joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180038bb0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180059010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x18005a550]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180038c23
mov eax, 0xa
jmp 0x180038cb2
test esi, esi
je 0x180038c45
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180038c68
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180038c68
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180038c61
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180038c68
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
movzx eax, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180043730
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180038ce0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x18005a55c]
mov ebx, edi
test ecx, ecx
je 0x180038e1b
mov rax, qword [0x18005a550]
add rax, 0x20
nop
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x180038d38
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180038d10
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x180038e1b
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xffffffff
setne r8b
call fcn.180038a00
mov r8d, dword [0x18005a55c]
cmp ebx, r8d
jae 0x180038da8
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x18005a550]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x180038da1
mov edx, esi
mov ecx, ebx
call fcn.180038bb0
mov edi, eax
test eax, eax
jne 0x180038da8
mov r8d, dword [0x18005a55c]
inc ebx
cmp ebx, r8d
jb 0x180038d70
cmp qword [rsp + 0x20], 0
je 0x180038e1b
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180038e07
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180038df8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180038dd0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180059d70]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180039210
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x180059d68], ebp
je 0x180039267
cmp rbx, 0x20
jae 0x180039250
xor ecx, ecx
jmp 0x180039252
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180059d68], ebp
jne 0x180039246
cmp qword [0x180059d70], r15
je 0x180039361
test rdi, rdi
jne 0x180039287
mov ecx, esi
call fcn.180038ce0
mov ebp, eax
jmp 0x180039366
mov ecx, dword [0x18005a55c]
mov ebx, r15d
test ecx, ecx
je 0x1800392af
mov r8, qword [0x18005a550]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x1800392b9
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1800392a0
mov ebp, 4
jmp 0x180039366
cmp ebx, 0xffffffff
je 0x1800392af
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x180039358
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.180038a00
mov edx, esi
mov ecx, ebx
call fcn.180038bb0
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x180039366
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180039342
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180039338
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180039310
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180059d70]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180039366
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x180039366
mov ebp, 2
xchg dword [0x180059d68], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x18003d620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x180059d18]
mov rdx, qword [str.Assembly_CSharp]
mov rcx, qword [0x180059ce0]
call rax
mov r9, qword [0x180059d40]
lea r8, str.ItemPickupBase
lea rdx, str.InventorySystem.Items.Pickups
mov rcx, qword [rax]
call r9
mov r9, qword [0x180059d48]
lea rdx, str.OnDestroy
xor r8d, r8d
mov rcx, qword [rax + 0x78]
call r9
lea rdx, [rbp - 0x38]
mov dword [rbp - 0x39], 0x65744953
lea rcx, [rbp + 7]
mov dword [rbp - 0x35], 0x7365446d
mov rbx, rax
mov dword [rbp - 0x31], 0x796f7274
mov byte [rbp - 0x2d], 0
call fcn.180002c00
lea r9, [0x180059e30]
mov qword [rsp + 0x20], rax
lea r8, [0x18003d500]
mov rcx, rbx
lea rdx, [rbp - 0x29]
call fcn.180039910
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x18003d702
mov rcx, qword [rbp - 0x29]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003d6fd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003d6fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180043b14
mov rax, qword [0x180059d18]
mov rdx, qword [str.Assembly_CSharp]
mov rcx, qword [0x180059ce0]
call rax
mov r9, qword [0x180059d40]
lea r8, str.PickupStandardPhysics
lea rdx, str.InventorySystem.Items.Pickups
mov rcx, qword [rax]
call r9
mov r9, qword [0x180059d48]
lea rdx, str.OnUpdate
xor r8d, r8d
mov rcx, qword [rax + 0x78]
call r9
lea rdx, [rbp - 0x38]
mov dword [rbp - 0x39], 0x6574497c
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x35], 0x6470556d
mov rbx, rax
mov dword [rbp - 0x31], 0x657461
call fcn.180002c00
lea r9, [0x180059e38]
mov qword [rsp + 0x20], rax
lea r8, [0x18003d340]
mov rcx, rbx
lea rdx, [rbp + 0x27]
call fcn.180039910
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x18003d7ce
mov rcx, qword [rbp + 0x27]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003d7c9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003d7c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180043b14
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rbp
ret
Function at 0x180042f70
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test edx, edx
je 0x180042fb2
cmp edx, 1
jne 0x180042fe0
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x180042c80]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret
cmp dword [0x180059fe8], 0
je 0x180042fe0
xor edx, edx
xor ecx, ecx
call fcn.180039210
mov rcx, qword [0x180059fe0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [0x180059fe0], rax
mov dword [0x180059fe8], eax
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x1800e4069
Capabilities:
Create thread

Disassembly:
jmp 0x18010fa70
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x180396380]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1803e10fc]
call fcn.1800e8ecf
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1800e77eb
mov r8, qword [rbp + 0x140]
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.1800e46bd
nop
lea rax, [0x1800e7309]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.1800e4785
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x18010fb56
lea rcx, [rbp + 8]
call fcn.1800e567b
jmp 0x18010fb6f
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1800e51e9
nop
lea rcx, [rbp + 8]
call fcn.1800e9352
lea rcx, [rbp - 0x30]
lea rdx, [0x1802cdfc0]
call fcn.1800e81be
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1800e669d
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x1800e45a5
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x1800fc900
mov byte [rsp + 0x20], r9b
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
mov rax, qword [0x180396380]
xor rax, rbp
mov qword [rbp + 0x148], rax
lea rcx, [0x1803e1103]
call fcn.1800e8ecf
mov rax, qword [rbp + 0x170]
mov rax, qword [rax]
mov qword [rbp + 8], rax
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x28], rax
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
lea rax, [rcx + rax*8]
lea r9, [rbp + 0x44]
mov r8d, 0x40
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
mov rdx, qword [rbp + 0x178]
mov qword [rcx + rax*8], rdx
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
lea rax, [rcx + rax*8]
lea r9, [rbp + 0x44]
mov r8d, dword [rbp + 0x44]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, byte [rbp + 0x188]
test eax, eax
jne 0x1800fca12
mov rax, qword [rbp + 0x170]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x70], rax
mov eax, dword [rbp + 0x180]
mov dword [rbp + 0x78], eax
lea rdx, [rbp + 0x68]
lea rcx, [0x1803c7348]
call fcn.1800e90a5
mov rax, qword [rbp + 0x28]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1802c9ec0]
call fcn.1800e81be
mov rax, rdi
mov rcx, qword [rbp + 0x148]
xor rcx, rbp
call fcn.1800e669d
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret
Function at 0x1800e47c1
Capabilities:
Write file on windows

Disassembly:
jmp 0x180195c90
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1803e10f5]
call fcn.1800e8ecf
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x180195ce7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x180195df3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x180195d8c
cmp qword [rbp + 0x28], 0
jle 0x180195d8c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x180195d2c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1800e89d4
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x180195de2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x180195de2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1800e4c5d
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x1800fbf40
mov byte [rsp + 0x20], r9b
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
mov rax, qword [0x180396380]
xor rax, rbp
mov qword [rbp + 0x148], rax
lea rcx, [0x1803e1103]
call fcn.1800e8ecf
mov rax, qword [rbp + 0x170]
mov rax, qword [rax]
mov qword [rbp + 8], rax
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x28], rax
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
lea rax, [rcx + rax*8]
lea r9, [rbp + 0x44]
mov r8d, 0x40
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
mov rdx, qword [rbp + 0x178]
mov qword [rcx + rax*8], rdx
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
lea rax, [rcx + rax*8]
lea r9, [rbp + 0x44]
mov r8d, dword [rbp + 0x44]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, byte [rbp + 0x188]
test eax, eax
jne 0x1800fc052
mov rax, qword [rbp + 0x170]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x70], rax
mov eax, dword [rbp + 0x180]
mov dword [rbp + 0x78], eax
lea rdx, [rbp + 0x68]
lea rcx, [0x1803c7348]
call fcn.1800e90a5
mov rax, qword [rbp + 0x28]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1802ca0a0]
call fcn.1800e81be
mov rax, rdi
mov rcx, qword [rbp + 0x148]
xor rcx, rbp
call fcn.1800e669d
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret

Function at 0x1800e5040
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x180294090
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x180396380]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x1803e1506]
call fcn.1800e8ecf
mov rax, qword [rbp + 0x140]
mov rax, qword [rax]
mov qword [rbp + 8], rax
movsxd rax, dword [rbp + 0x150]
mov rcx, qword [rbp + 8]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x28], rax
movsxd rax, dword [rbp + 0x150]
mov rcx, qword [rbp + 8]
lea rax, [rcx + rax*8]
lea r9, [rbp + 0x44]
mov r8d, 0x40
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsxd rax, dword [rbp + 0x150]
mov rcx, qword [rbp + 8]
mov rdx, qword [rbp + 0x148]
mov qword [rcx + rax*8], rdx
movsxd rax, dword [rbp + 0x150]
mov rcx, qword [rbp + 8]
lea rax, [rcx + rax*8]
lea r9, [rbp + 0x44]
mov r8d, dword [rbp + 0x44]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp - 0x20]
lea rdx, [0x18036aa70]
call fcn.1800e81be
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.1800e669d
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x1800e5045
Capabilities:
Create thread

Disassembly:
jmp 0x18010fbf0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x180396380]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1803e10fc]
call fcn.1800e8ecf
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1800e5784
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.1800e6788
nop
lea rax, [0x1800e73a4]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.1800e756b
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x18010fcca
lea rcx, [rbp + 8]
call fcn.1800e6224
jmp 0x18010fce3
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1800e51e9
nop
lea rcx, [rbp + 8]
call fcn.1800e60c6
lea rcx, [rbp - 0x30]
lea rdx, [0x1802ce040]
call fcn.1800e81be
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1800e669d
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x1800e522f
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x1800fcaa0
mov byte [rsp + 0x20], r9b
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
mov rax, qword [0x180396380]
xor rax, rbp
mov qword [rbp + 0x148], rax
lea rcx, [0x1803e1103]
call fcn.1800e8ecf
mov rax, qword [rbp + 0x170]
mov rax, qword [rax]
mov qword [rbp + 8], rax
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x28], rax
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
lea rax, [rcx + rax*8]
lea r9, [rbp + 0x44]
mov r8d, 0x40
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
mov rdx, qword [rbp + 0x178]
mov qword [rcx + rax*8], rdx
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
lea rax, [rcx + rax*8]
lea r9, [rbp + 0x44]
mov r8d, dword [rbp + 0x44]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, byte [rbp + 0x188]
test eax, eax
jne 0x1800fcbb2
mov rax, qword [rbp + 0x170]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x70], rax
mov eax, dword [rbp + 0x180]
mov dword [rbp + 0x78], eax
lea rdx, [rbp + 0x68]
lea rcx, [0x1803c7348]
call fcn.1800e90a5
mov rax, qword [rbp + 0x28]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1802c9ce0]
call fcn.1800e81be
mov rax, rdi
mov rcx, qword [rbp + 0x148]
xor rcx, rbp
call fcn.1800e669d
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret
Function at 0x1800e5897
Capabilities:
Hash data with md5

Disassembly:
jmp 0x18014ff90
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1803e114e]
call fcn.1800e8ecf
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rbp + 0xe0]
mov dword [rcx + rax], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rbp + 0xe0]
mov dword [rcx + rax], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rbp + 0xe0]
mov dword [rcx + rax], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rbp + 0xe0]
mov dword [rcx + rax], 0x10325476
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rbp + 0xe0]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rbp + 0xe0]
mov dword [rcx + rax + 0x10], 0
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1800e59b9
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x1800fc5c0
mov byte [rsp + 0x20], r9b
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
mov rax, qword [0x180396380]
xor rax, rbp
mov qword [rbp + 0x148], rax
lea rcx, [0x1803e1103]
call fcn.1800e8ecf
mov rax, qword [rbp + 0x170]
mov rax, qword [rax]
mov qword [rbp + 8], rax
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x28], rax
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
lea rax, [rcx + rax*8]
lea r9, [rbp + 0x44]
mov r8d, 0x40
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
mov rdx, qword [rbp + 0x178]
mov qword [rcx + rax*8], rdx
movsxd rax, dword [rbp + 0x180]
mov rcx, qword [rbp + 8]
lea rax, [rcx + rax*8]
lea r9, [rbp + 0x44]
mov r8d, dword [rbp + 0x44]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, byte [rbp + 0x188]
test eax, eax
jne 0x1800fc6d2
mov rax, qword [rbp + 0x170]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x70], rax
mov eax, dword [rbp + 0x180]
mov dword [rbp + 0x78], eax
lea rdx, [rbp + 0x68]
lea rcx, [0x1803c7348]
call fcn.1800e90a5
mov rax, qword [rbp + 0x28]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1802ca370]
call fcn.1800e81be
mov rax, rdi
mov rcx, qword [rbp + 0x148]
xor rcx, rbp
call fcn.1800e669d
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret
Function at 0x1800e5f54
Capabilities:
Write file on windows

Disassembly:
jmp 0x1801f20c0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x180396380]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x1803e1249]
call fcn.1800e8ecf
mov rax, qword [0x1803c0828]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
xorps xmm0, xmm0
movss dword [rax + 0x2ef0], xmm0
cmp qword [rbp + 0x160], 0
jne 0x1801f212f
jmp 0x1801f2185
mov qword [rbp + 0x28], 0
lea rcx, [rbp + 0x28]
call fcn.1800e9609
mov qword [rbp + 0x48], rax
lea rdx, [0x180344e10]
mov rcx, qword [rbp + 0x160]
call fcn.1800e615c
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x1801f2164
jmp 0x1801f2185
mov r9, qword [rbp + 0x68]
mov r8, qword [rbp + 0x28]
mov edx, 1
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ucrtbased.dll_fclose]
lea rcx, [rbp - 0x20]
lea rdx, [0x18033ca50]
call fcn.1800e81be
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.1800e669d
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret