joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140106800
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
nop
add rsp, 0x638dce52
sub rsp, 0x638dce72
mov r8, qword [rcx + 0x648]
xor esi, esi
mov rbx, rcx
test r8, r8
je 0x14010683b
mov rdi, qword [rcx + 0x640]
jmp 0x140106842
mov rdi, rsi
nop dword [rax]
test r8, r8
je 0x14010685b
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
jmp 0x14010685e
mov rcx, rsi
cmp rdi, rcx
je 0x140106aae
mov rax, qword [rdi]
cmp qword [rax + 0x28], rdx
je 0x140106888
nop
add rdi, 0x36ad410d
sub rdi, 0x36ad4105
jmp 0x140106842
test r8, r8
je 0x14010695a
cmp rdi, qword [rbx + 0x640]
jb 0x14010695a
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
cmp rdi, rcx
jae 0x14010695a
mov rdx, rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x1401068df
mov rax, qword [rbx + 0x640]
lea rax, [rax + rcx*8]
jmp 0x1401068e2
mov rax, rsi
nop
add rax, 0xffffffffc227ea82
sub rax, 0xffffffffc227ea8a
cmp rdx, rax
jae 0x140106913
mov rax, qword [rdx + 8]
mov qword [rdx], rax
nop
sub rdx, 0x7cc85516
add rdx, 0x7cc8551e
jmp 0x1401068bf
test rcx, rcx
je 0x14010695a
lea rax, [rcx - 1]
mov qword [rbx + 0x648], rax
test rax, rax
jne 0x14010695a
mov rcx, qword [rbx + 0x640]
test rcx, rcx
je 0x14010694c
call fcn.140099d90
mov qword [rbx + 0x640], rsi
mov qword [rbx + 0x650], rsi
mov qword [rbx + 0x648], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x140106982
mov rax, qword [rcx]
mov edx, 0x7bafbc61
xor edx, 0x25dc1265
add edx, 0x1ffa6338
xor edx, 0x7e6e113d
call qword [rax]
cmp qword [rbx + 0x648], rsi
je 0x140106aae
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400f1080
mov rcx, qword [rsp + 0x30]
mov r10d, 0x66e1a268
add r10d, 0x6a93f49
xor r10d, 0x6ecb0fd8
sub r10d, 0x341edc9
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x648]
sub eax, r8d
cdq
idiv dword [rbx + 0x648]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x140106a5f
mov rdx, qword [rbx + 0x640]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x140106a5f
mov r9d, r10d
xor r9d, 0x638a3839
xor r8d, 0x638a3839
nop dword [rax]
mov rcx, qword [rdx]
mov eax, esi
xor eax, 0x638a3839
add esi, r10d
nop
add rdx, 0x7b8cd630
sub rdx, 0x7b8cd628
mov dword [rcx + 0x30], eax
mov dword [rcx + 0x34], 0x7cb151f1
xor dword [rcx + 0x34], 0x5dedb844
add dword [rcx + 0x34], 0x422d4e84
mov dword [rcx + 0x38], r9d
mov dword [rcx + 0x3c], r8d
cmp rdx, r11
jne 0x140106a10
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140106aa6
sub ecx, r8d
mov dword [rax + 0x14], 0x3a861ce9
xor dword [rax + 0x14], 0x60a22c47
sub dword [rax + 0x14], 0x97bf76a
add dword [rax + 0x14], 0x12e1fef5
xor ecx, 0x638a3839
xor r8d, 0x638a3839
mov dword [rax + 0x10], ecx
mov dword [rax + 0x18], r8d
mov dword [rax + 0x1c], r8d
mov rcx, rbx
call fcn.1400f07b0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
sub rsp, 0xffffffffffffffe0
pop rdi
ret
Function at 0x140106ac0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.140102dc0
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.1401066d0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140106ac0
push rbx
add rsp, 0xffffffffffffffe0
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x140106bf2
lea rdx, [rsp + 0x30]
call fcn.1400f1080
mov r8, qword [rsp + 0x30]
mov r11d, 0x48c2640c
add r11d, 0xb5bb974
add r11d, 0x196fdd9d
xor r11d, 0x6d8dfbbd
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x140106ba8
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x140106ba3
mov r8d, r11d
xor r8d, 0x638a3839
xor r9d, 0x638a3839
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x638a3839
add r10d, r11d
sub rax, 0xfffffffffffffff8
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x56b85f87
xor dword [rdx + 0x34], 0xc31d287
add dword [rdx + 0x34], 0x900ab39
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x140106b5d
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140106bea
sub r8d, r9d
mov dword [rax + 0x14], 0x16b28949
xor dword [rax + 0x14], 0x70ebce8c
sub dword [rax + 0x14], 0x2cf0f8c
xor r8d, 0x638a3839
xor r9d, 0x638a3839
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.1400f07b0
nop
add rsp, 0x57fce8f5
sub rsp, 0x57fce8d5
pop rbx
ret
Function at 0x14011a3ac
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 0x10], rbp
xchg rbx, rbp
xchg rsi, r9
mov qword [rsp + 0x18], r9
xchg rsi, r9
xchg rdi, r13
mov qword [rsp + 0x20], r13
xchg r13, rdi
nop
sub rsp, 8
mov qword [rsp], rbp
xchg rbp, rsp
mov rsp, rbp
xchg rsp, rbp
add rsp, 0x1daf998c
sub rsp, 0x1daf9a0c
xor esi, esi
mov dword [rbp - 0x50], 0x572fb838
xor dword [rbp - 0x50], 0x360d43bc
sub dword [rbp - 0x50], 0x5c195a02
add dword [rbp - 0x50], 0x565f619
xor dword [rbp - 0x50], 0xa7997c5
mov dword [rbp - 0x4c], 0x303b203
add dword [rbp - 0x4c], 0x2a0fa842
xor dword [rbp - 0x4c], 0x3b33e1a0
sub dword [rbp - 0x4c], 0x15adbbe3
mov dword [rbp - 0x48], 0x4725593f
sub dword [rbp - 0x48], 0x464fdc38
xor dword [rbp - 0x48], 0x34f4801a
sub dword [rbp - 0x48], 0x9c2738b
xor dword [rbp - 0x48], 0x2a4389d9
mov dword [rbp - 0x44], 0x31e0235
add dword [rbp - 0x44], 0x125a0de7
add dword [rbp - 0x44], 0x64a9ec5
xor dword [rbp - 0x44], 0x1bbeaefc
mov qword [rbp + 0x10], rsi
lea ebx, [rsi + 1]
mov dword [rsp - 0x18], 0x5631bbef
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
xchg r14, r14
and cl, 3
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x50]
mov r11, r11
mov eax, 0x4f2d90fb
xor eax, 0x7de1e470
xor eax, 0x3d08d724
xor eax, 0x3f89e7a1
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x44], 0x43210ca3
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
xor cx, dx
mov word [rbp + rax*2 - 0x20], cx
mov dword [rsp - 0x18], 0x5b7b5267
mov rax, qword [rbp + 0x10]
add rax, rbx
xchg r14, rax
mov qword [rbp + 0x10], r14
xchg r14, rax
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
cmp rax, 8
mov dword [rsp - 0x14], 0xc2b5912
jb 0x14011a480
lea rax, [rbp - 0x20]
mov word [rbp - 0x10], si
xorps xmm0, xmm0
xchg r9, r9
xchg rsp, rax
mov qword [rbp - 0x38], rsp
xchg rsp, rax
lea r9, [rbp - 0x30]
mov dword [rsp - 0x30], 0x7f68a189
mov dword [rbp - 0x40], 0x39725885
xor dword [rbp - 0x40], 0x6243a013
sub dword [rbp - 0x40], 0x549155dc
sub dword [rbp - 0x40], 0x68ea2aa
lea r8, [rbp - 0x40]
mov dword [rsp + 0x20], esi
xor edx, edx
mov dword [rsp - 0x18], edx
xor ecx, ecx
xchg rbp, rsi
movups xmmword [rsi - 0x30], xmm0
xchg rbp, rsi
call fcn.140135b60
mov rbx, rbx
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
test rax, rax
mov dword [rsp - 0x40], 0x23e67700
je 0x14011a5a1
xchg r13, rax
mov rcx, r13
xchg r13, rax
call fcn.140110d88
test al, al
mov rdi, rdi
je 0x14011a5a1
lea rdx, [rbp - 0x40]
mov rcx, rdi
xchg r15, r15
call fcn.14010fcd0
test al, al
jne 0x14011a5a8
mov bl, sil
mov dword [rsp - 0x2c], edx
xor eax, eax
lea r11, [rsp + 0x80]
mov rsi, qword [r11 + 0x20]
mov dword [rsp - 0x44], 0x5fc9b09c
lea rdi, [rbp - 0x20]
lea ecx, [rax + 8]
rep stosb byte [rdi], al
mov dword [rsp - 0xc], edx
mov rdi, qword [r11 + 0x28]
mov al, bl
mov rbx, qword [r11 + 0x18]
mov rsp, r11
mov rsi, rsi
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x14011e750
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x230
mov rax, qword [0x1401432b0]
mov r13, r13
lea rdx, [rsp + 0x20]
ror rax, 9
ror rax, 6
ror rax, 8
ror rax, 0xc
ror rax, 2
ror rax, 3
ror rax, 1
ror rax, 1
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
movabs rcx, 0x7244116b19a6697b
xor rcx, 0x1d33a66d
add rcx, 0xc267447
add rcx, 0x7fffffff
add rcx, 0x238517ef
xor r9d, r9d
sub rax, rcx
mov dword [rsp - 0x1c], edi
movabs rcx, 0xc7ea37f9690d93cc
add rcx, 0x153ef8ee
sub rcx, 0x70d847ad
xor rcx, 0x57a62f73
add rcx, 0x7fffffff
sub rcx, 0x30a8df72
ror rax, 0x28
ror rax, 1
ror rax, 2
ror rax, 7
ror rax, 3
ror rax, 4
ror rax, 2
ror rax, 1
xor rax, rcx
movabs rcx, 0xe3e7093e26dff7a7
add rcx, 0x47a0d10e
xor rcx, 0x16c9c31f
xor rcx, 0x339acafa
xor rcx, 0xe6f18ca
ror rax, 0xc
ror rax, 0xb
ror rax, 4
ror rax, 1
ror rax, 1
lea r8d, [r9 + 8]
add rax, rcx
xor ecx, ecx
mov r12, r12
call rax
lea rcx, [rbx + 8]
xorps xmm0, xmm0
xchg rcx, r12
mov qword [rbx], r12
xchg r12, rcx
movups xmmword [rcx], xmm0
xchg rdi, rdi
xchg rcx, r12
movups xmmword [r12 + 0x10], xmm0
xchg r12, rcx
xchg r15, rcx
movups xmmword [r15 + 0x20], xmm0
xchg rcx, r15
test eax, eax
mov dword [rsp - 0x1c], esp
je 0x14011e995
lea rax, [rsp + 0x20]
nop
movabs rdx, 0xffffffff378bbba2
xor rdx, 0x4d0770b4
sub rdx, 0x509e6b60
add rdx, 0x7fffffff
xor rdx, 0x5611a04a
nop dword [rax + rax]
mov dword [rsp - 0x1c], 0x5a9661b1
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14011e8c5
mov r11, r11
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
xchg r9, rdx
mov qword [rbx + 0x38], r9
xchg rdx, r9
call fcn.140017a7c
xor r8d, r8d
xchg r15, rax
mov rdx, r15
xchg r15, rax
mov ecx, 0x674822e2
sub ecx, 0x409bf1a7
sub ecx, 0x251e3100
add ecx, 0x7b3b1baf
xor ecx, 0x4c845fe4
cmp qword [rbx + 0x38], r8
mov rdx, rdx
jbe 0x14011e9a2
lea r9, [rsp + 0x20]
mov r10d, 0x50c52342
sub r10d, 0x2a50a1e3
sub r10d, 0x2217203c
add r10d, 0x35412ef9
xor r10d, 0x399e90e3
sub r9, rax
nop word [rax + rax]
movzx eax, cx
mov r8, r8
lea rdx, [rdx + 2]
and ax, r10w
ror ecx, 5
ror ecx, 3
xor ax, word [r9 + rdx - 2]
inc r8
mov word [rdx - 2], ax
mov rsp, rsp
cmp r8, qword [rbx + 0x38]
jb 0x14011e957
xchg r11, rax
mov r11, rbx
xchg r11, rax
sub rsp, 0xfffffffffffffdd0
pop rbx
ret
xor r8d, r8d
xchg rdx, r8
mov qword [rbx + 0x38], rdx
xchg rdx, r8
xchg rdi, rbx
mov rax, rdi
xchg rbx, rdi
add rsp, 0x230
pop rbx
ret
Function at 0x140135b60
Capabilities:
Execute syscall

Disassembly:
xchg rcx, r14
mov r10, r14
xchg r14, rcx
mov eax, dword [0x140144004]
cmp qword [0x140144018], 0
jne 0x14008e620
mov dword [rsp - 0x40], esi
syscall
ret
jmp 0x14008f135
Function at 0x1401381b8
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rdi, rbx
xchg r8, rsi
mov qword [rsp + 0x10], r8
xchg r8, rsi
xchg rdi, r13
mov qword [rsp + 0x18], r13
xchg rdi, r13
push rbp
nop
push 0xaac6453
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r14
mov rbp, rsp
nop
add rsp, 0x6cb28677
sub rsp, 0x6cb286e7
xchg r8, rbp
mov rdi, rbp
xchg rbp, r8
xchg rdx, rsp
mov r14, rsp
xchg rdx, rsp
mov rsi, rcx
mov dword [rsp - 0x40], 0x1907495b
movabs r12, 0x28510a1f007fb375
add r12, 0x649e740f
sub r12, 0x3aba8a06
xor r12, 0x72f18b35
cmp r9d, 0x60001
mov dword [rsp - 0xc], ebx
jne 0x1401383ec
mov dword [rbp - 0x40], 0x1f403957
add dword [rbp - 0x40], 0x5685624e
sub dword [rbp - 0x40], 0x1f5ace10
xor dword [rbp - 0x40], 0x1e2cf029
add dword [rbp - 0x40], 0x59cad2d9
xor edx, edx
mov dword [rbp - 0x3c], 0x77464bc
add dword [rbp - 0x3c], 0x1fccb7bc
sub dword [rbp - 0x3c], 0x1ce5c6ee
xor dword [rbp - 0x3c], 0x6613544a
add dword [rbp - 0x3c], 0x3f108684
mov dword [rbp - 0x38], 0x3bfbd272
add dword [rbp - 0x38], 0x2a79a8d9
sub dword [rbp - 0x38], 0x60dddb84
xor dword [rbp - 0x38], 0x5680a375
add dword [rbp - 0x38], 0x77738be3
mov ecx, edx
mov r12, r12
mov eax, 0x7b990daa
sub eax, 0x1bd76f4f
outsd dx, dword [rsi]
xlatb
sbb ebp, dword [0x154572ee9]
sub eax, 0xb29d469
rol eax, cl
mov dword [rsp - 0x1c], 0x4dbe7162
xor al, byte [rbp + rdx - 0x40]
mov byte [rbp + rdx - 0x34], al
inc rdx
cmp rdx, 0xc
mov dword [rsp - 0x34], 0x58329ef3
jb 0x1401382b7
mov r9d, 0x58a225f6
add r9d, 0x17cfa172
xor r9d, 0xeb6493
xor r9d, 0x709aac04
mov qword [rsp + 0x20], 0x12823c8b
xor qword [rsp + 0x20], 0x6f38e827
sub qword [rsp + 0x20], 0x5cb504c1
xor qword [rsp + 0x20], 0x4d13b616
xor qword [rsp + 0x20], 0x6c1679f1
lea r8, [rbp - 0x34]
mov rdx, rdi
mov dword [rsp - 0x30], 0x46bf3b79
xchg r14, rcx
mov r14, rcx
xchg rcx, r14
call fcn.1401357ac
mov dword [rsp - 0x40], ebp
xchg rdi, rax
mov rbx, rdi
xchg rdi, rax
lea rdi, [rbp - 0x34]
xor eax, eax
xchg r15, r15
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
test rbx, rbx
mov dword [rsp - 0x34], ebx
je 0x140138436
lea rdx, [rbp - 0x28]
lea rcx, [rbx + 0xc]
call fcn.140090a40
xchg r15, r15
test dword [rbp - 7], 0x1000
jne 0x140138436
cmp byte [rbp - 0x1d], 0xe8
mov dword [rsp - 0x1c], 0x3646d4a2
jne 0x140138436
lea rdx, [rbx + 0xc]
xchg rcx, r11
mov r11, r14
xchg r11, rcx
call fcn.1400860a0
mov dword [rsp - 0x20], edx
movzx edx, byte [rbp - 0x28]
add edx, dword [rbp - 0x13]
add edx, eax
xchg rdx, rdx
mov rax, qword [rsi + 8]
xor rax, r12
add rdx, rax
mov dword [rsp - 0x2c], 0x3c2619f9
xor rdx, r12
mov qword [rsi + 0x20], rdx
cmp qword [rsi + 0x20], r12
setne al
mov r10, r10
lea r11, [rsp + 0x70]
xchg rsi, rbx
mov rsi, qword [r11 + 0x20]
xchg rsi, rbx
xchg rsi, rcx
mov rcx, qword [r11 + 0x28]
xchg rcx, rsi
mov rdi, qword [r11 + 0x30]
mov dword [rsp - 0x3c], edi
xchg rsp, r11
mov r11, rsp
xchg rsp, r11
pop r14
pop r12
mov dword [rsp - 0xc], 0x58b2eaa1
nop
mov rbp, qword [rsp]
add rsp, 8
ret
xor al, al
jmp 0x1401383f6
Function at 0x155a52c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x155a536
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x155a55f
pop rbp
sub rbp, 0x33
sub rbp, 0x115a52c
sub rsp, 0x20
jmp 0x155a57e
mov rax, 0x115a52c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffd40fb6cf
xor byte [rax], dl
inc rax
dec rcx
jne 0x155a59d
jmp 0x155a5b4
xchg dword [rsi + 0x26], eax
iretd
Function at 0x180001ad4
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180001be0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
jmp 0x180001bcf
cmp dword [rsp + 0x20], 0x10
jb 0x180001bb9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180001bb9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180001bb9
mov rdx, qword [rbx]
test rdx, rdx
jne 0x180001b73
mov rcx, qword [0x180152510]
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x180001bd7
lea rdi, [rbx + 0xc]
jmp 0x180001bab
mov eax, dword [rbx + 8]
lea rdi, [rbx + 0xc]
cmp dword [rdi], eax
jb 0x180001bab
mov rcx, qword [0x180152510]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180001bd7
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
mov ecx, dword [rdi]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
lea eax, [rcx + 1]
mov dword [rdi], eax
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180001b19
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x180001bf0
Capabilities:
Suspend thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
and qword [rcx], 0
mov ebp, r8d
and dword [rcx + 8], 0
mov r14d, edx
and dword [rcx + 0xc], 0
mov rbx, rcx
call fcn.180001ad4
cmp qword [rbx], 0
je 0x180001c71
xor edi, edi
cmp dword [rbx + 0xc], edi
jbe 0x180001c71
mov r8, qword [rbx]
xor edx, edx
mov r8d, dword [r8 + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180001c6a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.1800019d4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180001c30
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180001c8c
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x180001cf0
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x180001cde
mov r8, qword [rbx]
xor edx, edx
mov r8d, dword [r8 + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180001cd7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180001cab
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x180152510]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180001d00
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, ecx
mov esi, edx
imul rbx, rax, 0x38
add rbx, qword [0x180152540]
mov rdx, qword [rbx]
mov cl, byte [rbx + 0x20]
mov rbp, rdx
lea rdi, [rdx - 5]
and cl, 1
je 0x180001d36
mov rbp, rdi
movzx eax, cl
lea r9, [rsp + 0x40]
test cl, cl
mov r8d, 0x40
cmove rdi, rdx
lea r14, [rax*2 + 5]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180001d6c
mov eax, 0xa
jmp 0x180001dfb
test esi, esi
je 0x180001d8e
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180001daf
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180001daf
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180001da9
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180001daf
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, sil
shl sil, 2
add al, al
xor al, byte [rbx + 0x20]
and al, 2
xor al, byte [rbx + 0x20]
xor sil, al
and sil, 4
xor sil, al
mov byte [rbx + 0x20], sil
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1800025ec
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x180002603
cmp r8b, 0x90
je 0x180002603
cmp r8b, 0xcc
jne 0x180002625
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x180002621
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x180002625
add edx, r10d
cmp edx, r9d
jb 0x180002611
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x180002a90
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rsi, rcx
lea rcx, [rax - 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rbp, qword [rsp + 0x28]
cmp rsi, 0x40000000
jbe 0x180002ad1
lea rax, [rsi - 0x40000000]
cmp rbp, rax
cmovb rbp, rax
mov rbx, qword [0x180152530]
lea r14, [rsi + 0x40000000]
cmp qword [rsp + 0x30], r14
cmovbe r14, qword [rsp + 0x30]
sub r14, 0xfff
xor edi, edi
test rbx, rbx
je 0x180002b11
cmp rbx, rbp
jb 0x180002b0c
cmp rbx, r14
jae 0x180002b0c
cmp qword [rbx + 8], rdi
jne 0x180002bd9
mov rbx, qword [rbx]
jmp 0x180002af3
mov r15, rsi
cmp rsi, rbp
jb 0x180002b97
mov r8d, dword [rsp + 0x48]
mov rdx, rbp
mov rcx, r15
call fcn.180002990
mov r15, rax
test rax, rax
je 0x180002b58
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x180002b9e
cmp r15, rbp
jae 0x180002b19
test rbx, rbx
jmp 0x180002b95
mov r8d, dword [rsp + 0x48]
mov rdx, r14
mov rcx, rsi
call fcn.180002a04
mov rsi, rax
test rax, rax
je 0x180002bd9
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x180002b9e
cmp rsi, r14
jbe 0x180002b5d
jmp 0x180002bd9
lea rcx, [rbx + 0x40]
mov dword [rbx + 0x10], edi
mov edx, 0x40
mov qword [rcx], rdi
mov rax, rcx
mov qword [rbx + 8], rcx
add rdx, 0x40
add rcx, 0x40
mov rdi, rax
cmp rdx, 0xfc0
jbe 0x180002baa
mov rax, qword [0x180152530]
mov qword [rbx], rax
mov qword [0x180152530], rbx
lea r11, [rsp + 0x50]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x180012e90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x30]
lea rcx, [0x18015c112]
call fcn.1800f31a0
mov eax, dword [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
cmp dword [rbp + 0xc0], 1
je 0x180012ecf
jmp 0x180012f33
movzx eax, byte [0x180146009]
test eax, eax
je 0x180012f0a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0xf0]
lea r8, [0x18000b010]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x180146009], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0xf0]
lea r8, [0x18000b290]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x180034fe0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x18015c295]
call fcn.1800f31a0
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x180035040
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x18015c295]
call fcn.1800f31a0
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x180035380
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x18015c295]
call fcn.1800f31a0
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1800fd180]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1800353ff
mov dword [rbp + 0x120], 1
jmp 0x180035409
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x180035443
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
jmp 0x1800353ca
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret