joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004ef40
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.180045654
xor ebx, ebx
mov rdi, rax
cmp qword [0x1800860a0], rbx
jne 0x18004f046
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x18004f11b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18004f11b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1800860a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1800860a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1800860b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1800860c0], rax
test rax, rax
je 0x18004f03d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1800860b8], rax
jmp 0x18004f04d
mov rax, qword [0x1800860b8]
jmp 0x18004f054
mov rax, qword [0x1800860b8]
mov r11, qword [0x1800860c0]
cmp rax, rdi
je 0x18004f0bc
cmp r11, rdi
je 0x18004f0bc
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1800860c0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x18004f0bc
test rax, rax
je 0x18004f0bc
call rsi
test rax, rax
je 0x18004f0b6
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18004f0b6
test byte [rsp + 0x38], 1
jne 0x18004f0bc
bts ebp, 0x15
jmp 0x18004f0fa
mov rcx, qword [0x1800860a8]
cmp rcx, rdi
je 0x18004f0fa
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18004f0fa
call rax
mov rbx, rax
test rax, rax
je 0x18004f0fa
mov rcx, qword [0x1800860b0]
cmp rcx, rdi
je 0x18004f0fa
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18004f0fa
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1800860a0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18004f11b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x18004f11d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180016550
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1802dcd70]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x1800165de
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x180016582
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x1800165f0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1802dcd70]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x1800166f4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x1800166ef
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x1800166c4
cmp qword [rsp + 0x38], 2
jb 0x1800166c4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800166c4
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800166c4
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x180016637
jmp 0x180016786
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x180016786
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x18001675c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18001675c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18001675c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x1800166f4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x180017e80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.180270300
add rsp, 0x28
ret

Function at 0x180017ec0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.180272580
add rsp, 0x28
ret
Function at 0x180086070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov r8, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x38]
call fcn.180075c70
mov r8, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x40]
call fcn.180075c70
movss xmm0, dword [rsp + 0x3c]
ucomiss xmm0, dword [0x1802dd99c]
jp 0x1800860cf
je 0x1800860e3
movss xmm0, dword [rsp + 0x44]
divss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x30], xmm0
jmp 0x1800860ec
xorps xmm0, xmm0
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x38]
ucomiss xmm0, dword [0x1802dd99c]
jp 0x1800860fd
je 0x180086111
movss xmm0, dword [rsp + 0x40]
divss xmm0, dword [rsp + 0x38]
movss dword [rsp + 0x34], xmm0
jmp 0x18008611a
xorps xmm0, xmm0
movss dword [rsp + 0x34], xmm0
movss xmm2, dword [rsp + 0x30]
movss xmm1, dword [rsp + 0x34]
lea rcx, [rsp + 0x58]
call fcn.18003cb80
movsxd rax, dword [rsp + 0xe8]
imul rax, rax, 0x14
mov rcx, qword [rsp + 0xe0]
add rax, qword [rcx + 0x28]
mov qword [rsp + 0x48], rax
movsxd rax, dword [rsp + 0xf0]
imul rax, rax, 0x14
mov rcx, qword [rsp + 0xe0]
add rax, qword [rcx + 0x28]
mov qword [rsp + 0x50], rax
movzx eax, byte [rsp + 0x118]
test eax, eax
je 0x18008627e
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x70]
call fcn.1800837f0
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x60]
call fcn.1800838a0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
jmp 0x1800861c8
mov rax, qword [rsp + 0x20]
add rax, 0x14
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x20], rax
jae 0x180086279
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x20]
movss xmm2, dword [rax + 4]
mov rax, qword [rsp + 0x20]
movss xmm1, dword [rax]
lea rcx, [rsp + 0x80]
call fcn.18003cb80
mov r8, qword [rsp + 0xf8]
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.180075c70
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.180083d60
mov r8, rax
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x98]
call fcn.180075c10
mov qword [rsp + 0x78], rax
mov r9, qword [rsp + 0x68]
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0xa0]
call fcn.180083950
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], rax
jmp 0x1800861ba
jmp 0x18008631a
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
jmp 0x180086298
mov rax, qword [rsp + 0x28]
add rax, 0x14
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x28], rax
jae 0x18008631a
mov rax, qword [rsp + 0x28]
movss xmm2, dword [rax + 4]
mov rax, qword [rsp + 0x28]
movss xmm1, dword [rax]
lea rcx, [rsp + 0xa8]
call fcn.18003cb80
mov r8, qword [rsp + 0xf8]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.180075c70
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.180083d60
mov r8, rax
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0xc0]
call fcn.180075c10
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
jmp 0x18008628a
add rsp, 0xd8
ret
Function at 0x180095ea0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x180095ec6
mov dword [rsp + 0x20], 1
jmp 0x180095ece
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x1800bae30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x180495080]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x10]
and eax, 1
test eax, eax
jne 0x1800bae66
jmp 0x1800bb080
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 4]
and eax, 0xc0
test eax, eax
jne 0x1800bae81
mov byte [rsp + 0x20], 1
jmp 0x1800bae86
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x1800baead
mov rax, qword [rsp + 0x80]
movss xmm0, dword [rax + 0x50]
movss dword [rsp + 0x38], xmm0
jmp 0x1800baeb6
xorps xmm0, xmm0
movss dword [rsp + 0x38], xmm0
mov rax, qword [rsp + 0x80]
movss xmm0, dword [rax + 0x2c]
subss xmm0, dword [rsp + 0x38]
movss dword [rsp + 0x2c], xmm0
mov rax, qword [rsp + 0x88]
movss xmm0, dword [rsp + 0x2c]
addss xmm0, dword [rax + 0x10]
comiss xmm0, dword [rsp + 0x90]
jbe 0x1800baef6
mov dword [rsp + 0x3c], 0xffffffff
jmp 0x1800baefe
mov dword [rsp + 0x3c], 1
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x58]
call fcn.1800e37a0
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x24], eax
jmp 0x1800baf4b
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x24]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jl 0x1800bb052
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
cmp dword [rsp + 0x24], eax
jge 0x1800bb052
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x60], rax
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x60]
call fcn.1800e21e0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 4]
and eax, 0x20
test eax, eax
je 0x1800baf9e
jmp 0x1800bb052
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 4]
and eax, 0xc0
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 4]
and ecx, 0xc0
cmp eax, ecx
je 0x1800bafc5
jmp 0x1800bb052
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x40]
movss xmm0, dword [rsp + 0x2c]
addss xmm0, dword [rax + 0x10]
mov rax, qword [rsp + 0x50]
subss xmm0, dword [rax + 0x381c]
movss dword [rsp + 0x48], xmm0
mov rax, qword [rsp + 0x40]
movss xmm0, dword [rsp + 0x2c]
addss xmm0, dword [rax + 0x10]
mov rax, qword [rsp + 0x40]
addss xmm0, dword [rax + 0x14]
mov rax, qword [rsp + 0x50]
addss xmm0, dword [rax + 0x381c]
movss dword [rsp + 0x4c], xmm0
cmp dword [rsp + 0x30], 0
jge 0x1800bb034
movss xmm0, dword [rsp + 0x90]
comiss xmm0, dword [rsp + 0x48]
ja 0x1800bb04b
cmp dword [rsp + 0x30], 0
jle 0x1800bb04d
movss xmm0, dword [rsp + 0x4c]
comiss xmm0, dword [rsp + 0x90]
jbe 0x1800bb04d
jmp 0x1800bb052
jmp 0x1800baf3b
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x34], eax
je 0x1800bb080
mov eax, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
mov r8d, eax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.1800badf0
add rsp, 0x78
ret
Function at 0x1800e4190
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x90], 0x40000000
jbe 0x1800e41f1
mov rax, qword [rsp + 0x90]
sub rax, 0x40000000
cmp qword [rsp + 0x30], rax
jae 0x1800e41f1
mov rax, qword [rsp + 0x90]
sub rax, 0x40000000
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x90]
add rax, 0x40000000
cmp qword [rsp + 0x28], rax
jbe 0x1800e4219
mov rax, qword [rsp + 0x90]
add rax, 0x40000000
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
sub rax, 0xfff
mov qword [rsp + 0x28], rax
mov rax, qword [0x18049efb0]
mov qword [rsp + 0x20], rax
jmp 0x1800e4244
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800e427e
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x20], rax
jb 0x1800e4264
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x20], rax
jb 0x1800e4266
jmp 0x1800e4237
mov rax, qword [rsp + 0x20]
cmp qword [rax + 8], 0
je 0x1800e427c
mov rax, qword [rsp + 0x20]
jmp 0x1800e43f0
jmp 0x1800e4237
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jb 0x1800e42e7
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.1800e3f90
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1800e42ba
jmp 0x1800e42e7
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800e42e5
jmp 0x1800e42e7
jmp 0x1800e428b
cmp qword [rsp + 0x20], 0
jne 0x1800e4358
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x40], rax
ja 0x1800e4358
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call fcn.1800e4070
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1800e432b
jmp 0x1800e4358
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800e4356
jmp 0x1800e4358
jmp 0x1800e42fc
cmp qword [rsp + 0x20], 0
je 0x1800e43eb
mov rax, qword [rsp + 0x20]
add rax, 0x40
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x10], 0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x48]
add rax, 0x40
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
cmp rax, 0xfc0
jbe 0x1800e438b
mov rax, qword [rsp + 0x20]
mov rcx, qword [0x18049efb0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
mov qword [0x18049efb0], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x88
ret
Function at 0x1800e6150
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x180493728]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x1800e62de
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1800e62d3
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
jb 0x1800e62b4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x3c], eax
jne 0x1800e62b4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x38], eax
je 0x1800e62b4
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x1800e6221
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0x80
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x18049ac38]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x1800e621f
jmp 0x1800e62d3
jmp 0x1800e628b
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x1800e628b
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl eax, 1
mov eax, eax
shl rax, 2
mov r9, rax
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x18049ac38]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1800e626c
jmp 0x1800e62d3
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
mov edx, dword [rsp + 0x38]
mov dword [rcx + rax*4], edx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1800e61a4
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180258fa0
add rsp, 0x68
ret
Function at 0x1800e6300
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rcx, qword [rsp + 0x40]
call fcn.1800e6150
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x1800e63c2
mov dword [rsp + 0x20], 0
jmp 0x1800e635f
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x1800e63c2
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800e63c0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.1800e5fa0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800e6355
add rsp, 0x38
ret

Function at 0x1800e63d0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x1800e645f
mov dword [rsp + 0x20], 0
jmp 0x1800e63f8
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x1800e6448
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800e6446
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800e63ee
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x18049ac38]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x38
ret
Function at 0x1800e6470
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov eax, dword [rsp + 0x60]
imul rax, rax, 0x38
mov rcx, qword [0x18049efa0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 5
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800e64da
mov rax, qword [rsp + 0x30]
sub rax, 5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800e6503
mov eax, 0xa
jmp 0x1800e6634
cmp dword [rsp + 0x68], 0
je 0x1800e656e
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x30]
add rax, 5
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800e656c
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x48]
mov byte [rax + 1], 0xf9
jmp 0x1800e65ba
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800e659e
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call fcn.180263730
jmp 0x1800e65ba
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call fcn.180263730
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x68]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x68]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x20], al
xor eax, eax
add rsp, 0x58
ret