joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002cbc2
Capabilities:
Query environment variable

Disassembly:
push rbp
sub rsp, 0x300
lea rbp, [rsp + 0x20]
mov qword [rsp], rax
mov rax, 0x2fc
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x18002cbda
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0xb8], rbx
mov qword [rbp + 0x2f0], rcx
mov qword [rbp + 0x2f8], rdx
mov qword [rbp + 0x300], r8
mov qword [rbp + 0x308], r9
mov rax, qword [0x1800f4ae8]
xor rax, rbp
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x300]
lea rdx, [rbp + 0xc8]
mov ecx, 0x104
mov rbx, qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rbp + 0xa8], ecx
mov rcx, rax
mov eax, dword [rbp + 0xa8]
mov r8d, eax
call rbx
mov dword [rbp + 0x80], eax
lea rax, [rbp + 8]
mov edx, 0
mov ecx, reloc.WS2_32.dll_WSASetLastError
mov qword [rbp + 0xb0], rcx
mov rcx, rax
mov rax, qword [rbp + 0xb0]
mov r8, rax
call fcn.180062370
mov qword [rbp + 0xa0], rax
mov dword [rbp + 8], reloc.WS2_32.dll_WSASetLastError
mov dword [rbp + 0xc], 0x40
mov rax, qword [rbp + 0x2f8]
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0xc8]
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x38], 0
lea rax, [rbp + 8]
mov rdx, qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rcx, rax
call rdx
mov dword [rbp + 0x84], eax
mov eax, dword [rbp + 0x84]
test eax, eax
je 0x18002cd63
mov rax, qword [rbp + 0x70]
mov rdx, qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rcx, rax
call rdx
mov dword [rbp + 0x88], eax
mov rax, qword [rbp + 0x308]
mov edx, dword [rbp + 0x88]
mov dword [rax], edx
mov rax, qword [rbp + 0x70]
mov rdx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rax
call rdx
mov dword [rbp + 0x90], eax
mov eax, 0
mov dword [rbp + 0x94], eax
lea rax, reloc.WS2_32.dll_bind
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x2d8]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0x94]
mov rbx, qword [rbp + 0xb8]
lea rsp, [rbp + 0x2e0]
pop rbp
ret
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x8c], eax
mov eax, dword [rbp + 0x8c]
mov dword [rbp + 0x98], eax
lea rax, reloc.WS2_32.dll_bind
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x2d8]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0x98]
mov rbx, qword [rbp + 0xb8]
lea rsp, [rbp + 0x2e0]
pop rbp
ret
Function at 0x18002cbeb
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
sub rsp, 0x300
lea rbp, [rsp + 0x20]
mov qword [rsp], rax
mov rax, 0x2fc
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x18002cbda
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0xb8], rbx
mov qword [rbp + 0x2f0], rcx
mov qword [rbp + 0x2f8], rdx
mov qword [rbp + 0x300], r8
mov qword [rbp + 0x308], r9
mov rax, qword [0x1800f4ae8]
xor rax, rbp
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x300]
lea rdx, [rbp + 0xc8]
mov ecx, 0x104
mov rbx, qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rbp + 0xa8], ecx
mov rcx, rax
mov eax, dword [rbp + 0xa8]
mov r8d, eax
call rbx
mov dword [rbp + 0x80], eax
lea rax, [rbp + 8]
mov edx, 0
mov ecx, reloc.WS2_32.dll_WSASetLastError
mov qword [rbp + 0xb0], rcx
mov rcx, rax
mov rax, qword [rbp + 0xb0]
mov r8, rax
call fcn.180062370
mov qword [rbp + 0xa0], rax
mov dword [rbp + 8], reloc.WS2_32.dll_WSASetLastError
mov dword [rbp + 0xc], 0x40
mov rax, qword [rbp + 0x2f8]
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0xc8]
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x38], 0
lea rax, [rbp + 8]
mov rdx, qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rcx, rax
call rdx
mov dword [rbp + 0x84], eax
mov eax, dword [rbp + 0x84]
test eax, eax
je 0x18002cd63
mov rax, qword [rbp + 0x70]
mov rdx, qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rcx, rax
call rdx
mov dword [rbp + 0x88], eax
mov rax, qword [rbp + 0x308]
mov edx, dword [rbp + 0x88]
mov dword [rax], edx
mov rax, qword [rbp + 0x70]
mov rdx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rax
call rdx
mov dword [rbp + 0x90], eax
mov eax, 0
mov dword [rbp + 0x94], eax
lea rax, reloc.WS2_32.dll_bind
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x2d8]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0x94]
mov rbx, qword [rbp + 0xb8]
lea rsp, [rbp + 0x2e0]
pop rbp
ret
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x8c], eax
mov eax, dword [rbp + 0x8c]
mov dword [rbp + 0x98], eax
lea rax, reloc.WS2_32.dll_bind
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x2d8]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0x98]
mov rbx, qword [rbp + 0xb8]
lea rsp, [rbp + 0x2e0]
pop rbp
ret
Function at 0x18002f83d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
sub rsp, 0x460
lea rbp, [rsp + 0x20]
mov qword [rsp], rax
mov rax, 0x45c
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x18002f82c
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x450], rcx
mov qword [rbp + 0x458], rdx
mov rax, qword [0x1800f4ae8]
xor rax, rbp
mov qword [rbp + 0x438], rax
mov byte [rbp], 1
lea rax, [rbp + 0x38]
lea rdx, [0x1800f46e0]
mov ecx, 0x3f4
mov qword [rbp + 0x20], rcx
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rax
call fcn.180064f00
mov qword [rbp + 0x10], rax
mov eax, dword [rbp + 0x58]
cmp eax, 1
jne 0x18002f961
mov dword [rbp + 4], 0
mov eax, dword [rbp + 4]
cmp eax, 0x3d0
jae 0x18002f961
mov eax, dword [rbp + 4]
test al, 1
je 0x18002f8e8
lea rax, [rbp + 0x5c]
mov edx, dword [rbp + 4]
movsxd rdx, edx
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
not eax
lea rdx, [rbp + 0x5c]
mov ecx, dword [rbp + 4]
movsxd rcx, ecx
add rdx, rcx
mov byte [rdx], al
jmp 0x18002f91a
lea rax, [rbp + 0x5c]
mov edx, dword [rbp + 4]
movsxd rdx, edx
add rax, rdx
movzx eax, byte [rax]
mov edx, 1
mov ecx, eax
call fcn.1800116a7
mov byte [rbp + 1], al
lea rax, [rbp + 0x5c]
mov edx, dword [rbp + 4]
movsxd rdx, edx
add rax, rdx
movzx edx, byte [rbp + 1]
mov byte [rax], dl
lea rax, [rbp + 0x5c]
mov edx, dword [rbp + 4]
movsxd rdx, edx
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
mov edx, 0xc53fc79
mov ecx, dword [rbp + 4]
imul ecx, ecx, 8
sar edx, cl
and edx, 0xff
xor eax, edx
lea rdx, [rbp + 0x5c]
mov ecx, dword [rbp + 4]
movsxd rcx, ecx
add rdx, rcx
mov byte [rdx], al
mov eax, 1
add eax, dword [rbp + 4]
mov dword [rbp + 4], eax
jmp 0x18002f8ad
mov rax, qword [rbp + 0x458]
lea rdx, [rbp + 0x5c]
mov ecx, 0x3d0
mov qword [rbp + 0x28], rcx
mov rcx, rax
mov rax, qword [rbp + 0x28]
mov r8, rax
call fcn.180064f00
mov qword [rbp + 0x18], rax
mov eax, 0
mov dword [rbp + 8], eax
lea rax, reloc.WS2_32.dll_accept
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x438]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 8]
lea rsp, [rbp + 0x440]
pop rbp
ret
Function at 0x18002fe6e
Capabilities:
Set registry value

Disassembly:
push rbp
sub rsp, 0x4b0
lea rbp, [rsp + 0x30]
mov qword [rsp], rax
mov rax, 0x4ac
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x18002fe86
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x490], rcx
mov qword [rbp + 0x498], rdx
mov rax, qword [0x1800f4ae8]
xor rax, rbp
mov qword [rbp + 0x478], rax
mov byte [rbp + 0x18], 0
mov byte [rbp + 0x19], 0
mov dword [rbp + 0x1c], 0xffffffff
mov byte [rbp + 0x18], 1
mov rax, 0xffffffff80000002
lea rdx, [0x180102960]
mov ecx, 0
mov ebx, 0x102
lea rsi, [rbp + 8]
mov qword [rsp + 0x20], rsi
mov rsi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x40], ecx
mov rcx, rax
mov eax, dword [rbp + 0x40]
mov r8d, eax
mov r9d, ebx
call rsi
mov dword [rbp + 0x20], eax
mov byte [rbp + 0x19], 1
mov eax, dword [rbp + 0x20]
mov dword [rbp + 0x24], eax
movzx eax, byte [rbp + 0x19]
test eax, eax
jne 0x18002ff41
lea rax, [0x1801029a0]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x24]
test eax, eax
jne 0x180030064
lea rax, [rbp + 0x70]
mov rdx, qword [rbp + 0x498]
mov ecx, 0x3d0
mov qword [rbp + 0x48], rcx
mov rcx, rax
mov rax, qword [rbp + 0x48]
mov r8, rax
call fcn.180064f00
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x28], 0
mov eax, dword [rbp + 0x28]
cmp rax, 0x3d0
jae 0x18002ffb3
lea rax, [rbp + 0x70]
mov edx, dword [rbp + 0x28]
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
xor eax, 0x79
not eax
lea rdx, [rbp + 0x70]
mov ecx, dword [rbp + 0x28]
add rdx, rcx
mov byte [rdx], al
mov eax, 1
add eax, dword [rbp + 0x28]
mov dword [rbp + 0x28], eax
jmp 0x18002ff7a
movzx eax, byte [rbp + 0x18]
test eax, eax
jne 0x18002ffca
lea rax, [0x1801029a4]
mov rcx, rax
call fcn.180064a90
mov rax, qword [rbp + 8]
lea rdx, [0x1801029a9]
mov ecx, 0
mov ebx, 3
lea rsi, [rbp + 0x70]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 0x3d0
mov rsi, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x50], ecx
mov rcx, rax
mov eax, dword [rbp + 0x50]
mov r8d, eax
mov r9d, ebx
call rsi
mov dword [rbp + 0x2c], eax
mov byte [rbp + 0x19], 1
mov eax, dword [rbp + 0x2c]
mov dword [rbp + 0x24], eax
movzx eax, byte [rbp + 0x19]
test eax, eax
jne 0x18003002c
lea rax, [0x1801029a0]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x24]
test eax, eax
jne 0x18003003a
mov dword [rbp + 0x1c], 0
movzx eax, byte [rbp + 0x18]
test eax, eax
jne 0x180030051
lea rax, [0x1801029a4]
mov rcx, rax
call fcn.180064a90
mov rax, qword [rbp + 8]
mov rdx, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rax
call rdx
mov dword [rbp + 0x30], eax
mov eax, dword [rbp + 0x1c]
mov dword [rbp + 0x34], eax
lea rax, reloc.WS2_32.dll_bind
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x478]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0x34]
mov rbx, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x60]
lea rsp, [rbp + 0x480]
pop rbp
ret
Function at 0x18002fe97
Capabilities:
Encrypt data using rc4 prga
Set registry value

Disassembly:
push rbp
sub rsp, 0x4b0
lea rbp, [rsp + 0x30]
mov qword [rsp], rax
mov rax, 0x4ac
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x18002fe86
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x490], rcx
mov qword [rbp + 0x498], rdx
mov rax, qword [0x1800f4ae8]
xor rax, rbp
mov qword [rbp + 0x478], rax
mov byte [rbp + 0x18], 0
mov byte [rbp + 0x19], 0
mov dword [rbp + 0x1c], 0xffffffff
mov byte [rbp + 0x18], 1
mov rax, 0xffffffff80000002
lea rdx, [0x180102960]
mov ecx, 0
mov ebx, 0x102
lea rsi, [rbp + 8]
mov qword [rsp + 0x20], rsi
mov rsi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x40], ecx
mov rcx, rax
mov eax, dword [rbp + 0x40]
mov r8d, eax
mov r9d, ebx
call rsi
mov dword [rbp + 0x20], eax
mov byte [rbp + 0x19], 1
mov eax, dword [rbp + 0x20]
mov dword [rbp + 0x24], eax
movzx eax, byte [rbp + 0x19]
test eax, eax
jne 0x18002ff41
lea rax, [0x1801029a0]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x24]
test eax, eax
jne 0x180030064
lea rax, [rbp + 0x70]
mov rdx, qword [rbp + 0x498]
mov ecx, 0x3d0
mov qword [rbp + 0x48], rcx
mov rcx, rax
mov rax, qword [rbp + 0x48]
mov r8, rax
call fcn.180064f00
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x28], 0
mov eax, dword [rbp + 0x28]
cmp rax, 0x3d0
jae 0x18002ffb3
lea rax, [rbp + 0x70]
mov edx, dword [rbp + 0x28]
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
xor eax, 0x79
not eax
lea rdx, [rbp + 0x70]
mov ecx, dword [rbp + 0x28]
add rdx, rcx
mov byte [rdx], al
mov eax, 1
add eax, dword [rbp + 0x28]
mov dword [rbp + 0x28], eax
jmp 0x18002ff7a
movzx eax, byte [rbp + 0x18]
test eax, eax
jne 0x18002ffca
lea rax, [0x1801029a4]
mov rcx, rax
call fcn.180064a90
mov rax, qword [rbp + 8]
lea rdx, [0x1801029a9]
mov ecx, 0
mov ebx, 3
lea rsi, [rbp + 0x70]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 0x3d0
mov rsi, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x50], ecx
mov rcx, rax
mov eax, dword [rbp + 0x50]
mov r8d, eax
mov r9d, ebx
call rsi
mov dword [rbp + 0x2c], eax
mov byte [rbp + 0x19], 1
mov eax, dword [rbp + 0x2c]
mov dword [rbp + 0x24], eax
movzx eax, byte [rbp + 0x19]
test eax, eax
jne 0x18003002c
lea rax, [0x1801029a0]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x24]
test eax, eax
jne 0x18003003a
mov dword [rbp + 0x1c], 0
movzx eax, byte [rbp + 0x18]
test eax, eax
jne 0x180030051
lea rax, [0x1801029a4]
mov rcx, rax
call fcn.180064a90
mov rax, qword [rbp + 8]
mov rdx, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rax
call rdx
mov dword [rbp + 0x30], eax
mov eax, dword [rbp + 0x1c]
mov dword [rbp + 0x34], eax
lea rax, reloc.WS2_32.dll_bind
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x478]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0x34]
mov rbx, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x60]
lea rsp, [rbp + 0x480]
pop rbp
ret
Function at 0x180030650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x20]
mov qword [rsp], rax
mov rax, 0x4c
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x180030665
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov dword [rbp + 0x50], r8d
mov dword [rbp + 0x58], r9d
mov rax, qword [rbp + 0x40]
lea rdx, [0x180101c60]
mov qword [rax], rdx
mov rax, qword [rbp + 0x40]
mov qword [rax + 0x10], 0
mov rax, qword [rbp + 0x40]
mov qword [rax + 8], 0
mov eax, 1
add eax, dword [rbp + 0x50]
movsxd rax, eax
mov rcx, rax
call fcn.180062320
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
test rax, rax
je 0x18003079a
mov rax, qword [rbp + 0x10]
mov edx, 0
mov ecx, 1
add ecx, dword [rbp + 0x50]
movsxd rcx, ecx
mov qword [rbp + 0x20], rcx
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rax
call fcn.180062370
mov qword [rbp + 0x18], rax
mov dword [rbp], 0
mov eax, dword [rbp]
mov edx, dword [rbp + 0x50]
movsxd rdx, edx
cmp rax, rdx
jae 0x180030764
mov eax, dword [rbp]
add rax, qword [rbp + 0x48]
movzx eax, byte [rax]
movzx eax, al
mov edx, dword [rbp + 0x58]
mov ecx, dword [rbp]
and ecx, 3
imul ecx, ecx, 8
shr edx, cl
and edx, 0xff
xor eax, edx
mov edx, dword [rbp]
add rdx, qword [rbp + 0x10]
mov byte [rdx], al
mov eax, 1
add eax, dword [rbp]
mov dword [rbp], eax
jmp 0x18003071d
mov rax, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x10]
mov rcx, rax
call fcn.180005278
mov rax, qword [rbp + 0x10]
test rax, rax
jne 0x180030786
mov rax, qword [sym.imp.KERNEL32.dll_DebugBreak]
call rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call fcn.1800622b0
mov qword [rbp + 0x10], 0
mov rax, qword [rbp + 0x40]
lea rsp, [rbp + 0x30]
pop rbp
ret
Function at 0x18005bf64
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x20]
mov qword [rsp], rax
mov rax, 0x4c
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x18005bf79
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov dword [rbp + 0x50], r8d
mov dword [rbp + 0x58], r9d
mov rax, qword [rbp + 0x40]
lea rdx, [0x180101c60]
mov qword [rax], rdx
mov rax, qword [rbp + 0x40]
mov qword [rax + 0x10], 0
mov rax, qword [rbp + 0x40]
mov qword [rax + 8], 0
mov eax, 1
add eax, dword [rbp + 0x50]
movsxd rax, eax
imul rax, rax, 2
mov rcx, rax
call fcn.180062320
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
test rax, rax
je 0x18005c0ba
mov rax, qword [rbp + 0x10]
mov edx, 0
mov ecx, 1
add ecx, dword [rbp + 0x50]
movsxd rcx, ecx
imul rcx, rcx, 2
mov qword [rbp + 0x20], rcx
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rax
call fcn.180062370
mov qword [rbp + 0x18], rax
mov dword [rbp], 0
mov eax, dword [rbp]
mov edx, dword [rbp + 0x50]
movsxd rdx, edx
imul rdx, rdx, 2
cmp rax, rdx
jae 0x18005c084
mov eax, dword [rbp]
add rax, qword [rbp + 0x48]
movzx eax, byte [rax]
movzx eax, al
mov edx, dword [rbp + 0x58]
mov ecx, dword [rbp]
and ecx, 3
imul ecx, ecx, 8
shr edx, cl
and edx, 0xff
xor eax, edx
mov edx, dword [rbp]
add rdx, qword [rbp + 0x10]
mov byte [rdx], al
mov eax, 1
add eax, dword [rbp]
mov dword [rbp], eax
jmp 0x18005c039
mov rax, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x10]
mov rcx, rax
call fcn.1800055b0
mov rax, qword [rbp + 0x10]
test rax, rax
jne 0x18005c0a6
mov rax, qword [sym.imp.KERNEL32.dll_DebugBreak]
call rax
mov rax, qword [rbp + 0x10]
mov rcx, rax
call fcn.1800622b0
mov qword [rbp + 0x10], 0
mov rax, qword [rbp + 0x40]
lea rsp, [rbp + 0x30]
pop rbp
ret
Function at 0x18005fc46
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x30]
mov qword [rsp], rax
mov rax, 0x7c
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x18005fc5e
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
mov dword [rbp + 0x70], r8d
mov rax, qword [rbp + 0x60]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x18005fcb6
mov eax, 0xffffffff
mov rbx, qword [rbp + 0x38]
mov rsi, qword [rbp + 0x40]
lea rsp, [rbp + 0x50]
pop rbp
ret
mov rax, qword [rbp + 0x60]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov edx, 1
movsxd rdx, edx
imul rdx, rdx, 8
add rdx, qword [rax]
mov rax, qword [rdx]
mov rdx, qword [rbp + 8]
mov rcx, rdx
call rax
mov rax, qword [rbp + 0x68]
test rax, rax
je 0x18005fd2e
mov rax, qword [rbp + 0x60]
mov rax, qword [rax + 0x28]
mov rdx, qword [rbp + 0x68]
mov ecx, dword [rbp + 0x70]
mov ebx, 0x3000
mov dword [rsp + 0x20], 0x40
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x28], rcx
mov rcx, rax
mov rax, qword [rbp + 0x28]
mov r8, rax
mov r9d, ebx
call rsi
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x10]
mov qword [rax + 0x10], rdx
jmp 0x18005fdad
mov qword [rbp + 0x18], 0x1000
movabs rax, 0x800000000
mov rdx, qword [rbp + 0x18]
cmp rax, rdx
ja 0x18005fd5a
jmp 0x18005fdad
mov eax, 0x1000
add rax, qword [rbp + 0x18]
mov qword [rbp + 0x18], rax
jmp 0x18005fd36
mov rax, qword [rbp + 0x60]
mov rax, qword [rax + 0x28]
mov rdx, qword [rbp + 0x18]
mov ecx, dword [rbp + 0x70]
mov ebx, 0x3000
mov dword [rsp + 0x20], 0x40
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x30], rcx
mov rcx, rax
mov rax, qword [rbp + 0x30]
mov r8, rax
mov r9d, ebx
call rsi
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x20]
mov qword [rax + 0x10], rdx
mov rax, qword [rbp + 0x60]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x18005fd4b
mov rax, qword [rbp + 0x60]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x18005fdd0
mov rax, qword [rbp + 0x60]
mov dword [rax + 8], 1
mov eax, dword [rbp + 0x70]
mov rdx, qword [rbp + 0x60]
mov qword [rdx + 0x20], rax
mov rax, qword [rbp + 0x60]
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x18005fde6
mov dword [rbp], 0xffffffff
jmp 0x18005fded
mov dword [rbp], 0
mov eax, dword [rbp]
mov rbx, qword [rbp + 0x38]
mov rsi, qword [rbp + 0x40]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x180007290
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x1806ee188]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x20
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1801fe2b0
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x1806ee188]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x20
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x180007420
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x18000743c
cmp rcx, r8
jl 0x18000742f
mov qword [rdx + 0x80], rcx
test dword [0x1806e5a38], 1
je 0x18000746b
cmp byte [rsp + 0xd0], 0
je 0x18000746b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x180006f90
mov rsp, r8
jmp rax