joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002aab0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1800ae0f8]
test rax, rax
jne 0x18002ad0a
movups xmm0, xmmword [str.sGZXQ_Y_iVZEXLo2__0_0_]
mov eax, dword [str.____9O]
xor ecx, ecx
cmp dword [0x1800ab090], 2
mov dword [rsp + 0x58], eax
movzx eax, word [0x18009c67c]
movups xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x5c], ax
movsd xmm0, qword [0x18009c670]
movzx eax, byte [0x18009c67e]
movsd qword [rsp + 0x50], xmm0
mov byte [rsp + 0x5e], al
jl 0x18002ac43
movdqa xmm0, xmmword [0x1800a02c0]
lea rdx, [rsp + 0x44]
movdqa xmm4, xmmword [0x1800a0170]
movdqa xmm3, xmmword [0x1800a0390]
movdqa xmm5, xmmword [0x1800a01f0]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x1800a0280]
nop dword [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x18002ab50
movaps xmm6, xmmword [rsp + 0x60]
cmp ecx, 0x1f
jge 0x18002ac7f
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
inc ecx
sub al, dl
add al, 0x31
xor byte [r8 - 1], al
cmp ecx, 0x1f
jl 0x18002ac50
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
xorps xmm1, xmm1
mov r8, 0xffffffffffffffff
movups xmmword [rsp + 0x20], xmm0
movdqu xmmword [rsp + 0x30], xmm1
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18002aca0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180012cd0
lea rcx, [rsp + 0x20]
call fcn.1800287f0
mov rdx, qword [rsp + 0x38]
mov qword [0x1800ae0f8], rax
cmp rdx, 0xf
jbe 0x18002ad0a
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002acfe
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002ad0f
call fcn.18006a6e8
mov rax, qword [0x1800ae0f8]
add rsp, 0x78
ret
call fcn.180070324
int3
Function at 0x18002ad20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1800ae150]
test rax, rax
jne 0x18002af5a
movups xmm0, xmmword [0x18009c4a8]
movzx eax, byte [0x18009c4b8]
xor ecx, ecx
cmp dword [0x1800ab090], 2
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x50], al
jl 0x18002ae93
movdqa xmm0, xmmword [0x1800a02c0]
lea rdx, [rsp + 0x44]
movdqa xmm4, xmmword [0x1800a0170]
movdqa xmm3, xmmword [0x1800a0390]
movdqa xmm5, xmmword [0x1800a01f0]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x1800a0280]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x18002ada0
movaps xmm6, xmmword [rsp + 0x60]
cmp ecx, 0x11
jge 0x18002aecf
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
inc ecx
sub al, dl
add al, 0x31
xor byte [r8 - 1], al
cmp ecx, 0x11
jl 0x18002aea0
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
xorps xmm1, xmm1
mov r8, 0xffffffffffffffff
movups xmmword [rsp + 0x20], xmm0
movdqu xmmword [rsp + 0x30], xmm1
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18002aef0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180012cd0
lea rcx, [rsp + 0x20]
call fcn.1800287f0
mov rdx, qword [rsp + 0x38]
mov qword [0x1800ae150], rax
cmp rdx, 0xf
jbe 0x18002af5a
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002af4e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002af5f
call fcn.18006a6e8
mov rax, qword [0x1800ae150]
add rsp, 0x78
ret
call fcn.180070324
int3
Function at 0x18002cbb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rbx, rdx
test rcx, rcx
je 0x18002cccd
cmp qword [0x1800ae200], 0
je 0x18002cccd
mov rax, qword [0x1800ae1f0]
test rax, rax
jne 0x18002cbfe
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x10]
mov rax, qword [0x1800ae200]
add rax, r8
mov qword [0x1800ae1f0], rax
xor edi, edi
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rdi
call rax
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x18002ccaa
lea rcx, [rsp + 0x30]
call fcn.180022eb0
cmp qword [rsp + 0x48], 7
lea rdx, [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, rbx
cmova rdx, qword [rsp + 0x30]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x30]
cmova rdx, qword [rsp + 0x30]
call fcn.1800233e0
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x18002ce3d
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002cc97
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002ce4b
call fcn.18006a6e8
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
xorps xmm0, xmm0
mov rax, rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rax, qword [0x18009c6d8]
xor edi, edi
cmp byte [0x18009c6df], dil
mov qword [rsp + 0x60], rax
je 0x18002ce0d
cmp dword [0x1800ab090], 2
jl 0x18002cdd5
movdqa xmm2, xmmword [0x1800a0170]
movdqa xmm4, xmmword [0x1800a0320]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1800a01e0]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x60]
andps xmm2, xmmword [0x1800a0280]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1800a02c0]
xorps xmm2, xmm0
movd dword [rsp + 0x60], xmm2
movdqa xmm2, xmmword [0x1800a0180]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1800a01e0]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x64]
andps xmm2, xmmword [0x1800a0280]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1800a02c0]
xorps xmm2, xmm0
movd dword [rsp + 0x64], xmm2
jmp 0x18002ce0d
lea r8, [rsp + 0x60]
mov ecx, edi
nop dword [rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x31
xor byte [r8 - 1], al
cmp ecx, 8
jl 0x18002cde0
xorps xmm0, xmm0
lea rax, [rsp + 0x60]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rdi
inc r8
cmp byte [rax + r8], dil
jne 0x18002ce27
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.180012cd0
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call fcn.180070324
int3
Function at 0x18002ed50
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword gs:[0x60]
mov rbp, rcx
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x18002edf4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x18002edf4
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x586bb6d5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x18002edef
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x18002edd0
cmp edx, 0xf36d1c48
je 0x18002ee3e
test r8d, r8d
jne 0x18002edb0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x18002ee0a
cmp qword [rax + 0x30], 0
jne 0x18002ed80
xor eax, eax
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbp
call rax
test rax, rax
je 0x18002ee57
mov ecx, dword [rsp + 0x44]
test cl, 0xee
sete al
test ecx, 0x101
movzx eax, al
mov ecx, 1
cmovne eax, ecx
jmp 0x18002ee59
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x18002ee0c
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180049ee0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movzx eax, byte [rcx]
xor r8d, r8d
mov edx, r8d
test al, al
je 0x180049f09
cmp al, 0x3f
je 0x18004a0ff
movzx eax, byte [rcx + 1]
inc rcx
inc edx
test al, al
jne 0x180049ef4
cmp dword [0x1800ab090], 2
movups xmm0, xmmword [0x18009e450]
movzx eax, word [0x18009e470]
movups xmm1, xmmword [0x18009e460]
mov word [rsp + 0x60], ax
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
jl 0x18004a06e
movdqa xmm0, xmmword [0x1800a02c0]
lea rcx, [rsp + 0x44]
movdqa xmm4, xmmword [0x1800a0170]
movdqa xmm3, xmmword [0x1800a0340]
movdqa xmm5, xmmword [0x1800a01b0]
movdqa xmmword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x20]
movaps xmmword [rsp + 0x70], xmm6
movdqa xmm6, xmmword [0x1800a0280]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x20
jl 0x180049f80
movaps xmm6, xmmword [rsp + 0x70]
cmp r8d, 0x22
jge 0x18004a0b3
movsxd rax, r8d
lea r9, [rsp + 0x40]
add r9, rax
nop dword [rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x31
add cl, r8b
inc r8d
xor byte [r9 - 1], cl
cmp r8d, 0x22
jl 0x18004a080
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
xorps xmm1, xmm1
mov r8, 0xffffffffffffffff
movups xmmword [rsp + 0x20], xmm0
movdqu xmmword [rsp + 0x30], xmm1
inc r8
cmp byte [rax + r8], 0
jne 0x18004a0d0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180012cd0
mov dl, 1
lea rcx, [rsp + 0x20]
call fcn.180025530
xor eax, eax
add rsp, 0x88
ret
mov eax, 0x55555556
imul edx
mov eax, edx
shr eax, 0x1f
add eax, edx
add rsp, 0x88
ret
Function at 0x180052c20
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword gs:[0x60]
xor esi, esi
mov r12, rcx
mov rbp, qword [rax + 0x10]
movsxd rax, dword [rbp + 0x3c]
mov r15d, dword [rax + rbp + 0x50]
test r15d, r15d
jle 0x180052d35
lea rdi, [rbp + 3]
nop word [rax + rax]
movzx eax, byte [rdi - 3]
sub al, 0x48
test al, 0xfb
jne 0x180052d27
cmp byte [rdi - 2], 0x8d
jne 0x180052d27
mov eax, dword [rdi]
add eax, 7
movsxd r14, esi
movsxd rbx, eax
mov rax, qword gs:[0x60]
add rbx, r14
add rbx, rbp
mov rdx, qword [rax + 0x10]
cmp rbx, rdx
jbe 0x180052d27
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x50]
add rcx, rdx
cmp rbx, rcx
jae 0x180052d27
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180022eb0
mov rax, r12
sub rbx, r12
movzx edx, word [rax]
movzx ecx, word [rax + rbx]
sub edx, ecx
jne 0x180052ce5
add rax, 2
test ecx, ecx
jne 0x180052cd2
test edx, edx
mov rdx, qword [rsp + 0x38]
je 0x180052d56
cmp rdx, 7
jbe 0x180052d27
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180052d22
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180052d98
call fcn.18006a6e8
inc esi
inc rdi
cmp esi, r15d
jl 0x180052c70
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
lea rbx, [r14 + rbp]
cmp rdx, 7
jbe 0x180052d93
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180052d8e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180052d98
call fcn.18006a6e8
mov rax, rbx
jmp 0x180052d37
call fcn.180070324
int3
Function at 0x18005c780
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x18005c7c0
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x1800ae430]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x18005c7fe
cmp rsi, r14
jb 0x18005c7f6
cmp rsi, r15
jae 0x18005c7f6
cmp qword [rsi + 8], 0
jne 0x18005c9c7
mov rsi, qword [rsi]
test rsi, rsi
jne 0x18005c7e1
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x18005c892
nop dword [rax]
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x18005c889
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18005c889
cmp dword [rsp + 0x70], 0x10000
je 0x18005c90b
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x18005c889
sub rbx, rbp
cmp rbx, r14
jae 0x18005c850
test rsi, rsi
jne 0x18005c970
cmp rdi, r15
ja 0x18005c9af
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18005c9af
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18005c9af
cmp dword [rsp + 0x70], 0x10000
je 0x18005c941
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x18005c8c2
jmp 0x18005c9af
test rbx, rbx
je 0x18005c889
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18005c970
cmp rbx, r14
jae 0x18005c830
jmp 0x18005c892
test rdi, rdi
je 0x18005c9af
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18005c970
cmp rdi, r15
jbe 0x18005c8a0
jmp 0x18005c9af
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x18005c980
mov rax, qword [0x1800ae430]
mov qword [rsi], rax
mov qword [0x1800ae430], rsi
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x18005d330
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
xor esi, esi
mov r14d, edx
mov qword [rcx], rsi
mov rbx, rcx
mov qword [rcx + 8], rsi
xor edx, edx
mov ecx, 4
mov ebp, r8d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18005d456
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18005d44d
cmp dword [rsp + 0x20], 0x10
jb 0x18005d42f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18005d42f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x18005d42f
mov rdx, qword [rbx]
test rdx, rdx
jne 0x18005d3ea
mov rcx, qword [0x1800ade68]
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x18005d44d
jmp 0x18005d41f
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x18005d41f
mov rcx, qword [0x1800ade68]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x18005d44d
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
lea eax, [rcx + 1]
mov dword [rbx + 0xc], eax
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x18005d394
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], rsi
je 0x18005d4a5
cmp dword [rbx + 0xc], esi
jbe 0x18005d4a5
mov r8, qword [rbx]
xor edx, edx
mov eax, esi
mov ecx, 0x5a
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18005d49e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.18005d1a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x18005d460
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18005d4c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x30]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1800ae420]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18005d524
mov eax, 0xa
jmp 0x18005d5b7
test esi, esi
je 0x18005d546
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18005d569
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18005d569
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x18005d562
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18005d569
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18005d5d0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x1800ae42c]
mov ebx, edi
test ecx, ecx
je 0x18005d70d
mov rax, qword [0x1800ae420]
add rax, 0x20
nop
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x18005d628
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18005d600
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x18005d70d
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xffffffff
setne r8b
call fcn.18005d330
mov r8d, dword [0x1800ae42c]
cmp ebx, r8d
jae 0x18005d698
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x1800ae420]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x18005d691
mov edx, esi
mov ecx, ebx
call fcn.18005d4c0
mov edi, eax
test eax, eax
jne 0x18005d698
mov r8d, dword [0x1800ae42c]
inc ebx
cmp ebx, r8d
jb 0x18005d660
cmp qword [rsp + 0x20], 0
je 0x18005d70d
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18005d6f9
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18005d6ea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x18005d6c0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800ade68]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret