joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009f0b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r10d, r10d
mov rbp, r8
mov rsi, rdx
mov r12, rcx
mov rbx, rdx
test rdx, rdx
je 0x18009f0f1
cmp byte [rdx], r10b
je 0x18009f0e9
inc rbx
cmp byte [rbx], r10b
jne 0x18009f0e1
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 8]
xor edi, edi
test r13d, r13d
jle 0x18009f22d
mov qword [rsp + 0x40], r14
lea r14, [0x18012ad60]
nop dword [rax]
cmp edi, 2
jge 0x18009f11e
mov r9d, edi
xor r9d, 1
jmp 0x18009f121
mov r9d, edi
test rbp, rbp
je 0x18009f184
mov rax, qword [r12 + 0x10]
movsxd rcx, r9d
mov rdx, rbp
shl rcx, 5
mov r8, qword [rcx + rax]
movzx ecx, byte [rbp]
test cl, cl
je 0x18009f16f
nop word [rax + rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x18009f16f
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x18009f150
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x18009f201
mov rax, qword [r12 + 0x10]
movsxd rcx, r9d
shl rcx, 5
mov r10, qword [rcx + rax + 0x18]
cmp qword [r10 + 0x18], 0
je 0x18009f1da
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x18009f1cf
nop dword [rax + rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x18009f1b0
xor edx, edx
mov eax, r8d
div dword [r10 + 8]
jmp 0x18009f1dc
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 8]
mov r8d, ebx
mov rdx, rsi
call fcn.180067ef0
test rax, rax
je 0x18009f1fe
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x18009f20c
jmp 0x18009f201
xor r10d, r10d
inc edi
cmp edi, r13d
jl 0x18009f110
mov r14, qword [rsp + 0x40]
mov rax, r10
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, r10
jmp 0x18009f214
Function at 0x18009f310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
xor r9d, r9d
mov rbp, r8
mov rsi, rdx
mov rbx, rdx
test rdx, rdx
je 0x18009f348
cmp byte [rdx], r9b
je 0x18009f340
inc rbx
cmp byte [rbx], r9b
jne 0x18009f338
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 8]
xor edi, edi
test r13d, r13d
jle 0x18009f46c
mov qword [rsp + 0x40], r12
mov r12, qword [rcx + 0x10]
mov qword [rsp + 0x48], r14
lea r14, [0x18012ad60]
nop dword [rax]
cmp edi, 2
jge 0x18009f37c
mov eax, edi
xor eax, 1
jmp 0x18009f37e
mov eax, edi
movsxd r8, eax
shl r8, 5
mov r10, qword [r8 + r12 + 0x18]
test rbp, rbp
je 0x18009f3d4
movzx ecx, byte [rbp]
mov r8, qword [r8 + r12]
mov rdx, rbp
test cl, cl
je 0x18009f3bf
nop
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x18009f3bf
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x18009f3a0
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x18009f441
cmp qword [r10 + 0x30], 0
je 0x18009f41a
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x18009f40f
nop word [rax + rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x18009f3f0
xor edx, edx
mov eax, r8d
div dword [r10 + 0x20]
jmp 0x18009f41c
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 0x20]
mov r8d, ebx
mov rdx, rsi
call fcn.180067ef0
test rax, rax
je 0x18009f43e
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x18009f44c
jmp 0x18009f441
xor r9d, r9d
inc edi
cmp edi, r13d
jl 0x18009f370
mov r12, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rax, r9
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov rax, r9
jmp 0x18009f459
Function at 0x1800abd00
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx]
mov rax, rdx
test rdx, rdx
je 0x1800abd1f
cmp byte [rdx], 0
je 0x1800abd18
inc rax
cmp byte [rax], 0
jne 0x1800abd10
sub eax, edx
and eax, 0x3fffffff
mov rcx, qword [rcx + 0x78]
mov r8d, eax
add rcx, 0x50
jmp fcn.180067fc0
Function at 0x1800c4800
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov r13, qword [rcx + 0x18]
mov r15, qword [rcx]
mov eax, r8d
mov r12, rdx
mov r14, rcx
test rdx, rdx
je 0x1800c4a38
mov qword [r11 - 0x28], rdi
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
xor edi, edi
nop
cmp eax, 0x63
jne 0x1800c484d
movzx edx, byte [r12 + 1]
jmp 0x1800c4850
movzx edx, al
mov byte [r14 + 0x1e1], dl
movzx ecx, byte [r12]
sub ecx, 0x69
je 0x1800c495c
sub ecx, 1
je 0x1800c492b
cmp ecx, 1
je 0x1800c48d3
mov rdx, qword [r12 + 0x10]
xor r8d, r8d
mov rcx, r15
call fcn.1800962b0
mov byte [rsp + 0x30], 4
mov dword [rsp + 0x34], edi
mov byte [rsp + 0x31], 0
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x3c], edi
mov rbx, rax
test rax, rax
je 0x1800c49bc
mov r9, qword [r14]
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, r14
call fcn.1800c0bc0
mov rdx, rbx
mov rcx, r15
call fcn.1800b78d0
mov rdx, rbx
mov rcx, r15
call fcn.1800645a0
jmp 0x1800c49bc
mov rdx, qword [r12 + 0x28]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call fcn.180095ab0
mov rdx, qword [r12 + 0x30]
movzx edi, byte [r14 + 0x1e1]
xor r8d, r8d
mov rcx, r15
mov rsi, rax
call fcn.180095dd0
mov rdx, r12
mov rcx, r14
mov rbx, rax
call fcn.1800c46d0
mov r9, rsi
mov r8, rbx
mov rcx, r14
mov rdx, rax
mov dword [rsp + 0x20], edi
call fcn.1800c5180
xor edi, edi
jmp 0x1800c49bc
mov rdx, qword [r12 + 0x28]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call fcn.180095ab0
mov rdx, r12
mov rcx, r14
mov rbx, rax
call fcn.1800c46d0
mov r8, rbx
mov rdx, rax
mov rcx, r14
call fcn.1800a5de0
jmp 0x1800c49bc
movzx ebp, dl
mov rdx, qword [r12 + 0x38]
mov rcx, r15
call fcn.1800961c0
mov rdx, qword [r12 + 0x10]
xor r8d, r8d
mov rcx, r15
mov rsi, rax
call fcn.1800962b0
mov rdx, qword [r12 + 0x30]
xor r8d, r8d
mov rcx, r15
mov rdi, rax
call fcn.180095dd0
mov rdx, r12
mov rcx, r14
mov rbx, rax
call fcn.1800c46d0
mov r9, rdi
mov r8, rbx
mov rcx, r14
mov rdx, rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rsi
call fcn.1800ae820
xor edi, edi
cmp byte [r12], 0x74
je 0x1800c4a0c
movsxd rbx, dword [r13 + 0x18]
cmp dword [r13 + 0x1c], ebx
jg 0x1800c49d9
mov rcx, r13
call fcn.180084820
test eax, eax
jne 0x1800c4a0c
mov rax, qword [r13 + 0x20]
inc dword [r13 + 0x18]
lea rcx, [rbx + rbx*2]
mov byte [rax + rcx*8], 0x3a
mov byte [rax + rcx*8 + 3], 0
mov dword [rax + rcx*8 + 4], edi
mov dword [rax + rcx*8 + 8], edi
mov dword [rax + rcx*8 + 0xc], edi
mov qword [rax + rcx*8 + 0x10], rdi
mov byte [rax + rcx*8 + 1], 0
mov byte [r13 + 0xa2], 0
mov r12, qword [r12 + 0x40]
mov eax, dword [rsp + 0x80]
test r12, r12
jne 0x1800c4840
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1800caec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx]
xor r15d, r15d
mov rbp, r8
mov r8, rcx
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x20], r15d
mov r14d, dword [rcx]
mov r13, qword [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov edi, r15d
mov esi, r15d
mov r12, r15
test r14d, r14d
jle 0x1800cb089
nop word [rax + rax]
cmp esi, dword [rbp + 8]
jg 0x1800cb07c
mov rbx, qword [r13]
cmp byte [rbx], 0x98
jne 0x1800cb07c
cmp dword [rbx + 0x30], r9d
jne 0x1800cb07c
mov rdx, rbx
mov rcx, r8
call fcn.180094be0
mov rdx, rax
test rax, rax
jne 0x1800caf5c
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x38]
cmp qword [rbp], r15
je 0x1800caf93
cmp esi, dword [rbp + 8]
jge 0x1800caf93
mov rax, qword [rbp + 0x10]
mov r9d, dword [rax + r12*4]
mov rax, qword [rbp + 0x20]
cmp r9d, dword [rax + 8]
mov eax, 0xffffffff
cmove r9d, eax
mov rax, qword [rbp + 0x48]
movzx r10d, byte [rax + r12]
mov rax, qword [rbp + 0x50]
mov r8, qword [rax + r12*8]
jmp 0x1800caf9d
mov r8, qword [rdx]
or r9d, 0xffffffff
mov r10d, r15d
movsx eax, word [rbx + 0x34]
cmp eax, r9d
jne 0x1800cb046
mov rdx, qword [rdx]
lea rbx, [0x18012ad60]
movzx ecx, byte [rdx]
test cl, cl
je 0x1800cafdd
nop dword [rax + rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + rbx]
cmp byte [rcx + rbx], al
jne 0x1800cafdd
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x1800cafc0
movzx eax, byte [r8]
movzx ecx, byte [rax + rbx]
movzx eax, byte [rdx]
movzx eax, byte [rax + rbx]
cmp eax, ecx
jne 0x1800cb046
movzx eax, byte [r13 + 0x18]
movsxd rcx, dword [rsp + 0x98]
xor eax, r10d
cmp r12, rcx
jle 0x1800cb011
cmp eax, dword [rsp + 0x20]
jne 0x1800cb0c0
jmp 0x1800cb015
mov dword [rsp + 0x20], eax
inc edi
add r13, 0x20
test r9d, r9d
jns 0x1800cb053
mov r9d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
mov r8d, edi
call fcn.1800cae10
test eax, eax
jne 0x1800cb053
mov edi, r14d
jmp 0x1800cb053
movsxd rax, dword [rsp + 0x98]
cmp r12, rax
jge 0x1800cb06f
mov r9d, dword [rsp + 0x88]
inc esi
inc r12
cmp edi, r14d
jge 0x1800cb07c
mov r8, qword [rsp + 0x70]
jmp 0x1800caf20
cmp esi, dword [rbp + 8]
jne 0x1800cb0c0
mov r9d, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x78]
cmp dword [rsp + 0x20], r15d
mov rax, qword [rsp + 0xa0]
setne r15b
cmp edi, r14d
mov dword [rax], r15d
jl 0x1800cb0a9
mov eax, 1
jmp 0x1800cb0c2
cmp byte [rbp + 0x2c], 0
je 0x1800cb0c0
cmp esi, dword [rbp + 8]
jne 0x1800cb0c0
mov r8d, edi
call fcn.1800cae10
test eax, eax
je 0x1800cb0a2
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800e4ca0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x150
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
mov rax, qword [rdx]
xor edi, edi
mov r9d, edi
test rax, rax
sete r9b
test rax, rax
je 0x1800e4dcb
lea edx, [rdi + 2]
lea r8d, [rdi + 1]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_int____ptr64]
nop
call qword [sym.imp.MSVCP90.dll_public:_static_class_std::locale_const____ptr64___cdecl_std::locale::classic_void_]
mov r8, rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rcx, [rsp + rcx + 0x60]
lea rdx, [rsp + 0x168]
call qword [sym.imp.MSVCP90.dll_public:_class_std::locale___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::imbue_class_std::locale_const____ptr64____ptr64]
lea rcx, [rsp + 0x168]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::locale::destructor_void____ptr64]
call fcn.1800e7940
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.1800e7f00
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.1800e7fb0
xor ecx, ecx
call fcn.1800e7ae0
test eax, eax
sete dil
lea rax, str._hooked_successfully_n
lea rbx, str._hook_failed_n
test edi, edi
cmovne rbx, rax
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.18000fa50
mov rcx, rax
mov rdx, rbx
call fcn.18000fcc0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::str_void____ptr64]
cmp qword [rax + 0x20], 8
jb 0x1800e4da6
mov rcx, qword [rax + 8]
jmp 0x1800e4daa
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x38]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::vbase_dtor_void____ptr64]
mov eax, edi
jmp 0x1800e4dce
mov eax, r9d
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800e6e50
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
test rcx, rcx
jne 0x1800e6e66
mov ebx, 0x10000
jmp 0x1800e6e6d
lea rbx, [rcx + 0x10000]
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov edi, 0x5a4d
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800e6ef0
cmp dword [rsp + 0x40], 0x1000
jne 0x1800e6ef2
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x1800e6ef2
bt eax, 8
jb 0x1800e6ef2
cmp word [rbx], di
jne 0x1800e6ee7
mov eax, dword [rbx + 0x3c]
cmp rax, qword [rsp + 0x38]
ja 0x1800e6ee7
cmp eax, 0x40
jb 0x1800e6ee7
cdqe
cmp dword [rax + rbx], 0x4550
jne 0x1800e6ef2
mov rax, rbx
jmp 0x1800e6ef0
jmp 0x1800e6ef2
jmp 0x1800e6f01
mov rcx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x38]
add rbx, rcx
jmp 0x1800e6e92
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1800e6f10
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rsi
push rdi
sub rsp, 0x30
mov r9, rcx
test rcx, rcx
jne 0x1800e6f2b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9, rax
mov eax, 0x5a4d
cmp word [r9], ax
je 0x1800e6f48
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800e7015
movsxd r10, dword [r9 + 0x3c]
add r10, r9
cmp dword [r10], 0x4550
je 0x1800e6f6a
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800e7015
movzx eax, word [r10 + 0x14]
test ax, ax
jne 0x1800e6f86
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800e7015
movzx eax, ax
lea r11, [rax + r10 + 0x18]
xor edx, edx
mov dword [rsp + 0x20], edx
movzx eax, word [r10 + 6]
cmp edx, eax
jae 0x1800e6ff9
lea rcx, [rdx + rdx*4]
lea r8, [r11 + rcx*8]
lea rdi, str..detour
mov rsi, r8
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
jne 0x1800e6ff1
mov eax, dword [r8 + 0xc]
test eax, eax
je 0x1800e6ff9
cmp dword [r8 + 0x10], 0
je 0x1800e6ff9
lea rdi, [r9 + rax]
mov eax, dword [rdi]
cmp eax, 0x40
jb 0x1800e6ff9
cmp dword [rdi + 4], 0x727444
jne 0x1800e6ff9
cmp dword [rdi + 8], 0
jne 0x1800e6fe4
mov dword [rdi + 8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
jmp 0x1800e7015
inc edx
mov dword [rsp + 0x20], edx
jmp 0x1800e6f94
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800e7015
mov rsi, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800e7290
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx], 0x688
mov rbx, rcx
jne 0x1800e726f
cmp edx, 0x688
jb 0x1800e726f
mov edx, dword [rcx + 4]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x48], rdi
xor edi, edi
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0xffffffff
lea r8d, [rdi + 0x40]
mov dword [rsp + 0x50], 0xffffffff
mov dword [rsp + 0x40], 0xffffffff
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800e7262
mov edx, dword [rbx + 8]
mov rcx, qword [rbx + 0x18]
lea r9, [rsp + 0x50]
lea r8d, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800e724b
mov r8d, dword [rbx + 4]
mov rcx, qword [rbx + 0x10]
lea rdx, [rbx + 0x28]
call sub.MSVCR90.dll_memcpy
mov r8d, dword [rbx + 8]
mov rcx, qword [rbx + 0x18]
lea rdx, [rbx + 0x68]
call sub.MSVCR90.dll_memcpy
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1800e722f
mov edx, dword [rbx + 0xc]
lea r9, [rsp + 0x40]
lea r8d, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800e7234
mov r8d, dword [rbx + 0xc]
mov rcx, qword [rbx + 0x20]
lea rdx, [rbx + 0x670]
call sub.MSVCR90.dll_memcpy
mov edx, dword [rbx + 0xc]
mov r8d, dword [rsp + 0x40]
mov rcx, qword [rbx + 0x20]
lea r9, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, 1
jmp 0x1800e7234
mov edi, 1
mov edx, dword [rbx + 8]
mov r8d, dword [rsp + 0x50]
mov rcx, qword [rbx + 0x18]
lea r9, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [rbx + 4]
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x30
pop rbx
ret
push rbx
sub rsp, 0x20
xor ecx, ecx
call fcn.1800e6e50
mov rbx, rax
test rax, rax
je 0x1800e72d9
nop word [rax + rax]
lea r8, [rsp + 0x30]
lea rdx, [0x18012ad40]
mov rcx, rbx
call fcn.1800e7020
test rax, rax
jne 0x1800e72f7
mov rcx, rbx
call fcn.1800e6e50
mov rbx, rax
test rax, rax
jne 0x1800e72b0
mov ecx, 0x7e
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x7e
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x1800e72e4
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x1800e7140

Function at 0x1800e7310
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x1800e733e
xor al, al
jmp 0x1800e737c
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x1800e734f
xor al, al
jmp 0x1800e737c
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x1800e7376
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x1800e7376
mov al, 1
jmp 0x1800e737c
xor al, al
jmp 0x1800e737c
add rsp, 0x50
pop rbx
ret
Function at 0x1800e7430
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x1800e7450
lea rbx, [rax + rcx - 0x10000]
mov qword [rsp + 0x60], rsi
cmp rbx, rdx
jae 0x1800e751f
mov esi, 0x80010000
nop word [rax + rax]
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x1800e7487
mov rbx, rsi
jmp 0x1800e7516
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
lea r8d, [rax + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800e751f
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x1800e74fe
cmp rcx, 0x10000
jb 0x1800e74fe
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1800e7521
add rbx, 0x10000
jmp 0x1800e7516
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx eax, bx
test rax, rax
je 0x1800e7516
lea rbx, [rbx + rax - 0x10000]
cmp rbx, rdi
jb 0x1800e7470
xor eax, eax
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1800e7540
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
lea rbx, [rdx - 0x10000]
mov rdi, rcx
movzx eax, bx
test rax, rax
je 0x1800e755f
sub rbx, rax
cmp rbx, rcx
jbe 0x1800e761d
nop dword [rax + rax]
lea rax, [rbx - 0x50000000]
cmp rax, 0x30000000
ja 0x1800e7589
mov ebx, 0x4fff0000
jmp 0x1800e7614
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
lea r8d, [rax + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800e761d
cmp dword [rsp + 0x40], 0x10000
jne 0x1800e75fd
cmp qword [rsp + 0x38], 0x10000
jb 0x1800e75fd
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1800e761f
sub rbx, 0x10000
jmp 0x1800e7614
mov rbx, qword [rsp + 0x28]
add rbx, 0xffffffffffff0000
movzx eax, bx
test rax, rax
je 0x1800e7614
sub rbx, rax
cmp rbx, rdi
ja 0x1800e7570
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1800e7630
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
cmp rcx, 0x7ff80000
jbe 0x1800e764f
lea rsi, [rcx - 0x7ff80000]
jmp 0x1800e7654
mov esi, 0x10000
mov qword [rsp + 0x38], rdi
cmp rcx, 0xffffffff80000000
jae 0x1800e766b
lea rdi, [rcx + 0x7ff80000]
jmp 0x1800e7672
mov rdi, 0xfffffffffff80000
mov rdx, qword [0x18017a658]
mov rax, qword [0x18017a650]
mov qword [rsp + 0x30], rbp
test rdx, rdx
jne 0x1800e7699
test rax, rax
je 0x1800e76b0
mov rdx, rax
mov qword [0x18017a658], rax
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x1800e76b0
cmp rcx, rsi
jb 0x1800e76b0
cmp rcx, rdi
jbe 0x1800e77e8
mov rdx, rax
mov qword [0x18017a658], rax
test rax, rax
je 0x1800e76ec
nop
test rdx, rdx
je 0x1800e76dc
mov rax, qword [rdx + 0x10]
test rax, rax
je 0x1800e76dc
cmp rax, rsi
jb 0x1800e76dc
cmp rax, rdi
jbe 0x1800e77e8
mov rdx, qword [rdx + 8]
mov qword [0x18017a658], rdx
test rdx, rdx
jne 0x1800e76c0
movzx eax, bx
sub rbx, rax
cmp rbx, 0x40000000
jbe 0x1800e7729
lea rcx, [rbx - 0x40000000]
mov rdx, rbx
call fcn.1800e7430
mov rdx, rax
test rax, rax
jne 0x1800e7790
lea rdx, [rbx - 0x40000000]
mov rcx, rsi
call fcn.1800e7540
mov rdx, rax
test rax, rax
jne 0x1800e7790
movabs rax, 0xffffffff40000000
cmp rbx, rax
jae 0x1800e7766
lea rdx, [rbx + 0x40000000]
mov rcx, rbx
call fcn.1800e7540
mov rdx, rax
test rax, rax
jne 0x1800e7790
lea rcx, [rbx + 0x40000000]
mov rdx, rdi
call fcn.1800e7430
mov rdx, rax
test rax, rax
jne 0x1800e7790
mov rdx, rbx
mov rcx, rsi
call fcn.1800e7540
mov rdx, rax
test rax, rax
jne 0x1800e7790
mov rdx, rdi
mov rcx, rbx
call fcn.1800e7430
mov rdx, rax
test rax, rax
je 0x1800e7814
mov dword [rdx], 0x52727464
xor r8d, r8d
mov qword [0x18017a658], rdx
mov qword [rdx + 0x10], r8
mov rax, qword [0x18017a650]
lea rcx, [rdx + 0xffa8]
mov qword [rdx + 8], rax
mov qword [0x18017a650], rdx
lea rax, [rdx + 0xff60]
mov r9d, 0x2a7
nop word [rax + rax]
mov qword [rcx], r8
mov r8, rax
sub rcx, 0x60
sub rax, 0x60
sub r9, 1
jne 0x1800e77d0
mov qword [rdx + 0x10], r8
mov rbx, qword [rdx + 0x10]
cmp rbx, rsi
jb 0x1800e7814
cmp rbx, rdi
ja 0x1800e7814
mov rcx, qword [rbx + 0x48]
mov qword [rdx + 0x10], rcx
mov edx, 0xcc
mov rcx, rbx
lea r8d, [rdx - 0x6c]
call sub.MSVCR90.dll_memset
mov rax, rbx
jmp 0x1800e7816
xor eax, eax
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret