joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005c550
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x180334940]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rax, qword [0x180343110]
test rax, rax
jne 0x18005c596
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor ecx, ecx
test eax, eax
sete cl
mov qword [0x180343110], rcx
mov rax, rcx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1802439b0
add rsp, 0x1d8
ret

Function at 0x18005f120
Capabilities:
Check for time delay via gettickcount
Create thread
Encode data using base64
Execute anti-debugging instructions
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x320]
sub rsp, 0x420
mov rax, qword [0x180334940]
xor rax, rsp
mov qword [rbp + 0x310], rax
lea r12, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp + 0x58], r12
lea rsi, vtable.CVolObject.0
mov qword [rbp + 0x58], rsi
xor r15d, r15d
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], r15
lea r14, vtable.CVolMem.0
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x88], 0x40
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf0], rsi
mov qword [rbp + 0xf8], r15
mov qword [rbp + 0x100], r15
lea r13, vtable.CWString.0
mov qword [rbp + 0xf0], r13
lea rax, [rbp + 0x110]
mov qword [rsp + 0x30], rax
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x110], rsi
mov qword [rbp + 0x118], r15
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x128], r15
mov qword [rbp + 0x138], r15
mov qword [rbp + 0x130], r15
mov qword [rbp + 0x140], 0x40
mov qword [rbp + 0x108], r15
mov qword [rbp + 0x140], 0xfe
lea rcx, [0x1802dec90]
jmp 0x180362ce8

Function at 0x180060c00
Capabilities:
Create service
Execute anti-debugging instructions
Get hostname
Start service
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x180334940]
xor rax, rsp
mov qword [rbp + 0x280], rax
xor r14d, r14d
mov dword [rbp + 0x130], r14d
lea rcx, [0x1802ded10]
jmp 0x180365a48

Function at 0x180064170
Capabilities:
Enumerate process modules
Execute anti-debugging instructions
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [0x180334940]
xor rax, rsp
mov qword [rbp + 0x470], rax
lea rcx, [0x1802deff0]
jmp 0x18036ab2a
Function at 0x180066dc0
Capabilities:
Parse credit card information

Disassembly:
sub rsp, 0x28
movabs rcx, 0x14be8f400
call fcn.180090ad0
mov ecx, eax
cmp eax, 1
jl 0x180067006
cmp eax, 5
jge 0x180066ded
mov eax, 3
jmp 0x180067008
cmp ecx, 8
jge 0x180066e0b
mov eax, 5
cmp ecx, 0x64
jl 0x180066e15
cmp ecx, 0x65
jge 0x180066e1a
mov eax, 0x5f5ec9f
add rsp, 0x28
ret
cmp ecx, 0xc
jge 0x180066e29
mov eax, 9
cmp ecx, 0x65
jl 0x180066e33
cmp ecx, 0x66
jge 0x180066e3c
mov eax, 0x5f5eca0
add rsp, 0x28
ret
cmp ecx, 0xf
jge 0x180066e54
mov eax, 0x3e8
cmp ecx, 0x66
jl 0x180067077
cmp ecx, 0x67
jl 0x180066e1f
cmp ecx, 0x68
jge 0x180067024
mov eax, 0x5f5eca1
add rsp, 0x28
ret
cmp ecx, 0x13
jge 0x180066e63
mov eax, reloc.WS2_32.dll_inet_addr
add rsp, 0x28
ret
cmp ecx, 0x16
jge 0x180066e72
mov eax, send
add rsp, 0x28
ret
cmp ecx, 0x19
jge 0x180066e81
mov eax, socket
add rsp, 0x28
ret
cmp ecx, 0x1b
jge 0x180066e90
mov eax, 0x18
add rsp, 0x28
ret
cmp ecx, 0x1d
jge 0x180066e9f
mov eax, 0x1b
add rsp, 0x28
ret
cmp ecx, 0x1f
jge 0x180066eae
mov eax, 0x1f
add rsp, 0x28
ret
xor eax, eax
cmp ecx, 0x23
jge 0x180066ebf
mov eax, 0x97
add rsp, 0x28
ret
cmp ecx, 0x26
jge 0x180066ece
mov eax, 0x24
add rsp, 0x28
ret
cmp ecx, 0x2a
jge 0x180066edd
mov eax, 0x99
add rsp, 0x28
ret
cmp ecx, 0x2e
jge 0x180066eec
mov eax, 0x3d
add rsp, 0x28
ret
cmp ecx, 0x33
jge 0x180066efb
mov eax, 0x33
add rsp, 0x28
ret
cmp ecx, 0x34
jge 0x180066f0a
mov eax, 0x28
add rsp, 0x28
ret
cmp ecx, 0x36
jge 0x180066f19
mov eax, 0x2b
add rsp, 0x28
ret
cmp ecx, 0x39
jge 0x180066f28
mov eax, 0x50
add rsp, 0x28
ret
cmp ecx, 0x3b
jge 0x180066f37
mov eax, 0x59
add rsp, 0x28
ret
cmp ecx, 0x3d
jge 0x180066f46
mov eax, 0x54
add rsp, 0x28
ret
cmp ecx, 0x40
jge 0x180066f55
mov eax, 0x56
add rsp, 0x28
ret
cmp ecx, 0x44
jge 0x180066f64
mov eax, 0x53
add rsp, 0x28
ret
cmp ecx, 0x46
jge 0x180066f73
mov eax, 0x46
add rsp, 0x28
ret
cmp ecx, 0x4a
jge 0x180066f82
mov eax, 0x4a
add rsp, 0x28
ret
jne 0x180066f8e
mov eax, 0x65
add rsp, 0x28
ret
cmp ecx, 0x4b
jl 0x180066fa2
cmp ecx, 0x4e
jge 0x180066fa7
mov eax, 0x68
add rsp, 0x28
ret
cmp ecx, 0x4e
jl 0x180066fb6
cmp ecx, 0x50
jge 0x180066fbb
mov eax, 0xc0
add rsp, 0x28
ret
cmp ecx, 0x50
jl 0x180066fca
cmp ecx, 0x53
jge 0x180066fcf
mov eax, 0x138
add rsp, 0x28
ret
cmp ecx, 0x53
jl 0x180066fde
cmp ecx, 0x56
jge 0x180066fe3
mov eax, 0x1159d685
add rsp, 0x28
ret
cmp ecx, 0x56
jl 0x180066ff2
cmp ecx, 0x60
jge 0x180066ff7
mov eax, 0x1159d66c
add rsp, 0x28
ret
cmp ecx, 0x60
jl 0x180067008
cmp ecx, 0x62
jge 0x180067011
mov eax, 0x5f5e102
add rsp, 0x28
ret
xor eax, eax
cmp ecx, 0x62
jl 0x180066df7
cmp ecx, 0x64
jge 0x180066dfc
mov eax, 0x5f5e1b0
add rsp, 0x28
ret
cmp ecx, 0x69
jge 0x180067033
mov eax, 0x5f5eca2
add rsp, 0x28
ret
cmp ecx, 0x6a
jge 0x180067042
mov eax, 0x5f5eca3
add rsp, 0x28
ret
cmp ecx, 0x6b
jge 0x180067051
mov eax, 0x5f5eca4
add rsp, 0x28
ret
cmp ecx, 0x6c
jge 0x180067060
mov eax, 0x5f5eca5
add rsp, 0x28
ret
cmp ecx, 0x6d
jge 0x18006706f
mov eax, 0x5f5eca6
add rsp, 0x28
ret
mov edx, 0x5f5eca7
cmove eax, edx
add rsp, 0x28
ret
Function at 0x1800753b0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0xe0
mov rbx, rcx
lea rcx, [0x1802dfc50]
jmp 0x18036bb78

Function at 0x18008bb60
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
lea rcx, [0x1802e05f0]
jmp 0x18036c05d

Function at 0x18008d550
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
lea rcx, [0x1802e06a0]
jmp 0x18036c6bb

Function at 0x18008d950
Capabilities:
Access peb ldr_data

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x10]
mov rbx, rdx
mov qword [rsp + 0x20], rdx
cmp qword [rbx + 0x30], rcx
je 0x18008d98f
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x20], rbx
cmp rbx, rdx
je 0x18008d989
jmp 0x18008d973
cmp qword [rbx + 0x30], rcx
jne 0x18008d9bb
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rax + 8], rcx
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
movzx r8d, word [rbx + 0x48]
xor edx, edx
mov rcx, qword [rbx + 0x50]
call fcn.180246a10
xor eax, eax
mov qword [rbx], rax
jmp 0x18008d9bb
add rsp, 0x30
pop rbx
ret
Function at 0x180091000
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x180334940]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rdi, rcx
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x20], rcx
lea r15, vtable.CVolObject.0
mov qword [rsp + 0x20], r15
xor r14d, r14d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x30], r14
lea rax, vtable.CWString.0
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
lea r12, vtable.CVolMem.0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], 0x40
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x70], 0xfe
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x6c]
call fcn.180246a10
mov dword [rbp - 0x70], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800911eb
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800911e2
nop word [rax + rax]
mov rdx, r14
mov qword [rsp + 0x38], rdx
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x180091127
mov rdx, rax
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x40]
call qword [rax + 0x18]
mov rdx, qword [rsp + 0x38]
mov rcx, r14
mov qword [rsp + 0x58], rcx
mov r8, r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r14
cmp word [rbp - 0x44], cx
je 0x180091193
lea r9, [rbp - 0x44]
mov rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [r9 + rax*2], cx
jne 0x180091150
lea rbx, [rax*2 + 2]
test rbx, rbx
jle 0x180091193
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1800a42b0
mov r8, rbx
lea rdx, [rbp - 0x44]
mov rcx, rax
call fcn.180246360
mov r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
test rdx, rdx
jne 0x1800911a6
lea rdx, [0x1802d91d0]
test r8, r8
cmovne rdx, rcx
mov rcx, qword [rdi + 0x18]
test rcx, rcx
jne 0x1800911c0
cmp qword [rdi + 0x48], rcx
lea rcx, [0x1802d91d0]
je 0x1800911c0
mov rcx, qword [rdi + 0x38]
call fcn.18025151c
mov rcx, rsi
test eax, eax
je 0x18009125a
lea rdx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180091100
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, r14d
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], r12
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x180091214
lea rcx, [rsp + 0x40]
mov r8, qword [rsp + 0x40]
call qword [r8 + 0x18]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x20], r15
mov eax, ebx
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1802439b0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ebx, dword [rbp - 0x68]
jmp 0x1800911ee
Function at 0x1800a1c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor esi, esi
mov r14, r9
mov qword [r8 + 0x28], rsi
mov rbx, r8
mov rbp, rdx
test rdx, rdx
jne 0x1800a1cc2
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, bp
mov r8, r14
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x1800a1db7
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x1800a1db7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x1800a1dae
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x20], rdi
jl 0x1800a1d8c
cmp rdi, 1
jne 0x1800a1d4a
movzx ecx, byte [r14]
mov rax, qword [rbx + 0x18]
mov byte [rax], cl
inc qword [rbx + 0x28]
jmp 0x1800a1da9
cmp rdi, 2
jne 0x1800a1d61
movzx ecx, word [r14]
mov rax, qword [rbx + 0x18]
mov word [rax], cx
add qword [rbx + 0x28], rdi
jmp 0x1800a1da9
cmp rdi, 4
jne 0x1800a1d76
mov ecx, dword [r14]
mov rax, qword [rbx + 0x18]
mov dword [rax], ecx
add qword [rbx + 0x28], rdi
jmp 0x1800a1da9
cmp rdi, 8
jne 0x1800a1d8c
mov rcx, qword [r14]
mov rax, qword [rbx + 0x18]
mov qword [rax], rcx
add qword [rbx + 0x28], rdi
jmp 0x1800a1da9
test eax, eax
je 0x1800a1da9
mov rdx, rdi
mov rcx, rbx
call fcn.1800a42b0
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.180246360
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
Function at 0x1800a3140
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
test rcx, rcx
je 0x1800a327f
cmp word [rcx], 0
je 0x1800a327f
lea rdx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x60], rdx
lea rsi, vtable.CVolObject.0
mov qword [rbp - 0x60], rsi
xor edi, edi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rdi
lea rax, vtable.CWString.0
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rdi
lea r14, vtable.CVolMem.0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], 0x40
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x10], 0xfe
cmp word [rcx], di
je 0x1800a3236
cmp word [rcx + 2], di
je 0x1800a3236
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rcx + r8*2], 0
jne 0x1800a31f0
cmp word [rcx + r8*2 - 2], 0x5c
jne 0x1800a3236
cmp word [rcx + r8*2 - 4], 0x3a
je 0x1800a3236
dec r8
mov rdx, rcx
lea rcx, [rbp - 0x60]
call fcn.1800a5a30
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x1800a3236
lea rcx, [0x1802d91d0]
cmp qword [rbp - 0x18], 0
cmovne rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rbx, rdi
cmp eax, 0xffffffff
setne bl
lea rax, [rbp - 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x40], r14
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x1800a3266
lea rcx, [rbp - 0x40]
mov r8, qword [rbp - 0x40]
call qword [r8 + 0x18]
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x60], rsi
mov rax, rbx
jmp 0x1800a3281
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1800a32a0
Capabilities:
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x180334940]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rcx
test rcx, rcx
je 0x1800a348f
cmp word [rcx], 0
je 0x1800a348f
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x20], rcx
lea r14, vtable.CVolObject.0
mov qword [rsp + 0x20], r14
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rsi
lea rax, vtable.CWString.0
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
lea r15, vtable.CVolMem.0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], 0x40
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x70], 0xfe
mov ebx, esi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
movzx eax, word [rdi]
cmp ax, 0x5c
je 0x1800a339b
test ax, ax
je 0x1800a33da
cmp word [rdi + 2], 0x3a
jne 0x1800a33da
cmp word [rdi + 4], 0x5c
jne 0x1800a33da
mov edx, 0x5c
mov rcx, rdi
call fcn.180246254
test rax, rax
je 0x1800a33d5
cmp rax, rdi
jbe 0x1800a33be
lea rcx, [rax - 2]
cmp word [rcx], 0x3a
cmovne rax, rcx
sub rax, rdi
lea r8, [rax + 2]
sar r8, 1
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1800a5a30
mov rbx, qword [rsp + 0x38]
test rbx, rbx
jne 0x1800a33f9
cmp qword [rsp + 0x68], rbx
jne 0x1800a33ef
lea rbx, [0x1802d91d0]
jmp 0x1800a33f9
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x1800a3440
cmp word [rbx], 0
je 0x1800a3440
lea rdx, [rbp - 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1800a3440
cmp word [rbx], 0
je 0x1800a3421
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
cmp word [rbp - 0x70], 0
je 0x1800a344c
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x1800a344c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], r15
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1800a3471
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x40]
call qword [rax + 0x18]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x20], r14
mov rax, rbx
jmp 0x1800a3491
xor eax, eax
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1802439b0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1800a9300
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800a9347
xor al, al
jmp 0x1800a93e9
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x1800a9371
xor al, al
jmp 0x1800a93e9
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x1800a93e1
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x1800a93e1
mov al, 1
jmp 0x1800a93e9
jmp 0x1800a93e7
xor al, al
add rsp, 0x78
ret

Function at 0x1800a96f0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18033ba40]
mov qword [rsp + 0x28], rax
jmp 0x1800a9710
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800a973f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1800a973d
call sub.KERNEL32.dll_GetLastError
jmp 0x1800a9741
jmp 0x1800a9702
xor eax, eax
add rsp, 0x38
ret
Function at 0x1800a9780
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x18033ba58], eax
je 0x1800a97ad
mov eax, 0x10dd
jmp 0x1800a99c6
cmp dword [0x18033ba5c], 0
je 0x1800a97c1
mov eax, dword [0x18033ba5c]
jmp 0x1800a99c6
cmp qword [rsp + 0x78], 0
jne 0x1800a97d3
mov eax, 0x57
jmp 0x1800a99c6
cmp qword [rsp + 0x70], 0
jne 0x1800a97e5
mov eax, 6
jmp 0x1800a99c6
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x1800a9817
mov dword [rsp + 0x20], 6
mov eax, dword [rsp + 0x20]
mov dword [0x18033ba5c], eax
mov rax, qword [rsp + 0x70]
mov qword [0x18033ba60], rax
mov eax, dword [rsp + 0x20]
jmp 0x1800a99c6
mov ecx, 0x30
call fcn.1800ab474
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1800a9889
mov dword [rsp + 0x20], 8
mov eax, dword [rsp + 0x20]
mov dword [0x18033ba5c], eax
cmp qword [rsp + 0x30], 0
je 0x1800a9874
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x50]
call fcn.18005bba0
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x70]
mov qword [0x18033ba60], rax
mov eax, dword [rsp + 0x20]
jmp 0x1800a99c6
xor edx, edx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call fcn.1800a9750
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, qword [rsp + 0x78]
call fcn.1800a9750
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 0x3e]
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp dword [rsp + 0x24], 0
je 0x1800a98e6
movsxd rax, dword [rsp + 0x24]
cmp rax, 0x1e
jbe 0x1800a9903
mov dword [rsp + 0x20], 9
cmp dword [0x18033ba50], 0
je 0x1800a98fe
jmp 0x1800a984a
jmp 0x1800a9840
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
cmp qword [rax + 0x50], rcx
je 0x1800a9930
mov dword [rsp + 0x20], 9
cmp dword [0x18033ba50], 0
je 0x1800a992b
jmp 0x1800a984a
jmp 0x1800a9840
mov dword [rsp + 0x28], 0
movsxd rax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1800a9967
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x1800a9840
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 1
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x28]
mov dword [rax + 0x28], ecx
mov rax, qword [rsp + 0x30]
mov rcx, qword [0x18033ba70]
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov qword [0x18033ba70], rax
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800a99d0
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x18033ba58], eax
je 0x1800a99eb
mov eax, 0x10dd
jmp 0x1800a9b10
mov rax, qword [0x18033ba70]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800a9a95
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x1800a9a60
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x1800a9a60
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.1800a9100
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.18005bba0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x1800a99f7
mov qword [0x18033ba70], 0
call fcn.1800a94b0
mov rax, qword [0x18033ba68]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800a9af9
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, qword [rsp + 0x48]
call fcn.18005bba0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x1800a9ab1
mov qword [0x18033ba68], 0
mov dword [0x18033ba58], 0
xor eax, eax
add rsp, 0x68
ret