joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180334260
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.180333ec0
lea rcx, [rsp + 0x20]
call fcn.180333f00
movzx eax, al
test eax, eax
jne 0x1803342a5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.180333ee0
mov rax, qword [rsp + 0x40]
jmp 0x18033439f
lea rcx, [rsp + 0x20]
call fcn.180333fd0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.180333f80
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.18029d450
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180233180
lea rcx, [rsp + 0x28]
call fcn.180233220
movzx eax, al
test eax, eax
jne 0x18033433f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1802331c0
lea rcx, [rsp + 0x20]
call fcn.180333ee0
mov rax, qword [rsp + 0x50]
jmp 0x18033439f
lea rcx, [rsp + 0x20]
call fcn.180333fd0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.180233670
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1803eb8f0
lea rcx, [rsp + 0x28]
call fcn.1802fdd30
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1802331c0
lea rcx, [rsp + 0x20]
call fcn.180333ee0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x180335af0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x180347560
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.18029f760
lea rcx, [rsp + 0x48]
call fcn.18029f760
call fcn.180312970
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.18029f650
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1803475cf
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.18029f7f0
lea rcx, [rsp + 0x78]
call fcn.18029f7f0
mov eax, dword [rsp + 0x24]
jmp 0x180347660
call fcn.180312970
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.18029f650
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x180347616
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.18029f7f0
lea rcx, [rsp + 0x78]
call fcn.18029f7f0
mov eax, dword [rsp + 0x2c]
jmp 0x180347660
lea rcx, [rsp + 0x48]
call fcn.18029fb40
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.18029fb40
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.18029f7f0
lea rcx, [rsp + 0x78]
call fcn.18029f7f0
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x180361e40
Capabilities:
Get system information on windows

Disassembly:
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_sendto
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1806072aa]
call fcn.180278fb0
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1804f8070]
call fcn.180278d80
mov eax, edi
add rsp, 0x70
pop rdi
ret
Function at 0x180364ea0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_sendto
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
lea rcx, [0x180607413]
call fcn.180278fb0
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x2c]
call fcn.180364f20
mov rcx, qword [rsp + 0x80]
mov dword [rcx], eax
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x50]
mov dword [rax + 4], ecx
mov rcx, rsp
lea rdx, [0x1804f8550]
call fcn.180278d80
add rsp, 0x70
pop rdi
ret

Function at 0x180378570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rcx, [0x1806079fe]
call fcn.180278fb0
mov eax, dword [rsp + 0x70]
mov ecx, 1
mov dword [rsp + 0x3c], ecx
movzx ecx, al
mov eax, dword [rsp + 0x3c]
shl eax, cl
dec eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0
jmp 0x1803785ed
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x70]
movzx ecx, al
mov eax, dword [rsp + 0x68]
shr eax, cl
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x78]
mov ecx, dword [rsp + 0x24]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x88]
cmp dword [rsp + 0x28], eax
jae 0x18037868c
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x68]
and ecx, eax
mov eax, ecx
add eax, dword [rsp + 0x24]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x28], 0
jne 0x180378620
mov byte [rsp + 0x40], 0x7b
jmp 0x180378625
mov byte [rsp + 0x40], 0x7c
movzx edx, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
call fcn.18034e430
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x180378645
mov eax, dword [rsp + 0x30]
jmp 0x1803786b8
xor eax, eax
test eax, eax
jne 0x180378612
mov edx, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x80]
call fcn.1803762d0
mov r8, 0xffffffffffffffff
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call fcn.18034e470
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x180378681
mov eax, dword [rsp + 0x34]
jmp 0x1803786b8
xor eax, eax
test eax, eax
jne 0x18037864b
jmp 0x1803785c2
xor eax, eax
cmp eax, 0x7d
je 0x1803786b6
mov dl, 0x7d
mov rcx, qword [rsp + 0x60]
call fcn.18034e430
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x1803786b0
mov eax, dword [rsp + 0x38]
jmp 0x1803786b8
xor eax, eax
test eax, eax
jne 0x180378693
xor eax, eax
add rsp, 0x50
pop rdi
ret
Function at 0x180389700
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
lea rcx, [0x180607e3d]
call fcn.180278fb0
nop
cmp qword [rsp + 0x30], 0
jne 0x180389739
mov r8d, 0xa9
lea rdx, [0x1805927b0]
lea rcx, [0x1805927f8]
call fcn.1803a4020
nop
xor eax, eax
test eax, eax
jne 0x180389717
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x48], 0
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
movabs rdx, 0x6a09e667f3bcc908
mov qword [rcx + rax + 8], rdx
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x30]
movabs rdx, 0xbb67ae8584caa73b
mov qword [rcx + rax + 8], rdx
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x30]
movabs rdx, 0x3c6ef372fe94f82b
mov qword [rcx + rax + 8], rdx
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rsp + 0x30]
movabs rdx, 0xa54ff53a5f1d36f1
mov qword [rcx + rax + 8], rdx
mov eax, 8
imul rax, rax, 4
mov rcx, qword [rsp + 0x30]
movabs rdx, 0x510e527fade682d1
mov qword [rcx + rax + 8], rdx
mov eax, 8
imul rax, rax, 5
mov rcx, qword [rsp + 0x30]
movabs rdx, 0x9b05688c2b3e6c1f
mov qword [rcx + rax + 8], rdx
mov eax, 8
imul rax, rax, 6
mov rcx, qword [rsp + 0x30]
movabs rdx, 0x1f83d9abfb41bd6b
mov qword [rcx + rax + 8], rdx
mov eax, 8
imul rax, rax, 7
mov rcx, qword [rsp + 0x30]
movabs rdx, 0x5be0cd19137e2179
mov qword [rcx + rax + 8], rdx
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x18038b230
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
lea rcx, [0x180607e6e]
call fcn.180278fb0
nop
cmp qword [rsp + 0x30], 0
jne 0x18038b269
mov r8d, 0xc6
lea rdx, [0x1805929e0]
lea rcx, [0x180592a28]
call fcn.1803a4020
nop
xor eax, eax
test eax, eax
jne 0x18038b247
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x28], 0
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0x5be0cd19
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1803917e0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
lea rcx, [0x180607e9f]
call fcn.180278fb0
nop
cmp qword [rsp + 0x30], 0
jne 0x180391819
mov r8d, 0x9f
lea rdx, [0x180592c10]
lea rcx, [0x180592c50]
call fcn.1803a4020
nop
xor eax, eax
test eax, eax
jne 0x1803917f7
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0x10325476
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0xc3d2e1f0
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x1c], 0
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x180392b10
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
lea rcx, [0x180607ed0]
call fcn.180278fb0
nop
cmp qword [rsp + 0x30], 0
jne 0x180392b49
mov r8d, 0xe3
lea rdx, [0x180592e88]
lea rcx, [0x180592ec8]
call fcn.1803a4020
nop
xor eax, eax
test eax, eax
jne 0x180392b27
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax + 8], 0x10325476
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x18], 0
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x180395430
Capabilities:
Hash data using tiger

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x180607f01]
call fcn.180278fb0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
shr rax, 0
movzx eax, al
lea rcx, [0x180509040]
lea rdx, [0x180509040]
mov r8, qword [rsp + 0x20]
shr r8, 0x10
movzx r8d, r8b
mov rdx, qword [rdx + r8*8 + 0x800]
mov rax, qword [rcx + rax*8]
xor rax, rdx
lea rcx, [0x180509040]
mov rdx, qword [rsp + 0x20]
shr rdx, 0x20
movzx edx, dl
xor rax, qword [rcx + rdx*8 + 0x1000]
lea rcx, [0x180509040]
mov rdx, qword [rsp + 0x20]
shr rdx, 0x30
movzx edx, dl
xor rax, qword [rcx + rdx*8 + 0x1800]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
lea rax, [0x180509040]
mov rcx, qword [rsp + 0x20]
shr rcx, 8
movzx ecx, cl
lea rdx, [0x180509040]
mov r8, qword [rsp + 0x20]
shr r8, 0x18
movzx r8d, r8b
mov rdx, qword [rdx + r8*8 + 0x1000]
mov rax, qword [rax + rcx*8 + 0x1800]
xor rax, rdx
lea rcx, [0x180509040]
mov rdx, qword [rsp + 0x20]
shr rdx, 0x28
movzx edx, dl
xor rax, qword [rcx + rdx*8 + 0x800]
mov rcx, qword [rsp + 0x20]
shr rcx, 0x38
movzx ecx, cl
lea rdx, [0x180509040]
xor rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x48]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 5
je 0x1803955a4
cmp dword [rsp + 0x28], 7
je 0x1803955bc
cmp dword [rsp + 0x28], 9
je 0x1803955d4
jmp 0x1803955ea
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x20]
lea rax, [rax + rcx*4]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
jmp 0x1803955ea
mov rax, qword [rsp + 0x20]
shl rax, 3
sub rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
jmp 0x1803955ea
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x20]
lea rax, [rax + rcx*8]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
add rsp, 0x30
pop rdi
ret
Function at 0x1803a4630
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x30]
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
lea rcx, [0x180608790]
call fcn.180278fb0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 0xf0000020
mov r9d, 1
lea r8, [0x1805980f0]
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1803a46be
mov dword [rsp + 0x20], 0xf0000028
mov r9d, 1
lea r8, [0x180598120]
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1803a46be
xor eax, eax
jmp 0x1803a46fb
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
cmp eax, 1
jne 0x1803a46ec
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [rsp + 0x68]
jmp 0x1803a46fb
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x18051aab0]
call fcn.180278d80
mov rax, rdi
add rsp, 0x50
pop rdi
ret
Function at 0x1803a9cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
lea rcx, [0x180608bcb]
call fcn.180278fb0
nop
cmp dword [rsp + 0x60], 0
je 0x1803a9eab
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x68]
mov ecx, dword [rcx + 4]
cmp dword [rax + 8], ecx
jne 0x1803a9e49
mov rax, qword [rsp + 0x68]
cmp dword [rax + 0xc], 0
jne 0x1803a9d71
mov dword [rsp + 0x20], 0
jmp 0x1803a9d26
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x10]
cmp dword [rsp + 0x20], eax
jge 0x1803a9d6f
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
movzx eax, byte [rcx + rax + 0x14]
inc eax
and eax, 0xff
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x68]
mov byte [rdx + rcx + 0x14], al
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
movzx eax, byte [rcx + rax + 0x14]
test eax, eax
je 0x1803a9d6d
jmp 0x1803a9d6f
jmp 0x1803a9d1c
jmp 0x1803a9dd4
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 4]
dec eax
mov dword [rsp + 0x20], eax
jmp 0x1803a9d8b
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x10]
cmp dword [rsp + 0x20], eax
jl 0x1803a9dd4
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
movzx eax, byte [rcx + rax + 0x14]
inc eax
and eax, 0xff
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x68]
mov byte [rdx + rcx + 0x14], al
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
movzx eax, byte [rcx + rax + 0x14]
test eax, eax
je 0x1803a9dd2
jmp 0x1803a9dd4
jmp 0x1803a9d81
mov rax, qword [rsp + 0x68]
add rax, 0x138
mov rcx, qword [rsp + 0x68]
add rcx, 0xa4
mov rdx, qword [rsp + 0x68]
add rdx, 0x14
mov qword [rsp + 0x28], rdx
mov r8, qword [rsp + 0x68]
movsxd r8, dword [r8]
imul r8, r8, 0xc0
mov qword [rsp + 0x30], r8
lea r9, [0x1805b4740]
mov r8, rax
mov rdx, rcx
mov rax, qword [rsp + 0x28]
mov rcx, rax
mov rax, qword [rsp + 0x30]
call qword [r9 + rax + 0x28]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x1803a9e3d
mov eax, dword [rsp + 0x24]
jmp 0x1803a9ead
mov rax, qword [rsp + 0x68]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x68]
movsxd rcx, dword [rcx + 8]
mov rdx, qword [rsp + 0x68]
movzx ecx, byte [rdx + rcx + 0xa4]
xor eax, ecx
mov rcx, qword [rsp + 0x58]
mov byte [rcx], al
mov rax, qword [rsp + 0x58]
inc rax
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 8]
inc eax
mov rcx, qword [rsp + 0x68]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x60]
dec eax
mov dword [rsp + 0x60], eax
jmp 0x1803a9ce6
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x1803bbd80
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x20]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
mov rax, qword [0x180591580]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rcx, [0x180609a06]
call fcn.180278fb0
mov dword [rsp + 0x20], 0
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x1803bbfdf
mov dword [rsp + 0x38], 0x1c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1803bbfd3
mov dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x38]
cmp rax, 0x10
jb 0x1803bbf5c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x44], eax
jne 0x1803bbf5c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x40], eax
je 0x1803bbf5c
mov rax, qword [rsp + 0x90]
cmp qword [rax], 0
jne 0x1803bbea4
mov rax, qword [rsp + 0x90]
mov dword [rax + 8], 0x80
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x1805b7c68]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
mov rax, qword [rsp + 0x90]
cmp qword [rax], 0
jne 0x1803bbe9f
mov dword [rsp + 0x20], 0
jmp 0x1803bbf7b
jmp 0x1803bbf27
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x90]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x1803bbf27
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rsp + 0x90]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 8]
shl rax, 2
mov r9, rax
mov rax, qword [rsp + 0x90]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1805b7c68]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x1803bbf17
mov dword [rsp + 0x20], 0
jmp 0x1803bbf7b
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x68]
mov qword [rax], rcx
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
mov edx, dword [rsp + 0x40]
mov dword [rcx + rax*4], edx
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rsp + 0x90]
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x38], 0x1c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1803bbe0d
cmp dword [rsp + 0x20], 0
je 0x1803bbf95
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1803bbf95
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
jne 0x1803bbfd3
mov rax, qword [rsp + 0x90]
cmp qword [rax], 0
je 0x1803bbfd3
mov rax, qword [rsp + 0x90]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1805b7c68]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x90]
mov qword [rax], 0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rsp + 0x20]
mov edi, eax
mov rcx, rsp
lea rdx, [0x18051ee70]
call fcn.180278d80
mov eax, edi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1802791f0
add rsp, 0x80
pop rdi
ret
Function at 0x1803bc020
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x180609a06]
call fcn.180278fb0
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rcx, qword [rsp + 0x40]
call fcn.1803bbd80
test eax, eax
jne 0x1803bc086
mov dword [rsp + 0x20], 9
jmp 0x1803bc109
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x1803bc109
mov dword [rsp + 0x24], 0
jmp 0x1803bc0a5
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x24], eax
jae 0x1803bc109
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1803bc107
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.1803bbb50
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x1803bc09b
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret

Function at 0x1803bc120
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x180609a06]
call fcn.180278fb0
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x1803bc1be
mov dword [rsp + 0x20], 0
jmp 0x1803bc155
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x1803bc1a6
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1803bc1a4
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x1803bc14b
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1805b7c68]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x30
pop rdi
ret