joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002420
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x180002591
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180002591
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x180002591
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x1800024c6
nop
cmp rdi, r11
jae 0x180002591
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x1800024b0
cmp rdi, r11
jae 0x180002591
movzx eax, word [rdi]
test ax, ax
je 0x180002591
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x1800024fc
mov edx, ebx
mov rcx, rsi
call fcn.180001f10
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x180002519
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.180010ea0
test eax, eax
je 0x180002567
cmp eax, 0xc
je 0x18000255c
cmp eax, 0x16
je 0x180002551
cmp eax, 0x22
je 0x180002551
cmp eax, 0x50
je 0x180002567
mov ecx, 0x80004005
call fcn.180001000
int3
mov ecx, 0x80070057
call fcn.180001000
int3
mov ecx, 0x8007000e
call fcn.180001000
int3
test ebx, ebx
js 0x180002586
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x180002586
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x180002593
mov ecx, 0x80070057
call fcn.180001000
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1800027b0
Capabilities:
Get file version info

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1070
call fcn.180025830
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x10a8], rbx
mov qword [rsp + 0x10b0], rbp
mov qword [rsp + 0x10b8], rsi
mov rax, qword [0x180037318]
xor rax, rsp
mov qword [rsp + 0x1060], rax
mov rdi, rcx
xor sil, sil
mov byte [rsp + 0x50], sil
mov ebx, 0x1000
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x51]
call fcn.180011580
xor edx, edx
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov r8d, eax
cmp eax, ebx
cmova r8d, ebx
xor r15d, r15d
mov eax, r15d
test r8d, r8d
setne al
test eax, eax
je 0x18000284b
lea r9, [rsp + 0x50]
xor edx, edx
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoW
mov dword [rsp + 0x20], r15d
test eax, eax
je 0x1800029e1
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x38]
lea rdx, str.VarFileInfoTranslation
lea rcx, [rsp + 0x50]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1800029dc
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x1800029d7
mov r12d, r15d
test eax, 0xfffffffc
jbe 0x1800029d2
mov rbp, r15
nop
nop
test sil, sil
jne 0x1800029cd
lea rcx, [0x1800371a8]
mov rax, qword [0x1800371a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
movzx r9d, word [rax + rbp + 2]
movzx r8d, word [rax + rbp]
lea rdx, str.StringFileInfo_04x_04xCompanyName
lea rcx, [rsp + 0x28]
call fcn.180002700
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x24], r15d
mov rbx, qword [rsp + 0x28]
cmp dword [rbx - 8], 1
jle 0x18000290b
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.180001e00
mov rbx, qword [rsp + 0x28]
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x30]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call sub.VERSION.dll_VerQueryValueW
mov r11d, dword [rsp + 0x24]
test r11d, r11d
je 0x180002994
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180002994
mov r13d, r15d
lea r14, str.Grisoft
test sil, sil
jne 0x180002994
mov r9, qword [r14]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r9
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp ecx, r11d
cmova ecx, r11d
mov r8d, ecx
mov rcx, r9
call fcn.180012050
movzx esi, sil
test eax, eax
mov eax, 1
cmove esi, eax
add r13d, eax
add r14, 8
cmp r13d, 3
jae 0x180002994
mov rdx, qword [rsp + 0x30]
mov r11d, dword [rsp + 0x24]
jmp 0x180002940
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1800029b0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add r12d, 1
add rbp, 4
mov ecx, dword [rsp + 0x20]
shr ecx, 2
cmp r12d, ecx
jb 0x1800028a0
mov al, sil
jmp 0x1800029e4
mov al, sil
jmp 0x1800029e4
mov al, sil
jmp 0x1800029e4
mov al, sil
jmp 0x1800029e4
mov al, sil
jmp 0x1800029e4
mov al, sil
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.1800111b0
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180003550
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x180037318]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea eax, [rdx - 0x1000]
mov rdi, rcx
xor cl, cl
cmp eax, 0xff
mov esi, edx
ja 0x180003594
movzx ecx, cl
mov eax, 1
cmp edx, 0x104d
cmovne ecx, eax
test rdi, rdi
je 0x1800035af
cmp rdi, qword [0x180038e68]
jne 0x1800035af
test cl, cl
jne 0x1800036fb
jmp 0x18000364f
test cl, cl
jne 0x1800036fb
test rdi, rdi
je 0x1800036fb
xor edx, edx
lea rcx, [rsp + 0x32]
mov word [rsp + 0x30], 0
lea r8d, [rdx + 0x7e]
call fcn.180011580
lea rdx, [rsp + 0x30]
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.SysListView32
lea rcx, [rsp + 0x30]
call fcn.1800124f0
test eax, eax
jne 0x1800036fb
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0xfe
mov word [rsp + 0x30], ax
call fcn.180011580
lea rdx, [rsp + 0x30]
mov r8d, 0x80
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rsp + 0x30], 0
jne 0x1800036fb
cmp dword [0x180038e60], 6
jb 0x1800036fb
mov qword [0x180038e68], rdi
lea rdx, str.svcboot
mov rcx, rdi
mov qword [rsp + 0x158], rbx
call fcn.180003310
lea rdx, str.atisvc
mov rcx, rdi
movzx ebx, al
call fcn.180003310
lea rdx, [0x180038c50]
mov rcx, rdi
or bl, al
call fcn.180003310
or bl, al
mov rbx, qword [rsp + 0x158]
je 0x1800036fb
cmp esi, 0x104d
jne 0x1800036da
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ValidateRgn]
xor eax, eax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], eax
call qword [sym.imp.USER32.dll_GetCursorPos]
movzx r9d, word [rsp + 0x24]
movzx eax, word [rsp + 0x20]
mov edx, 0x200
shl r9d, 0x10
or r9, rax
jmp 0x1800036ef
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_InvalidateRgn]
xor r9d, r9d
lea edx, [r9 + 0xf]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800111b0
mov rsi, qword [rsp + 0x160]
add rsp, 0x140
pop rdi
ret
Function at 0x180004490
Capabilities:
Get graphical window text

Disassembly:
mov r11, rsp
push rbx
push rdi
sub rsp, 0x4d8
mov rax, qword [0x180037318]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x20], r13
lea eax, [rdx - 0x1000]
xor bpl, bpl
xor r13b, r13b
xor dil, dil
cmp eax, 0xff
mov qword [r11 - 0x28], r14
mov esi, edx
mov rbx, rcx
mov r14d, 1
ja 0x18000451d
cmp edx, 0x1009
jne 0x1800044fe
mov rcx, qword [0x180038e68]
cmp rbx, rcx
jne 0x180004524
xor ecx, ecx
mov qword [0x180038e68], rcx
jmp 0x180004524
cmp edx, 0x1030
je 0x18000451d
mov rcx, qword [0x180038e68]
movzx edi, dil
cmp edx, 0x1060
cmovne edi, r14d
jmp 0x180004524
mov rcx, qword [0x180038e68]
test rbx, rbx
je 0x180004537
cmp rbx, rcx
jne 0x180004537
movzx ebp, r14b
jmp 0x180004686
test dil, dil
jne 0x180004686
test rcx, rcx
je 0x180004553
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x180004686
test rbx, rbx
je 0x180004686
xor edx, edx
lea rcx, [rsp + 0x22]
mov word [rsp + 0x20], 0
lea r8d, [rdx + 0x7e]
call fcn.180011580
lea rdx, [rsp + 0x20]
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.SysListView32
lea rcx, [rsp + 0x20]
call fcn.1800124f0
test eax, eax
jne 0x180004686
lea rcx, [rsp + 0xa2]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0xa0], ax
call fcn.180011580
lea rdx, [rsp + 0xa0]
mov r8d, 0x208
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rsp + 0xa0], 0
jne 0x180004686
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je 0x180004686
mov rcx, rax
mov qword [rsp + 0x4d0], r12
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
mov r12, rax
je 0x18000467e
cmp word [0x180038e80], 0
jne 0x180004640
lea r8, [0x180038e80]
lea rcx, str.filemgmt.dll
mov r9d, 0x104
mov edx, 0x89c
call fcn.1800042a0
cmp word [0x180038e80], 0
je 0x18000467e
lea rdx, [rsp + 0xa0]
mov r8d, 0x208
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [0x180038e80]
lea rcx, [rsp + 0xa0]
call fcn.1800122b0
test rax, rax
je 0x18000467e
mov qword [0x180038e68], rbx
mov bpl, r14b
movzx r13d, r14b
mov r12, qword [rsp + 0x4d0]
cmp esi, 0x4e
mov rsi, qword [rsp + 0x500]
jne 0x18000469e
movzx edi, dil
test r13b, r13b
cmove edi, r14d
mov r14, qword [rsp + 0x4c0]
mov r13, qword [rsp + 0x4c8]
test bpl, bpl
mov rbp, qword [rsp + 0x4f8]
je 0x1800046ed
test dil, dil
jne 0x1800046ed
lea rdx, str.svcboot
mov rcx, rbx
call fcn.180003310
lea rdx, str.atisvc
mov rcx, rbx
call fcn.180003310
lea rdx, [0x180038c50]
mov rcx, rbx
call fcn.180003310
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.1800111b0
add rsp, 0x4d8
pop rdi
pop rbx
ret
Function at 0x180004710
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x2c0
mov rax, qword [0x180037318]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea eax, [rdx - 0x1000]
mov rbx, rcx
xor cl, cl
cmp eax, 0xff
ja 0x18000474e
movzx ecx, cl
mov eax, 1
cmp edx, 0x104d
cmovne ecx, eax
test rbx, rbx
mov rax, qword [0x180038e68]
mov qword [rsp + 0x2d8], rsi
mov qword [rsp + 0x2e0], rdi
je 0x18000477c
cmp rbx, rax
jne 0x18000477c
test cl, cl
jne 0x1800048bd
jmp 0x180004890
test cl, cl
jne 0x1800048bd
test rax, rax
je 0x18000479a
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1800048bd
test rbx, rbx
je 0x1800048bd
xor edx, edx
lea rcx, [rsp + 0x22]
mov word [rsp + 0x20], 0
lea r8d, [rdx + 0x7e]
call fcn.180011580
lea rdx, [rsp + 0x20]
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.SysListView32
lea rcx, [rsp + 0x20]
call fcn.1800124f0
test eax, eax
jne 0x1800048bd
cmp word [0x180039090], ax
lea rdi, [0x180039090]
jne 0x18000480f
lea edx, [rax + 0x6a]
lea rcx, str.msconfig.exe
mov r9d, 0x104
mov r8, rdi
call fcn.1800042a0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
mov rsi, rax
je 0x1800048bd
lea rcx, [rsp + 0xa2]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0xa0], 0
call fcn.180011580
lea rdx, [rsp + 0xa0]
mov r8d, 0x104
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r11, [rsp + 0xa0]
sub rdi, r11
nop
nop
nop
movzx edx, word [r11]
movzx eax, word [r11 + rdi]
sub edx, eax
jne 0x180004885
add r11, 2
test eax, eax
jne 0x180004870
test edx, edx
jne 0x1800048bd
mov qword [0x180038e68], rbx
lea rdx, str.svcboot
mov rcx, rbx
call fcn.180003310
lea rdx, str.atisvc
mov rcx, rbx
call fcn.180003310
lea rdx, [0x180038c50]
mov rcx, rbx
call fcn.180003310
mov rdi, qword [rsp + 0x2e0]
mov rsi, qword [rsp + 0x2d8]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1800111b0
add rsp, 0x2c0
pop rbx
ret
Function at 0x180006d20
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 8]
xor esi, esi
test rcx, rcx
jne 0x180006d41
mov eax, esi
jmp 0x180006d4c
mov rax, qword [rdi + 0x10]
sub rax, rcx
sar rax, 3
test eax, eax
mov qword [rsp + 0x30], rbp
je 0x180006d99
mov ebp, eax
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x180006d70
mov rax, qword [rdi + 0x10]
sub rax, rcx
sar rax, 3
cmp rsi, rax
jb 0x180006d75
call fcn.180012f20
mov rax, qword [rdi + 8]
mov rbx, qword [rax + rsi*8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 1
sub rbp, 1
jne 0x180006d57
mov rsi, qword [rdi + 0x10]
cmp qword [rdi + 8], rsi
jbe 0x180006da8
call fcn.180012f20
mov rbx, qword [rdi + 8]
cmp rbx, qword [rdi + 0x10]
jbe 0x180006db7
call fcn.180012f20
cmp rbx, rsi
je 0x180006dea
mov rax, qword [rdi + 0x10]
sub rax, rsi
sar rax, 3
test rax, rax
lea rdx, [rax*8]
lea rbp, [rdx + rbx]
jle 0x180006de6
mov r9, rdx
mov r8, rsi
mov rcx, rbx
call fcn.1800111d0
mov qword [rdi + 0x10], rbp
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180007d00
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x180037318]
xor rax, rsp
mov qword [rsp + 0x260], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
mov esi, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x180007d9a
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x234
call fcn.180011580
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], 0x238
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180007d91
nop
test ebx, ebx
jne 0x180007d91
cmp dword [rsp + 0x28], esi
jne 0x180007d80
mov ebx, dword [rsp + 0x40]
jmp 0x180007d8d
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x180007d70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800111b0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1800083d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x860
mov rax, qword [0x180037318]
xor rax, rsp
mov qword [rsp + 0x850], rax
lea rcx, [rsp + 0x442]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x440], 0
call fcn.180011580
lea rdx, [rsp + 0x440]
mov r8d, 0x208
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x30], 0
call fcn.180011580
lea rcx, [rsp + 0x30]
mov edx, 0x208
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, str.kernel32
xor edi, edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rbx, rax
je 0x18000848c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x20]
mov rcx, rax
call rbx
test eax, eax
je 0x1800084a1
cmp dword [rsp + 0x20], edi
je 0x1800084a1
lea rcx, [rsp + 0x30]
mov edx, 0x208
call fcn.180007ba0
lea rdx, str.svchost.exe
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
sete al
test al, al
jne 0x180008599
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x870], rsi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.rundll32.exe
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, 1
test eax, eax
jne 0x180008555
call fcn.180007d00
test eax, eax
je 0x180008555
lea rcx, str.F486943B_9DC8_41AB_9C9E_904930A090F7
mov edx, eax
call fcn.1800019b0
test rax, rax
mov rbx, rax
je 0x180008555
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
test eax, eax
cmove edi, esi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x180008555
mov al, sil
jmp 0x180008591
xor bl, bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str.93FBB0E4_9FDB_40fd_9C27_3B3DA6207B6B
mov edx, eax
call fcn.1800019b0
test rax, rax
mov rdi, rax
je 0x18000858f
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx ebx, bl
mov rcx, rdi
test eax, eax
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov rsi, qword [rsp + 0x870]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1800111b0
mov rbx, qword [rsp + 0x878]
add rsp, 0x860
pop rdi
ret
Function at 0x18000a100
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rdi, rcx
test rcx, rcx
je 0x18000a199
call qword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
jne 0x18000a195
lea edx, [rax + 0x14]
xor ecx, ecx
lea r9d, [rax + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18000a19b
mov rcx, qword [0x1800370a0]
mov qword [rax], rcx
mov rcx, qword [0x1800370a8]
mov qword [rax + 8], rcx
mov ecx, dword [0x1800370b0]
mov dword [rax + 0x10], ecx
mov qword [rax + 4], rdi
jmp 0x18000a171
mov dword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
mov edx, 0x14
lea r8d, [rdx + 0xc]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, rbx
jmp 0x18000a19b
xor eax, eax
jmp 0x18000a19b
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18000a5f0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [0x180037318]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov eax, dword [0x18003c76c]
xor esi, esi
mov rbp, rcx
test al, 1
jne 0x18000a69e
or eax, 1
lea rcx, [rsp + 0x74]
xor edx, edx
mov r8d, 0x118
xor bl, bl
mov dword [0x18003c76c], eax
call fcn.180011580
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x80], 2
jne 0x18000a696
mov eax, dword [rsp + 0x74]
cmp eax, 6
jbe 0x18000a675
mov bl, 1
mov byte [0x18003c768], bl
jmp 0x18000a6a4
jne 0x18000a696
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x18000a689
mov bl, 1
mov byte [0x18003c768], bl
jmp 0x18000a6a4
movzx ebx, bl
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov byte [0x18003c768], bl
jmp 0x18000a6a4
mov bl, byte [0x18003c768]
mov eax, 0x1000
mov edi, 0x400
test bl, bl
cmovne edi, eax
mov qword [rsp + 0x40], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], esi
lea r9, [rsp + 0x40]
mov r8, rbx
mov rdx, rbp
mov rcx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rax, qword [rsp + 0x40]
lea rcx, [0x18002b1c8]
test rax, rax
cmovne rbp, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000a723
lea rdx, str.GetProcessId
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a723
mov rcx, rbp
call rax
mov esi, eax
jmp 0x18000a77b
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000a77b
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a77b
xor ecx, ecx
lea r8, [rsp + 0x48]
xor edx, edx
lea r9d, [rcx + 0x20]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rcx
mov rcx, rbp
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
call rax
test eax, eax
cmove esi, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000a78b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1800111b0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18000a7e0
Capabilities:
Enumerate threads

Disassembly:
push rbx
push rbp
push r12
push r13
push r14
sub rsp, 0x50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
lea ecx, [rdx + 4]
mov r13d, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
xor r14d, r14d
test rax, rax
mov rbp, rax
mov rbx, r14
je 0x18000a939
lea rdx, [rsp + 0x30]
mov rcx, rax
mov qword [rsp + 0x88], rsi
mov dword [rsp + 0x30], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
mov esi, eax
je 0x18000a928
mov qword [rsp + 0x90], rdi
nop
nop
test rbx, rbx
jne 0x18000a920
cmp dword [rsp + 0x3c], r12d
jne 0x18000a909
mov r8d, dword [rsp + 0x38]
cmp r8d, r13d
je 0x18000a909
lea ecx, [rbx + 0x40]
xor edx, edx
mov qword [rsp + 0x80], r14
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
mov rdi, rax
je 0x18000a8de
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000a8d5
lea rdx, str.NtQueryInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000a8d5
lea r9d, [rbx + 8]
lea r8, [rsp + 0x80]
lea edx, [rbx + 9]
mov rcx, rdi
mov qword [rsp + 0x20], r14
call rax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
call fcn.18000a060
test al, al
jne 0x18000a909
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
mov rbx, rax
jne 0x18000a918
lea rdx, [rsp + 0x30]
mov rcx, rbp
call sub.KERNEL32.dll_Thread32Next
mov esi, eax
test esi, esi
jne 0x18000a850
mov rdi, qword [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x88]
mov rax, rbx
add rsp, 0x50
pop r14
pop r13
pop r12
pop rbp
pop rbx
ret
Function at 0x18000ac20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor r12d, r12d
mov rsi, rcx
mov rcx, qword [rcx + 0x28]
test rcx, rcx
mov r13, rdx
mov edi, r12d
jne 0x18000aca7
test rdx, rdx
je 0x18000ac8c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rsi + 0x28]
mov r8, rbx
mov rdx, r13
mov rcx, rax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp qword [rsi + 0x28], rdi
jmp 0x18000acaf
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x28], rax
cmp rax, rdi
jmp 0x18000acaf
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x18000acce
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov edi, eax
jle 0x18000acc6
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x18000ad81
cmp qword [rsi + 0x30], r12
jne 0x18000ad03
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rsi + 0x30], rax
jne 0x18000ad03
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov edi, eax
jle 0x18000ad03
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x18000ad81
cmp qword [rsi + 0x20], r12
jne 0x18000ad81
lea rbx, [rsi + 0x18]
lea rbp, [0x18000a960]
test rbp, rbp
mov dword [rbx], r12d
je 0x18000ad64
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x18000ad35
call fcn.18000a200
cmp rax, rbp
jne 0x18000ad64
jmp 0x18000ad46
mov rcx, rbp
call fcn.18000a100
test rax, rax
mov qword [rsi + 0x10], rax
je 0x18000ad64
mov r8, qword [rsi + 0x10]
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r12, rax
test r12, r12
mov qword [rsi + 0x20], r12
jne 0x18000ad81
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x18000ad83
movzx eax, ax
or eax, 0x80070000
jmp 0x18000ad83
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret