joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180076f20
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x210
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x250], rbx
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov r12, r9
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rcx, rdx
call fcn.180074a30
lea rcx, [rsp + 0x28]
call fcn.180075680
nop
xor r9d, r9d
mov r8d, ebx
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.180076970
test eax, eax
je 0x1800770b3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov r8d, 1
lea rdx, str.SeDebugPrivilege
call fcn.18008a080
xor r13d, r13d
mov ebx, r13d
lea rcx, [rsp + 0x28]
call fcn.180075690
mov ebp, eax
test eax, eax
jle 0x180077096
mov dword [rsp + 0x50], r13d
xor edx, edx
mov r8d, 0x1a4
lea rcx, [rsp + 0x54]
call fcn.1800369b0
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.1800766b0
mov rdx, rax
lea rcx, [rsp + 0x50]
mov r8d, 0xa0
call fcn.1800378f0
mov r11, qword [rdi]
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [r11 + 0x80]
nop
mov rax, qword [rsp + 0x20]
cmp dword [rax - 8], 0
jne 0x180077045
mov eax, dword [rsp + 0x50]
test eax, eax
jne 0x18007702a
lea rdx, str.System_Idle_Process
jmp 0x18007703b
cmp eax, 4
je 0x180077034
cmp eax, 8
jne 0x180077045
lea rdx, [0x1800cc450]
lea rcx, [rsp + 0x20]
call fcn.18001d4c0
mov r8d, 0x103
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0xf4]
call fcn.180036c70
mov r8, r12
lea rdx, [rsp + 0xf4]
mov rcx, rdi
call fcn.180077c40
test eax, eax
je 0x180077082
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.180074a40
nop
lea rcx, [rsp + 0x20]
call fcn.18001d340
inc ebx
cmp ebx, ebp
jl 0x180076fc0
mov rdx, rsi
mov rcx, rdi
call fcn.180076c00
nop
lea rcx, [rsp + 0x28]
call fcn.1800766c0
mov eax, 1
jmp 0x1800770bf
lea rcx, [rsp + 0x28]
call fcn.1800766c0
xor eax, eax
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.180036980
mov rbx, qword [rsp + 0x250]
add rsp, 0x210
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180077560
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, rdx
mov rbx, rcx
test rdx, rdx
jne 0x18007757e
mov dword [rcx + 8], 0x57
add rsp, 0x20
pop rbx
ret
mov edx, r8d
mov rcx, rax
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, eax
test eax, eax
jne 0x18007759e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x1800775b0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
call fcn.180070470
mov r11, qword [0x180122f18]
test r11, r11
jne 0x1800775dd
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x30], rsi
lea ecx, [rdx + 2]
call r11
mov rsi, rax
test rax, rax
jne 0x180077610
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [rsp + 0x30]
mov dword [rbx + 8], eax
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov edi, eax
cmp eax, 0xffffffff
jne 0x180077629
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
xor eax, eax
cmp edi, 0xffffffff
setne al
add rsp, 0x20
pop rdi
ret

Function at 0x180077650
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
call fcn.180070470
mov r11, qword [0x180122f18]
test r11, r11
jne 0x18007767d
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x30], rsi
lea ecx, [rdx + 2]
call r11
mov rsi, rax
test rax, rax
jne 0x1800776b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [rsp + 0x30]
mov dword [rbx + 8], eax
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, eax
cmp eax, 0xffffffff
jne 0x1800776c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
xor eax, eax
cmp edi, 0xffffffff
setne al
add rsp, 0x20
pop rdi
ret
Function at 0x1800776f0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov esi, edx
mov rbx, rcx
call fcn.180070470
mov r11, qword [0x180122f18]
test r11, r11
je 0x180077734
xor edx, edx
mov r8d, esi
lea ecx, [rdx + 1]
call r11
mov rsi, rax
test rax, rax
jne 0x180077746
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, eax
test eax, eax
jne 0x180077760
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 8], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x180077990
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rdx
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.1800369b0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180020a90
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180036980
add rsp, 0x150
pop rbx
ret

