joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002cf0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x18004b4b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov esi, edx
cmp qword [0x18004e1a0], 0
jne 0x180002d57
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18004e1a0], rax
test rax, rax
jne 0x180002d57
or eax, 0xffffffff
jmp 0x180002e15
mov r8d, esi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x180002d4f
xor ecx, ecx
mov qword [rsp + 0x40], rcx
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rcx
lea r9d, [rcx + 0x30]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rdi
call qword [0x18004e1a0]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
js 0x180002d4f
lea rcx, [0x18004b390]
mov rax, qword [0x18004b390]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov r9, qword [rsp + 0x68]
mov r8d, esi
lea rdx, str.iSafeMon::getParentProcessID_CurrentProcessID___d__ParentId___d
lea rcx, [rsp + 0x30]
call fcn.180003840
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edi, dword [rsp + 0x68]
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x180002e13
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, edi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180022860
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180003de0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18004b4b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, 1
xchg dword [0x18004e190], eax
mov rcx, qword [0x18004e188]
test rcx, rcx
je 0x180003ee4
mov rax, qword [0x18004e178]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rdi
test rax, rax
je 0x180003e34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x18004e188]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x18004e180]
xor edi, edi
test rcx, rcx
je 0x180003e8d
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x180003e6c
cmp dword [rsp + 0x20], 0x103
lea rcx, str.iSafeMon::FreeLibraryAndExitThread_ExitThread
je 0x180003e73
lea rcx, str.iSafeMon::Normal_ExitThread
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [0x18004e180]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x18004e180], rdi
mov rcx, qword [0x18004e178]
test rcx, rcx
je 0x180003ea6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x18004e178], rdi
mov rbx, qword [0x18004e188]
test rbx, rbx
je 0x180003ed3
mov rdx, qword [rbx + 8]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x180003ecb
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rcx, rbx
call fcn.18002283c
mov rbx, qword [rsp + 0x40]
mov qword [0x18004e188], rdi
mov rdi, qword [rsp + 0x30]
mov eax, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180022860
add rsp, 0x38
ret

Function at 0x1800040e0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x18004b4b0]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
call fcn.180024170
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jne 0x180004133
cmp dword [rsp + 0x28], 2
lea rax, str.kernelbase.dll
jae 0x18000413a
lea rax, str.kernel32.dll
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180022860
add rsp, 0x158
ret
Function at 0x180004160
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x18004b4b0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor r14d, r14d
mov rsi, rcx
mov rbp, rdx
lea rcx, [rsp + 0x42]
lea r8d, [r14 + 0x7e]
xor edx, edx
mov word [rsp + 0x40], r14w
call fcn.180024170
xor edx, edx
mov rcx, rsi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
je 0x1800042aa
mov rcx, 0xffffffffffffffff
mov eax, 2
mov qword [rsp + 0x100], rbx
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.180022834
mov r8d, edi
xor edx, edx
mov r9, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x18000426d
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x28]
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
mov dword [rsp + 0x34], r14d
call qword [sym.imp.VERSION.dll_VerQueryValueW]
cmp dword [rsp + 0x34], r14d
je 0x18000426d
mov rax, qword [rsp + 0x28]
lea rdx, str.StringFileInfo_04x_04xFileVersion
lea rcx, [rsp + 0x40]
movzx r9d, word [rax + 2]
movzx r8d, word [rax]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x30], r14d
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov rdx, qword [rsp + 0x20]
mov r8d, 0x208
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
test rbx, rbx
je 0x18000427a
mov rcx, rbx
call fcn.180023ad8
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180022860
mov rbp, qword [rsp + 0x108]
add rsp, 0xd0
pop r14
pop rdi
pop rsi
ret
mov eax, dword [rsp + 0x30]
jmp 0x180004286
Function at 0x180007ac0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
cmp dword [0x180043010], 0xffffffff
jne 0x180007b18
mov r8d, 0x114
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180024170
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x34], 6
jb 0x180007b06
mov dword [rsp + 0x24], 1
jmp 0x180007b0e
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x24]
mov dword [0x180043010], eax
cmp dword [0x180043010], 1
jne 0x180007b2b
mov dword [rsp + 0x20], 1
jmp 0x180007b33
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x158
ret
Function at 0x180008f40
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x1b8
mov r9b, 1
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x1c0]
call fcn.18000a510
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x180008faf
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x64
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x20]
add rsp, 0x1b8
ret
Function at 0x180009a60
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0xe8
cmp qword [0x18004cae0], 0
jne 0x180009ca6
lea rcx, [rsp + 0xb8]
call fcn.18001a260
lea rcx, [rsp + 0x90]
call fcn.18001a260
mov r8d, 8
lea rdx, [rsp + 0xb0]
lea rcx, [0x1800318a4]
call fcn.18000c150
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x44], eax
mov r8d, 0x10
lea rdx, [rsp + 0x70]
lea rcx, [0x1800318cc]
call fcn.18000c150
mov qword [rsp + 0x60], rax
mov r8d, 0x10
lea rdx, [rsp + 0x80]
lea rcx, [0x1800318c4]
call fcn.18000c150
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x60]
mov r9, rcx
mov r8, rax
lea rdx, str._S_S__x_S
lea rcx, [rsp + 0xb8]
call fcn.18001b5f0
lea rcx, [rsp + 0xb8]
call fcn.18001b7a0
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180009c8c
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x40], eax
mov r8d, 0x10
lea rdx, [rsp + 0x70]
lea rcx, [0x1800318cc]
call fcn.18000c150
mov qword [rsp + 0x68], rax
mov r8d, 0x10
lea rdx, [rsp + 0x80]
lea rcx, [0x1800318c4]
call fcn.18000c150
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x68]
mov r9, rcx
mov r8, rax
lea rdx, str._S_S__x
lea rcx, [rsp + 0x90]
call fcn.18001b5f0
lea rcx, [rsp + 0x90]
call fcn.18001b7a0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180009c76
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180009c17
mov dword [rsp + 0x30], 1
jmp 0x180009c1f
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x18004cae0], rax
cmp dword [rsp + 0x48], 0
je 0x180009c6b
cmp qword [0x18004cae0], 0
je 0x180009c6b
mov rax, qword [0x18004cae0]
mov dword [rax], 0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x90]
call fcn.18001a5e0
lea rcx, [rsp + 0xb8]
call fcn.18001a5e0
cmp qword [0x18004cae0], 0
je 0x180009cc0
mov rcx, qword [0x18004cae0]
call fcn.180009a40
jmp 0x180009cc2
xor eax, eax
add rsp, 0xe8
ret
Function at 0x18000a180
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000a1e7
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x34], eax
jne 0x18000a1d0
mov byte [rsp + 0x30], 1
jmp 0x18000a1e5
mov r8d, dword [rsp + 0x60]
mov edx, dword [rsp + 0x34]
lea rcx, str.ReadFromPipe:_Error_reading_from_pipe:_Number_read_was__d__requested_was__d_n
call fcn.180007b70
jmp 0x18000a1f3
lea rcx, str.ReadFromPipe:_Error_reading_from_pipe:_ReadFile_returned_False_n
call fcn.180007b70
movzx eax, byte [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x18000b480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x70]
call fcn.18000bfe0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18000b630
xor eax, eax
mov word [rsp + 0x20], ax
jmp 0x18000b4d1
movzx eax, word [rsp + 0x20]
inc ax
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp eax, dword [rcx + 0x14]
jae 0x18000b630
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
movzx ecx, word [rsp + 0x20]
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x48], rax
jne 0x18000b62b
mov dword [rsp + 0x24], 0
jmp 0x18000b53b
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x24], eax
jae 0x18000b5ed
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x24]
movzx eax, word [rax + rcx*2]
mov word [rsp + 0x2c], ax
movzx eax, word [rsp + 0x2c]
movzx ecx, word [rsp + 0x20]
cmp eax, ecx
jne 0x18000b5e8
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x24]
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x88]
mov r8, rax
mov edx, ecx
mov rcx, qword [rsp + 0x80]
call fcn.180023f80
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x18000b5d6
mov dword [rsp + 0x38], 1
jmp 0x18000b5de
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
jmp 0x18000b5ed
jmp 0x18000b531
cmp dword [rsp + 0x28], 0
jne 0x18000b629
movzx eax, word [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
add eax, dword [rcx + 0x10]
mov ecx, dword [rsp + 0x88]
mov r9d, eax
lea r8, [0x1800328d4]
mov edx, ecx
mov rcx, qword [rsp + 0x80]
call fcn.18002413c
mov dword [rsp + 0x28], 1
jmp 0x18000b630
jmp 0x18000b4c4
jmp 0x18000b63a
mov eax, dword [rsp + 0x28]
add rsp, 0x68
ret
Function at 0x18000b9c0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
call fcn.18000e340
test eax, eax
je 0x18000b9d9
xor eax, eax
jmp 0x18000baca
mov qword [rsp + 0x58], 0
mov edx, 0x10000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x40], rax
mov r8d, 0x8000
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x50], 0xffffffffffffffff
je 0x18000bac5
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18000baba
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x58]
add rsp, 0x68
ret

Function at 0x18000bc00
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0
mov edx, 2
mov rcx, qword [rsp + 0x50]
call fcn.18000ca00
test eax, eax
jne 0x18000bc6a
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x18000bc6a
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x18000bc6a
mov qword [rsp + 0x28], 0
jmp 0x18000bc75
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x18000c560
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x168
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rax, qword [rsp + 0x170]
mov r8, qword [rax]
lea rdx, str.8__U
lea rcx, [0x1800327b8]
call fcn.180011de0
mov edx, 1
lea rcx, [rsp + 0x50]
call fcn.180011ae0
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x18000c620
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18000c60f
mov rax, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [rsp + 0x30], 1
jmp 0x18000c615
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x30]
add rsp, 0x168
ret
Function at 0x18000cc00
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov eax, dword [rsp + 0x48]
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x38
ret

Function at 0x18000f6a0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x34], 0
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0xffffffffffffffff
je 0x18000f7b6
mov rcx, qword [rsp + 0x90]
call fcn.18000ccf0
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x58], 0x1c
cmp dword [rsp + 0x30], 0
je 0x18000f7ab
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x18000f7ab
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x64], eax
jne 0x18000f794
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x48
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18000f792
mov rcx, qword [rsp + 0x48]
call fcn.18000f570
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x50], 0
je 0x18000f792
mov rax, qword [rsp + 0x50]
add rax, 0x30
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
mov r9d, 4
lea r8, [rsp + 0x40]
mov rdx, rax
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18000f792
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x34], eax
jmp 0x18000f7ab
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x18000f70c
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x34]
add rsp, 0x88
ret
Function at 0x180010880
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x1800109ee
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
jne 0x1800109ee
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax + 0x88]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1800109ee
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x50]
cmp dword [rsp + 0x20], eax
jae 0x1800109ee
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800109ee
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0xc], 0
je 0x1800109ee
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x10], 0
je 0x1800109ee
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x50]
cmp dword [rax + 0x10], ecx
jae 0x1800109ee
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
test rax, rax
je 0x1800109ee
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1800109db
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
cmp qword [rax], rcx
jne 0x1800109cb
mov edx, 8
mov rcx, qword [rsp + 0x30]
call fcn.18000cc00
test eax, eax
je 0x1800109cb
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x30], rax
jmp 0x180010991
mov rax, qword [rsp + 0x28]
add rax, 0x14
mov qword [rsp + 0x28], rax
jmp 0x18001092d
add rsp, 0x48
ret

Function at 0x1800124c0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
cmp dword [0x18004b358], 0xffffffff
jne 0x180012526
mov r8d, 0x114
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180024170
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x34], 6
ja 0x180012514
cmp dword [rsp + 0x34], 6
jne 0x18001250a
cmp dword [rsp + 0x38], 1
ja 0x180012514
mov dword [rsp + 0x24], 0
jmp 0x18001251c
mov dword [rsp + 0x24], 1
mov eax, dword [rsp + 0x24]
mov dword [0x18004b358], eax
cmp dword [0x18004b358], 1
jne 0x180012539
mov dword [rsp + 0x20], 1
jmp 0x180012541
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x158
ret
Function at 0x180015110
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x20], 0
xor edx, edx
lea rcx, [0x180032df8]
call fcn.18000c280
mov qword [0x18004cd40], rax
xor edx, edx
lea rcx, [0x180032e18]
call fcn.18000c280
mov qword [0x18004cd48], rax
lea rcx, [rsp + 0x58]
call fcn.18001a260
mov r8d, 0x20
lea rdx, [rsp + 0x38]
lea rcx, [0x180032e44]
call fcn.18000c150
lea rdx, [0x180032de0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], 0x72
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], 0x64
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], 0x63
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
lea r8, [rsp + 0x38]
lea rdx, str._S__x
lea rcx, [rsp + 0x58]
call fcn.18001b5f0
lea rcx, [rsp + 0x58]
call fcn.18001b220
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rcx, qword [rsp + 0x98]
mov qword [rcx], rax
mov rax, qword [rsp + 0x98]
cmp qword [rax], 0
je 0x1800152ac
mov edx, 0xffffffff
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rsp + 0xa0]
mov qword [0x18004cd28], rax
mov rax, qword [rsp + 0xa8]
mov qword [0x18004cd30], rax
cmp qword [0x18004cd40], 0
je 0x180015271
cmp qword [0x18004cd48], 0
jne 0x180015273
jmp 0x1800152ac
lea rdx, [0x180013090]
mov ecx, 1
call qword [0x18004cd40]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18001529c
mov dword [rsp + 0x24], 1
jmp 0x1800152a4
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1800152d5
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x58]
call fcn.18001a5e0
mov eax, dword [rsp + 0x28]
add rsp, 0x88
ret
Function at 0x180015300
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp qword [0x18004cd40], 0
je 0x180015322
cmp qword [0x18004cd48], 0
jne 0x18001539f
mov edx, 1
lea rcx, [0x180032e70]
call fcn.18000c340
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rax, 0xa
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18001539d
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x18004cd38]
sub rcx, rax
mov rax, rcx
sub rax, 0xe
mov rcx, qword [rsp + 0x28]
mov dword [rcx + 0xa], eax
mov rax, qword [rsp + 0x28]
add rax, 0xa
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1800153ac
lea rcx, [0x180013090]
call qword [0x18004cd48]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret