], 0x10000
jb 0x180075564
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180075542
mov rax, qword [rsp + 0x28]
jmp 0x180075588
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x180075552
xor eax, eax
jmp 0x180075588
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180075581
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800755d0
mov qword [rsp + 0x20], rax
jmp 0x18007548d
xor eax, eax
add rsp, 0x68
ret
Function at 0x180075620
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180075bb0
mov qword [rsp + 0x28], 0
cmp qword [0x180337948], 0
jne 0x180075668
cmp qword [0x180337940], 0
je 0x180075668
mov rax, qword [0x180337940]
mov qword [0x180337948], rax
cmp qword [0x180337948], 0
je 0x18007570e
mov rax, qword [0x180337948]
cmp qword [rax + 0x10], 0
je 0x18007570e
mov rax, qword [0x180337948]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18007570e
mov rax, qword [0x180337948]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18007570e
mov rax, qword [0x180337948]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x1800756d4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x1800756db
xor eax, eax
jmp 0x180075885
mov rax, qword [0x180337948]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.1800a5830
mov rax, qword [rsp + 0x28]
jmp 0x180075885
mov rax, qword [0x180337940]
mov qword [0x180337948], rax
jmp 0x180075730
mov rax, qword [0x180337948]
mov rax, qword [rax + 8]
mov qword [0x180337948], rax
cmp qword [0x180337948], 0
je 0x18007577d
cmp qword [0x180337948], 0
je 0x18007577b
mov rax, qword [0x180337948]
cmp qword [rax + 0x10], 0
je 0x18007577b
mov rax, qword [0x180337948]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18007577b
mov rax, qword [0x180337948]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18007577b
jmp 0x1800756ac
jmp 0x18007571e
mov rax, qword [rsp + 0x60]
and rax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180075890
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180075883
mov rax, qword [rsp + 0x48]
mov qword [0x180337948], rax
mov rax, qword [0x180337948]
mov dword [rax], 0x52727464
mov rax, qword [0x180337948]
mov qword [rax + 0x10], 0
mov rax, qword [0x180337948]
mov rcx, qword [0x180337940]
mov qword [rax + 8], rcx
mov rax, qword [0x180337948]
mov qword [0x180337940], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x180337948]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180075834
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x18007586e
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18007582a
mov rax, qword [0x180337948]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x1800756ac
xor eax, eax
add rsp, 0x58
ret
Function at 0x1800765a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800765e7
xor al, al
jmp 0x180076689
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x180076611
xor al, al
jmp 0x180076689
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x180076681
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x180076681
mov al, 1
jmp 0x180076689
jmp 0x180076687
xor al, al
add rsp, 0x78
ret

Function at 0x180076990
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180337940]
mov qword [rsp + 0x28], rax
jmp 0x1800769b0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800769df
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1800769dd
call sub.KERNEL32.dll_GetLastError
jmp 0x1800769e1
jmp 0x1800769a2
xor eax, eax
add rsp, 0x38
ret
Function at 0x1800770a0
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x180337958], eax
je 0x1800770bb
mov eax, 0x10dd
jmp 0x1800771e0
mov rax, qword [0x180337970]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180077165
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x180077130
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x180077130
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.180075cf0
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.18007a2e4
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x1800770c7
mov qword [0x180337970], 0
call fcn.180076750
mov rax, qword [0x180337968]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800771c9
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
call fcn.18007a2e4
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x180077181
mov qword [0x180337968], 0
mov dword [0x180337958], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x180077710
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x18033795c], 0
je 0x18007772d
mov eax, dword [0x18033795c]
jmp 0x1800777f3
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x180077740
xor eax, eax
jmp 0x1800777f3
mov ecx, 0x10
call fcn.180079e68
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1800777ae
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x180077793
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x38]
call fcn.18007a2e4
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x18033795c], eax
mov qword [0x180337960], 0
mov eax, dword [rsp + 0x20]
jmp 0x1800777f3
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1800777c8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x180077769
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x180337968]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x180337968], rax
xor eax, eax
add rsp, 0x48
ret

Function at 0x18007fe7c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18007feeb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18007feeb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18007feeb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18007feeb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18007feeb
cmp dword [rcx + 0x84], 0xe
jbe 0x18007feeb
cmp dword [rcx + 0xf8], 0
je 0x18007feeb
mov ecx, ebx
call fcn.18007ff9c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.18007fd78
nop
cmp dword [rbp + 0x20], 0
je 0x18007ff39
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18007ff44
int3
xor r8d, r8d
xor edx, edx
jmp 0x18007fe7c