joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001da98
Capabilities:
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xe8
mov rax, qword [0x18002c008]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov r12, qword [rbp + 0x6f]
mov ebx, edx
mov r13, qword [rbp + 0x7f]
and ebx, 8
mov r15d, r9d
shl ebx, 0x15
mov r14, r8
lea r9, [rsp + 0x48]
mov esi, edx
xor r8d, r8d
lea rdx, [rsp + 0x38]
or ebx, 0x120089
call qword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U]
nop dword [rax + rax]
xor ecx, ecx
test al, al
je 0x18001dbe5
mov rdi, qword [rsp + 0x40]
cmp word [rsp + 0x48], cx
je 0x18001db1e
movups xmm0, xmmword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
movdqu xmmword [rsp + 0x38], xmm0
jmp 0x18001db26
mov rax, rcx
mov qword [rsp + 0x58], rcx
mov qword [rbp - 0x61], rax
lea r9, [rbp - 0x79]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 0x4000
xorps xmm0, xmm0
mov qword [rbp - 0x59], rax
lea r8, [rbp - 0x69]
mov dword [rbp - 0x69], 0x30
mov edx, ebx
mov dword [rbp - 0x51], 0x40
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 7
movdqu xmmword [rbp - 0x49], xmm0
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
lea rcx, [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test ebx, ebx
js 0x18001dbe5
mov rcx, qword [rsp + 0x30]
lea r8, [rbp - 0x39]
mov r9d, 0x28
mov dword [rsp + 0x20], 4
lea rdx, [rbp - 0x79]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
test eax, eax
jns 0x18001dc08
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor al, al
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.18000d460
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, dword [rbp - 0x19]
mov r9d, r15d
mov r8, r14
mov dword [r13], eax
mov edx, esi
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntdll.dll_NtQuerySecurityObject]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test ebx, ebx
setns al
jmp 0x18001dbe7
Function at 0x18001dc50
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x18002c008]
xor rax, rsp
mov qword [rsp + 0x68], rax
and qword [rsp + 0x30], 0
xor r9d, r9d
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
mov dword [rsp + 0x28], 0x2200080
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18001dcae
xor al, al
jmp 0x18001dd32
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
and dword [rsp + 0x50], 0
lea r8, [rsp + 0x48]
and dword [rsp + 0x4c], 0
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
mov r9d, 0xc
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 0x10
mov edx, 0x2d1400
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov byte [rdi], 0
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x48], 0x37
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
nop dword [rax + rax]
test eax, eax
je 0x18001dd21
cmp dword [rsp + 0x40], 0x10
jne 0x18001dd21
test byte [rsp + 0x60], 1
je 0x18001dd21
mov byte [rdi], 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18000d460
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x18001ddf0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x4b0
mov rax, qword [0x18002c008]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov rbx, rcx
mov rsi, rdx
lea rcx, [rsp + 0x30]
xor edi, edi
call sym.ulib.dll_public:_void___cdecl_PATH::constructor_void____ptr64
mov rbp, qword [rbx + 0x10]
test rbp, rbp
je 0x18001df56
test rsi, rsi
jne 0x18001dea9
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_file_l1_2_4.dll_GetTempPath2W]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
xor edx, edx
mov esi, eax
lea r8d, [rax + rax]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x18001df56
mov rdx, rax
mov ecx, esi
call qword [sym.imp.api_ms_win_core_file_l1_2_4.dll_GetTempPath2W]
nop dword [rax + rax]
test eax, eax
jne 0x18001ded3
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ebx, edi
jmp 0x18001deca
lea rcx, [rsi + 0x218]
mov byte [rsp + 0x28], 1
xor r9d, r9d
mov dword [rsp + 0x20], edi
or r8d, 0xffffffff
xor edx, edx
call sym.ulib.dll_public:_unsigned_short_int____ptr64___cdecl_WSTRING::QueryWSTR_unsigned_long_int__unsigned_long_int__unsigned_short_int____ptr64__unsigned_long_int__unsigned_char_const___ptr64
mov rbx, rax
test rbx, rbx
je 0x18001df56
lea r9, [rsp + 0x290]
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetTempFileNameW]
nop dword [rax + rax]
test eax, eax
jne 0x18001df16
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor eax, eax
jmp 0x18001df59
xor r8d, r8d
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x30]
call sym.ulib.dll_public:_unsigned_char___cdecl_PATH::Initialize_unsigned_short_int_const____ptr64__unsigned_char____ptr64
lea rcx, [rsp + 0x30]
call sym.ulib.dll_public:_static_class_FSN_FILE____ptr64___cdecl_SYSTEM::MakeFile_class_PATH_const____ptr64_
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rdi, rax
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rax, rdi
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.18000d460
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4b0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001df90
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x230
mov rax, qword [0x18002c008]
xor rax, rsp
mov qword [rsp + 0x220], rax
test rcx, rcx
je 0x18001e05d
mov rcx, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
mov r8d, 0x100
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
test eax, eax
je 0x18001e05d
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
lea r8d, [rdx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x18001e05d
mov rcx, qword [0x18002c868]
lea rdx, [rsp + 0x20]
and qword [rax + 0x10], 0
or r8d, 0xffffffff
and dword [rax + 0x18], 0
lea rax, sym.ulib.dll_const_DSTRING::vftable
and qword [rbx + 0x20], 0
and dword [rbx + 0x28], 0
mov qword [rbx + 8], rcx
mov rcx, rbx
mov qword [rbx], rax
call sym.ulib.dll_public:_unsigned_char___cdecl_WSTRING::Initialize_unsigned_short_int_const____ptr64__unsigned_long_int____ptr64
test al, al
je 0x18001e03f
mov rax, rbx
jmp 0x18001e05f
mov rax, qword [rbx]
movabs r10, 0xfd980fd51c5c1870
mov rax, qword [rax]
mov edx, 1
mov rcx, rbx
call qword [0x1800214b0]
xor eax, eax
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.18000d460
add rsp, 0x230
pop rbx
ret

Function at 0x18001e240
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x18002c008]
xor rax, rsp
mov qword [rsp + 0x270], rax
and qword [rsp + 0x30], 0
lea rax, sym.ulib.dll_const_DSTRING::vftable
and dword [rsp + 0x38], 0
lea rcx, [rsp + 0x60]
and qword [rsp + 0x40], 0
mov edx, 0x104
and dword [rsp + 0x48], 0
mov qword [rsp + 0x20], rax
mov rax, qword [0x18002c868]
mov qword [rsp + 0x28], rax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
or r8d, 0xffffffff
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call sym.ulib.dll_public:_unsigned_char___cdecl_WSTRING::Initialize_unsigned_short_int_const____ptr64__unsigned_long_int____ptr64
test al, al
je 0x18001e323
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, 0x260
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
test rax, rax
je 0x18001e323
mov rcx, rax
call sym.ulib.dll_public:_void___cdecl_PATH::constructor_void____ptr64
mov rbx, rax
test rax, rax
je 0x18001e300
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call sym.ulib.dll_public:_unsigned_char___cdecl_PATH::Initialize_class_WSTRING_const____ptr64__unsigned_char____ptr64
test al, al
jne 0x18001e325
test rbx, rbx
je 0x18001e323
mov rax, qword [rbx]
movabs r10, 0xfd980fd51c5c1870
mov rax, qword [rax]
mov edx, 1
mov rcx, rbx
call qword [0x1800214b0]
xor ebx, ebx
lea rcx, [rsp + 0x20]
call sym.ulib.dll_public_virtual:_void___cdecl_DSTRING::destructor_void____ptr64
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18000d460
add rsp, 0x280
pop rbx
ret
Function at 0x18001e360
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x18002c008]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rdx
call sym.ulib.dll_public:_class_WSTRING____ptr64___cdecl_PATH::QueryRoot_void____ptr64
mov rdi, rax
test rax, rax
je 0x18001e4c7
and dword [rsp + 0x38], 0
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x50]
and qword [rsp + 0x28], 0
mov r8d, 0x104
mov rcx, qword [rax + 0x10]
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
nop dword [rax + rax]
test eax, eax
jne 0x18001e3f1
mov rax, qword [rdi]
movabs r10, 0xfd980fd51c5c1870
mov rax, qword [rax]
mov edx, 1
mov rcx, rdi
call qword [0x1800214b0]
jmp 0x18001e4c7
mov eax, dword [rsp + 0x40]
xor edx, edx
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x44]
mov dword [rbx], eax
mov rcx, qword gs:[0x60]
lea r8d, [rdx + 0x30]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x18001e484
and qword [rax + 0x10], 0
lea rdx, [rsp + 0x50]
and dword [rax + 0x18], 0
or r8d, 0xffffffff
and qword [rbx + 0x20], 0
lea rax, sym.ulib.dll_const_DSTRING::vftable
and dword [rbx + 0x28], 0
mov rcx, rbx
mov qword [rbx], rax
mov rax, qword [0x18002c868]
mov qword [rbx + 8], rax
call sym.ulib.dll_public:_unsigned_char___cdecl_WSTRING::Initialize_unsigned_short_int_const____ptr64__unsigned_long_int____ptr64
test al, al
je 0x18001e486
mov rax, qword [rdi]
movabs r10, 0xfd980fd51c5c1870
mov rax, qword [rax]
mov edx, 1
mov rcx, rdi
call qword [0x1800214b0]
mov rax, rbx
jmp 0x18001e4c9
xor ebx, ebx
mov rax, qword [rdi]
movabs r10, 0xfd980fd51c5c1870
mov rax, qword [rax]
mov edx, 1
mov rcx, rdi
call qword [0x1800214b0]
test rbx, rbx
je 0x18001e4c7
mov rax, qword [rbx]
movabs r10, 0xfd980fd51c5c1870
mov rax, qword [rax]
mov edx, 1
mov rcx, rbx
call qword [0x1800214b0]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18000d460
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x18001e590
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx]
xor edi, edi
mov r10b, dl
mov rsi, rcx
test rbx, rbx
je 0x18001e6b3
mov rax, qword [0x18002c728]
mov r9, qword [rbx + 8]
mov r8, qword [rax]
cmp qword [r9], r8
jne 0x18001e635
lea rax, [rbx + 0x270]
test dl, dl
jne 0x18001e5da
test byte [rax], 1
jne 0x18001e6b3
mov edx, dword [rax]
test dl, 1
je 0x18001e5ef
and edx, 0xfffffffe
xor r8d, r8d
mov rcx, rbx
call sym.ulib.dll_public:_unsigned_char___cdecl_FSNODE::SetAttributes_unsigned_long_int__unsigned_long_int____ptr64____ptr64
mov rcx, qword [rbx + 0x238]
test rcx, rcx
je 0x18001e6b3
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x18001e6b3
mov r8, qword [rbx]
movabs r10, 0xfd980fd51c5c1870
mov rax, qword [r8]
mov edx, 1
mov rcx, rbx
call qword [0x1800214b0]
jmp 0x18001e6af
test rbx, rbx
je 0x18001e6b3
mov rax, qword [0x18002c720]
mov rdx, qword [rbx + 8]
mov rcx, qword [rax]
cmp qword [rdx], rcx
jne 0x18001e6b3
lea rax, [rbx + 0x270]
test r10b, r10b
jne 0x18001e65e
test byte [rax], 1
jne 0x18001e6b3
mov edx, dword [rax]
test dl, 1
je 0x18001e673
and edx, 0xfffffffe
xor r8d, r8d
mov rcx, rbx
call sym.ulib.dll_public:_unsigned_char___cdecl_FSNODE::SetAttributes_unsigned_long_int__unsigned_long_int____ptr64____ptr64
mov rcx, qword [rbx + 0x238]
test rcx, rcx
je 0x18001e6b3
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_RemoveDirectoryW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x18001e6b3
mov rax, qword [rbx]
movabs r10, 0xfd980fd51c5c1870
mov rax, qword [rax]
mov edx, 1
mov rcx, rbx
call qword [0x1800214b0]
and qword [rsi], 0
mov rbx, qword [rsp + 0x30]
test edi, edi
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret

Function at 0x18001eed0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x248
mov rax, qword [0x18002c008]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rax, [r11 + 0x10]
mov r9, rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.18001ee5c
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18000d460
add rsp, 0x248
ret
Function at 0x14184a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14184a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14184a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14184a06f
add dl, dl
jne 0x14184a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14184a0f6
xor eax, eax
add dl, dl
jne 0x14184a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14184a1ad
add dl, dl
jne 0x14184a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14184a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14184a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14184a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14184a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14184a07e
mov eax, 1
add dl, dl
jne 0x14184a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14184a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14184a0fb
sub eax, ebx
mov ebx, 1
jne 0x14184a14c
mov ecx, 1
add dl, dl
jne 0x14184a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14184a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14184a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14184a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14184a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14184a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14184a15d
cmp eax, 0x7d00
jae 0x14184a19b
cmp eax, 0x500
jb 0x14184a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14184a07e
cmp eax, 0x7f
ja 0x14184a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14184a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14184a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14184a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001690
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x1400016f4
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x1400016e2
mov r8, qword [rbx]
xor edx, edx
mov r8d, dword [r8 + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1400016db
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x1400016af
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x140040f30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140001704
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, ecx
imul rdi, rax, 0x38
add rdi, qword [0x140040f60]
mov rdx, qword [rdi]
mov cl, byte [rdi + 0x20]
mov rsi, rdx
lea rbx, [rdx - 5]
and cl, 1
je 0x14000173d
mov rsi, rbx
movzx eax, cl
lea r9, [rsp + 0x38]
test cl, cl
mov r8d, 0x40
cmove rbx, rdx
lea rbp, [rax*2 + 5]
mov rcx, rbx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001770
mov eax, 0xa
jmp 0x1400017bd
mov byte [rbx], 0xe9
mov eax, dword [rdi + 8]
sub eax, esi
sub eax, 5
mov dword [rbx + 1], eax
test byte [rdi + 0x20], 1
je 0x14000178c
mov rax, qword [rdi]
mov word [rax], 0xf9eb
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [rdi + 0x20], 6
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140001bd8
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x140001bef
cmp r8b, 0x90
je 0x140001bef
cmp r8b, 0xcc
jne 0x140001c11
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x140001c0d
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x140001c11
add edx, r10d
cmp edx, r9d
jb 0x140001bfd
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x140001f78
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x140001fc2
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rbx, qword [0x140040f50]
lea r12, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r12
cmovbe r12, qword [rbp - 0x50]
sub r12, 0xfff
xor esi, esi
jmp 0x140001ffb
cmp rbx, r14
jb 0x140001ff8
cmp rbx, r12
jae 0x140001ff8
cmp qword [rbx + 8], rsi
jne 0x14000215d
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140001fe4
mov r15, rdi
cmp rdi, r14
jb 0x140002117
mov r13d, dword [rbp - 0x38]
xor edx, edx
mov rax, r15
div r13
sub r15, rdx
jmp 0x140002047
mov r8d, gethostbyname
lea rdx, [rbp - 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002081
cmp dword [rbp - 0x10], 0x10000
je 0x140002051
mov r15, qword [rbp - 0x28]
cmp r15, r13
jb 0x140002081
sub r15, r13
cmp r15, r14
jae 0x14000201d
jmp 0x140002081
test r15, r15
je 0x140002081
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140002122
cmp r15, r14
jae 0x14000200c
test rbx, rbx
jmp 0x140002115
mov r15d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov r14d, r15d
div r15
mov eax, r15d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r12
ja 0x14000215d
mov r8d, gethostbyname
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000215d
cmp dword [rbp - 0x10], 0x10000
je 0x1400020f0
xor edx, edx
lea edi, [r15 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div r14
sub rdi, rdx
cmp rdi, r12
jbe 0x1400020ad
jmp 0x14000215d
test rdi, rdi
je 0x14000215d
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140002122
cmp rdi, r12
jbe 0x140002089
jmp 0x14000215d
lea rcx, [rbx + 0x40]
mov dword [rbx + 0x10], esi
mov edx, 0x40
mov qword [rcx], rsi
mov rax, rcx
mov qword [rbx + 8], rcx
add rdx, 0x40
add rcx, 0x40
mov rsi, rax
cmp rdx, 0xfc0
jbe 0x14000212e
mov rax, qword [0x140040f50]
mov qword [rbx], rax
mov qword [0x140040f50], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14000b1e0
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x18
xor eax, eax
test eax, eax
je 0x14000b1ff
movsx eax, byte [rsp + 0x28]
or eax, 0x20
mov dword [rsp], eax
jmp 0x14000b207
movsx eax, byte [rsp + 0x28]
mov dword [rsp], eax
mov eax, dword [rsp]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
imul eax, eax, 0x1000193
add rsp, 0x18
ret

Function at 0x14000b650
Capabilities:
Enumerate threads
Resume thread

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x14000b70d
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x14000b702
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
jb 0x14000b6e7
mov eax, dword [rsp + 0x68]
cmp dword [rsp + 0x38], eax
je 0x14000b6e7
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x3c], eax
jne 0x14000b6e7
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14000b6e7
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x14000b694
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x58
ret

Function at 0x14000b720
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x14000b7dd
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x14000b7d2
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
jb 0x14000b7b7
mov eax, dword [rsp + 0x68]
cmp dword [rsp + 0x38], eax
je 0x14000b7b7
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x3c], eax
jne 0x14000b7b7
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14000b7b7
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x14000b764
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x58
ret