Function at 0x180077cc0
Capabilities:
Suspend thread

Disassembly:
push r12
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov ebx, edx
mov r12, rcx
call fcn.180070470
cmp qword [0x180122f18], 0
je 0x180077d26
lea rcx, [rsp + 0x28]
call fcn.180025a60
nop
mov rax, qword [r12]
lea r8, [rsp + 0x28]
mov edx, ebx
mov rcx, r12
call qword [rax + 0xd0]
mov ebp, eax
test eax, eax
jne 0x180077d2a
lea rcx, [rsp + 0x28]
call fcn.180025a70
xor eax, eax
jmp 0x180077d99
xor edi, edi
xor esi, esi
cmp dword [rsp + 0x30], esi
jle 0x180077d8d
nop word [rax + rax]
mov rax, qword [rsp + 0x28]
mov r8d, dword [rax + rsi*4]
xor edx, edx
lea ecx, [rdx + 2]
call qword [0x180122f18]
mov rbx, rax
test rsi, rsi
jne 0x180077d61
test rax, rax
je 0x180077d80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
inc rsi
cmp edi, dword [rsp + 0x30]
jge 0x180077d8d
jmp 0x180077d40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r12 + 8], eax
xor ebp, ebp
lea rcx, [rsp + 0x28]
call fcn.180025a70
mov eax, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x180077dc0
Capabilities:
Resume thread

Disassembly:
push r12
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov ebx, edx
mov r12, rcx
call fcn.180070470
cmp qword [0x180122f18], 0
je 0x180077e26
lea rcx, [rsp + 0x28]
call fcn.180025a60
nop
mov rax, qword [r12]
lea r8, [rsp + 0x28]
mov edx, ebx
mov rcx, r12
call qword [rax + 0xd0]
mov ebp, eax
test eax, eax
jne 0x180077e2a
lea rcx, [rsp + 0x28]
call fcn.180025a70
xor eax, eax
jmp 0x180077e99
xor edi, edi
xor esi, esi
cmp dword [rsp + 0x30], esi
jle 0x180077e8d
nop word [rax + rax]
mov rax, qword [rsp + 0x28]
mov r8d, dword [rax + rsi*4]
xor edx, edx
lea ecx, [rdx + 2]
call qword [0x180122f18]
mov rbx, rax
test rsi, rsi
jne 0x180077e61
test rax, rax
je 0x180077e80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
inc rsi
cmp edi, dword [rsp + 0x30]
jge 0x180077e8d
jmp 0x180077e40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r12 + 8], eax
xor ebp, ebp
lea rcx, [rsp + 0x28]
call fcn.180025a70
mov eax, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret

Function at 0x180077ec0
Capabilities:
Acquire debug privileges

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov ebx, r9d
mov r13, r8
mov rbp, rdx
mov r12, rcx
lea rcx, [rsp + 0x28]
call fcn.180025a60
nop
mov rax, qword [r12]
mov r8d, ebx
lea rdx, [rsp + 0x28]
mov rcx, r12
call qword [rax + 0xb0]
test eax, eax
jne 0x180077f23
lea rcx, [rsp + 0x28]
call fcn.180025a70
xor eax, eax
jmp 0x180077fbf
xor esi, esi
mov ebx, esi
cmp dword [rsp + 0x30], ebx
jle 0x180077fb0
mov edi, esi
test esi, esi
jne 0x180077f54
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea r8d, [rsi + 1]
lea rdx, str.SeDebugPrivilege
call fcn.18008a080
mov esi, 1
mov rax, qword [rsp + 0x28]
mov r9, qword [r12]
mov r8d, dword [rdi + rax]
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [r9 + 0x80]
nop
mov r8, r13
mov rdx, qword [rsp + 0x60]
mov rcx, r12
call fcn.180077c40
test eax, eax
je 0x180077f9a
mov rax, qword [rsp + 0x28]
mov r8d, dword [rdi + rax]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.180025ce0
nop
lea rcx, [rsp + 0x60]
call fcn.18001d340
inc ebx
add rdi, 4
cmp ebx, dword [rsp + 0x30]
jl 0x180077f33
lea rcx, [rsp + 0x28]
call fcn.180025a70
mov eax, 1
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x18007b840
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
jne 0x18007b849
xor eax, eax
jmp 0x18007b891
mov eax, 0x5a4d
cmp word [rcx], ax
je 0x18007b857
xor eax, eax
jmp 0x18007b891
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
je 0x18007b86a
xor eax, eax
jmp 0x18007b891
cmp word [rax + 0x14], 0
jne 0x18007b875
xor eax, eax
jmp 0x18007b891
test edx, edx
je 0x18007b888
mov ecx, 0x8664
cmp word [rax + 4], cx
je 0x18007b888
xor eax, eax
jmp 0x18007b891
mov eax, 1
jmp 0x18007b891
repz ret

Function at 0x18007bcc0
Capabilities:
Parse pe header

Disassembly:
mov edx, 1
jmp fcn.18007b840

Function at 0x18007cd70
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x28
mov eax, dword [0x18012306c]
test eax, eax
jne 0x18007cd9e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.SeDebugPrivilege
mov r8d, 1
mov ecx, eax
call fcn.18008a080
mov dword [0x18012306c], eax
add rsp, 0x28
ret

Function at 0x18007d1c0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x130], rax
test rdx, rdx
jne 0x18007d1fb
mov eax, 0xf0000001
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180036980
add rsp, 0x148
ret
lea rcx, [0x1800c3dc8]
mov qword [rsp + 0x150], rbx
mov qword [rsp + 0x140], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.comctl32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rdi, rdi
je 0x18007d2d9
test rax, rax
je 0x18007d2d9
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1800369b0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.18007cc20
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x47
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x49
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d4310]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d42e8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d42d8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d42f8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.RemoteLoadDll9x_____Can_not_get_function_address
call fcn.1800843e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180036980
add rsp, 0x148
ret
Function at 0x18007e870
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, rcx
lea rcx, [0x1800d44b4]
mov rsi, rdx
call fcn.18007e320
mov rbx, rax
test rax, rax
jne 0x18007e8b5
xor eax, eax
jmp 0x18007e962
xor eax, eax
lea r8, [rsp + 0x30]
mov rdx, rsi
lea r9d, [rax + 0x40]
mov rcx, rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
je 0x18007e8ae
mov eax, 0x5a4d
cmp word [rsp + 0x30], ax
jne 0x18007e8ae
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, pe_nt_image_headers64
call fcn.1800369b0
movsxd rdx, dword [rsp + 0x6c]
lea r8, [rsp + 0x70]
add rdx, rsi
mov r9d, pe_nt_image_headers64
mov rcx, rdi
mov qword [rsp + 0x20], 0
call rbx
test eax, eax
je 0x18007e8ae
cmp dword [rsp + 0x70], 0x4550
jne 0x18007e8ae
movzx eax, word [rsp + 0x86]
not ax
movzx eax, ax
shr eax, 0xd
and eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180036980
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18007f090
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
test rcx, rcx
mov ebx, 0x10000
je 0x18007f0ab
lea rbx, [rcx + 0x10000]
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov edi, 0x5a4d
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18007f11a
cmp dword [rsp + 0x40], 0x1000
jne 0x18007f11c
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x18007f11c
bt eax, 8
jb 0x18007f11c
cmp word [rbx], di
jne 0x18007f11c
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x18007f11c
mov rax, rbx
jmp 0x18007f11a
jmp 0x18007f128
mov rbx, qword [rsp + 0x38]
add rbx, qword [rsp + 0x20]
jmp 0x18007f0d0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x18007f140
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rsi
push rdi
sub rsp, 0x30
mov r9, rcx
test rcx, rcx
jne 0x18007f15b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9, rax
mov eax, 0x5a4d
cmp word [r9], ax
je 0x18007f178
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18007f241
movsxd r10, dword [r9 + 0x3c]
add r10, r9
cmp dword [r10], 0x4550
je 0x18007f19a
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18007f241
movzx eax, word [r10 + 0x14]
test ax, ax
jne 0x18007f1b6
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18007f241
movzx eax, ax
lea r11, [rax + r10 + 0x18]
xor edx, edx
mov dword [rsp + 0x20], edx
movzx eax, word [r10 + 6]
cmp edx, eax
jae 0x18007f225
lea rcx, [rdx + rdx*4]
lea r8, [r11 + rcx*8]
lea rdi, str.tdetour
mov rsi, r8
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
jne 0x18007f221
mov eax, dword [r8 + 0xc]
test eax, eax
je 0x18007f225
cmp dword [r8 + 0x10], 0
je 0x18007f225
lea rdi, [r9 + rax]
mov eax, dword [rdi]
cmp eax, 0x40
jb 0x18007f225
cmp dword [rdi + 4], 0x727444
jne 0x18007f225
cmp dword [rdi + 8], 0
jne 0x18007f214
mov dword [rdi + 8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
jmp 0x18007f241
inc edx
jmp 0x18007f1c0
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18007f241
mov rsi, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18007f6a0
Capabilities:
Parse pe header

Disassembly:
push rbp
push r14
sub rsp, 0x28
xor ebp, ebp
mov r14, rcx
test rcx, rcx
je 0x18007f7cc
xor ecx, ecx
mov qword [rsp + 0x58], r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
test rax, rax
je 0x18007f7c7
mov eax, 0x5a4d
cmp word [r12], ax
jne 0x18007f7c7
movsxd rax, dword [r12 + 0x3c]
add rax, r12
je 0x18007f7c7
cmp dword [rax], 0x4550
jne 0x18007f7c7
mov qword [rsp + 0x40], rbx
mov ebx, dword [rax + 0x90]
add rbx, r12
je 0x18007f7c2
mov ecx, dword [rax + 0x94]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x20], r13
movabs rax, 0xcccccccccccccccd
mov esi, ebp
mul rcx
mov r13, rdx
shr r13, 4
test r13d, r13d
je 0x18007f7b8
add rbx, 0xc
mov qword [rsp + 0x50], rdi
cmp dword [rbx - 0xc], ebp
jne 0x18007f74f
cmp dword [rbx + 4], ebp
je 0x18007f7b3
mov edi, dword [rbx]
add rdi, r12
je 0x18007f7b3
mov rdx, r14
mov rcx, rdi
call fcn.18004376c
test eax, eax
je 0x18007f7ae
mov edx, 0x5c
mov rcx, rdi
call fcn.180038b64
mov r11, rax
test rax, rax
je 0x18007f7a1
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r11
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 1
jbe 0x18007f7a1
lea rcx, [r11 + 1]
mov rdx, r14
call fcn.18004376c
test eax, eax
je 0x18007f7ae
inc esi
add rbx, 0x14
cmp esi, r13d
jb 0x18007f745
jmp 0x18007f7b3
mov ebp, 1
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x58]
mov eax, ebp
add rsp, 0x28
pop r14
pop rbp
ret
Function at 0x180080640
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdi, rcx
lea rcx, [0x1800d44b4]
mov rsi, rdx
call fcn.18007e320
mov rbx, rax
test rax, rax
jne 0x180080685
xor eax, eax
jmp 0x180080732
xor eax, eax
lea r8, [rsp + 0x30]
mov rdx, rsi
lea r9d, [rax + 0x40]
mov rcx, rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
je 0x18008067e
mov eax, 0x5a4d
cmp word [rsp + 0x30], ax
jne 0x18008067e
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x108
call fcn.1800369b0
movsxd rdx, dword [rsp + 0x6c]
lea r8, [rsp + 0x70]
add rdx, rsi
mov r9d, 0x108
mov rcx, rdi
mov qword [rsp + 0x20], 0
call rbx
test eax, eax
je 0x18008067e
cmp dword [rsp + 0x70], 0x4550
jne 0x18008067e
movzx eax, word [rsp + 0x86]
not ax
movzx eax, ax
shr eax, 0xd
and eax, 1
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.180036980
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180080820
Capabilities:
Parse pe header

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0xc0
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r8
mov rdi, rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], r8
test rdx, rdx
mov ebx, 0x10000
je 0x180080862
lea rbx, [rdx + 0x10000]
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
xor r13d, r13d
mov r12d, 0x5a4d
nop dword [rax + rax]
mov r9d, 0x30
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x180080985
mov rcx, qword [rsp + 0x48]
mov rax, rcx
and eax, 0xfff
cmp rax, 0xfff
je 0x180080985
add rcx, qword [rsp + 0x30]
cmp rcx, rbx
jb 0x180080985
cmp dword [rsp + 0x50], 0x1000
jne 0x180080976
mov eax, dword [rsp + 0x54]
cmp al, 1
je 0x180080976
bt eax, 8
jb 0x180080976
mov qword [rsp + 0x20], r13
mov r9d, 0x40
lea r8, [rsp + 0x70]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180080976
cmp word [rsp + 0x70], r12w
jne 0x180080961
movsxd rcx, dword [rsp + 0xac]
mov eax, ecx
cmp rax, qword [rsp + 0x48]
ja 0x180080961
cmp ecx, 0x40
jb 0x180080961
lea rdx, [rbx + rcx]
mov qword [rsp + 0x20], r13
mov r9d, pe_nt_image_headers64
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180080976
cmp dword [rsi], 0x4550
jne 0x180080976
mov rax, rbx
jmp 0x180080987
jmp 0x180080976
mov rbx, qword [rsp + 0x48]
add rbx, qword [rsp + 0x30]
jmp 0x180080890
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180036980
add rsp, 0xc0
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180081440
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
test rcx, rcx
mov ebx, 0x10000
je 0x18008145b
lea rbx, [rcx + 0x10000]
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov edi, 0x5a4d
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800814ca
cmp dword [rsp + 0x40], 0x1000
jne 0x1800814cc
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x1800814cc
bt eax, 8
jb 0x1800814cc
cmp word [rbx], di
jne 0x1800814cc
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x1800814cc
mov rax, rbx
jmp 0x1800814ca
jmp 0x1800814d8
mov rbx, qword [rsp + 0x38]
add rbx, qword [rsp + 0x20]
jmp 0x180081480
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1800814f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rsi
push rdi
sub rsp, 0x30
mov r9, rcx
test rcx, rcx
jne 0x18008150b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9, rax
mov eax, 0x5a4d
cmp word [r9], ax
je 0x180081528
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800815f1
movsxd r10, dword [r9 + 0x3c]
add r10, r9
cmp dword [r10], 0x4550
je 0x18008154a
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800815f1
movzx eax, word [r10 + 0x14]
test ax, ax
jne 0x180081566
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800815f1
movzx eax, ax
lea r11, [rax + r10 + 0x18]
xor edx, edx
mov dword [rsp + 0x20], edx
movzx eax, word [r10 + 6]
cmp edx, eax
jae 0x1800815d5
lea rcx, [rdx + rdx*4]
lea r8, [r11 + rcx*8]
lea rdi, str.tdetour
mov rsi, r8
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
jne 0x1800815d1
mov eax, dword [r8 + 0xc]
test eax, eax
je 0x1800815d5
cmp dword [r8 + 0x10], 0
je 0x1800815d5
lea rdi, [r9 + rax]
mov eax, dword [rdi]
cmp eax, 0x40
jb 0x1800815d5
cmp dword [rdi + 4], 0x727444
jne 0x1800815d5
cmp dword [rdi + 8], 0
jne 0x1800815c4
mov dword [rdi + 8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
jmp 0x1800815f1
inc edx
jmp 0x180081570
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800815f1
mov rsi, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret