joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180029ea4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp word [0x18015d0e0], 0xa
mov rdx, rcx
jb 0x180029ee0
lea rax, [0x18015ac20]
cmp rax, rcx
jbe 0x180029ed4
mov rcx, qword gs:[0x60]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 0x30]
jmp sym.ntdll.dll_RtlFreeHeap
lea rax, [0x18015ada0]
cmp rdx, rax
jae 0x180029ebd
lea rcx, [0x18015d0e0]
jmp fcn.18009e460

Function at 0x18002a38c
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
lea r14, [rcx + 0x120]
mov r15d, edx
mov rsi, qword [r14]
jmp 0x18002a3ae
mov rsi, qword [rsi]
cmp rsi, r14
je 0x18002a453
lea rbp, [rsi - 0x18]
test rbp, rbp
je 0x18002a3ab
mov rbx, qword [rbp + 0x30]
cmp rbx, qword [rbp + 0x48]
jae 0x18002a3ab
and qword [rsp + 0x28], 0
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], 0x30
mov rdx, rbx
or rcx, 0xffffffffffffffff
call sym.ntdll.dll_NtQueryVirtualMemory
mov edi, eax
test eax, eax
js 0x1800acf24
cmp dword [rsp + 0x50], 0x1000
jne 0x18002a449
mov rax, qword [rsp + 0x48]
lea r8, [rsp + 0xa0]
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0xa8]
lea rax, [rsp + 0x90]
mov qword [rsp + 0xa8], rbx
mov r9d, r15d
mov qword [rsp + 0x20], rax
or rcx, 0xffffffffffffffff
call sym.ntdll.dll_NtProtectVirtualMemory
mov edi, eax
test eax, eax
js 0x1800acedc
add rbx, qword [rsp + 0x48]
jmp 0x18002a3c4
xor edi, edi
mov eax, edi
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], 0
je 0x1800acf0f
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
lea rcx, str.HEAP__wZ_:
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800acf1b
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea rcx, str.VirtualProtect_Failed_0x_p__x_n
jmp 0x1800acf6a
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], 0
je 0x1800acf57
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
lea rcx, str.HEAP__wZ_:
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800acf63
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea rcx, str.VirtualQuery_Failed_0x_p__x_n
mov rdx, rbx
mov r8d, edi
call sym.ntdll.dll_DbgPrint
nop
jmp 0x18002a455
Function at 0x18002aa88
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov qword [r8 + 0x28], r9
lea rbx, [r8 - 0x10]
mov r14, rdx
lea rax, [r8 + 0x30]
mov qword [r8 + 0x20], rax
mov rbp, r8
mov dword [rbx + 8], 0x10004
mov rdi, rcx
mov byte [rbx + 0xf], 3
mov rdx, qword [rdx + 0x28]
cmp rdx, r14
jne 0x18002ab81
xor sil, sil
cmp dword [0x18015d450], 1
mov byte [rbx + 0xe], sil
mov rsi, qword [rsp + 0x60]
jge 0x1800ad36a
cmp rsi, rbx
je 0x18002aafb
movzx eax, word [rdi + 0x8c]
mov word [rbx + 0xc], ax
cmp dword [rdi + 0x7c], 0
je 0x18002ab16
mov al, byte [rbx + 0xa]
xor al, byte [rbx + 9]
xor al, byte [rbx + 8]
mov byte [rbx + 0xb], al
mov eax, dword [rdi + 0x88]
xor dword [rbx + 8], eax
mov rdx, rbp
mov rcx, rdi
call fcn.18002abd8
inc dword [r14 + 0x54]
mov rax, qword [rbp + 0x28]
shr rax, 0xc
add dword [r14 + 0x50], eax
mov rax, qword [rbp + 0x28]
sub qword [rdi + 0x220], rax
inc dword [rdi + 0x23c]
cmp dword [rdi + 0x23c], 0xa
ja 0x18002aba9
mov rax, qword [rbp + 0x28]
cmp rax, 0xff000
jae 0x18002aba0
mov rax, qword [rsp + 0x68]
sub rbx, rsi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
sar rbx, 4
mov qword [rax], rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop r14
ret
mov rsi, rbx
sub rsi, r14
shr rsi, 0x10
inc rsi
cmp rsi, 0xfe
jb 0x18002aad5
jmp 0x1800ad348
add qword [rdi + 0x228], rax
jmp 0x18002ab57
cmp qword [rdi + 0x140], 0
jne 0x18002ab4b
mov eax, dword [rdi + 0x70]
and al, 3
cmp al, 2
sete cl
test byte [0x18015d42c], 1
sete al
test al, cl
je 0x18002ab4b
bts dword [rdi + 0x78], 0x1c
jmp 0x18002ab4b
and qword [rsp + 0x28], 0
mov r9, r14
and qword [rsp + 0x20], 0
mov r8, rbx
mov ecx, 3
call fcn.18009a4c0
nop
jmp 0x18002aad5
cmp rsi, rbx
jbe 0x18002aaee
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], 0
je 0x1800ad3a6
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
lea rcx, str.HEAP__wZ_:
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800ad3b2
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea rcx, str.__PHEAP_ENTRY_LastKnownEntry___Entry_
call sym.ntdll.dll_DbgPrint
mov ecx, 1
call fcn.1800fc294
nop
jmp 0x18002aaeb
Function at 0x18002acd0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [0x18015d450], 1
mov rbx, rdx
mov rdi, rcx
jge 0x1800ad40c
mov rdx, qword [rdi + 0x140]
test rdx, rdx
jne 0x18002ad21
lea rcx, [rdi + 0xf0]
mov rax, qword [rcx]
cmp rcx, rax
je 0x18002ad13
cmp qword [rax + 0x28], rbx
jae 0x18002ad16
mov rax, qword [rax]
jmp 0x18002ad03
mov rax, rcx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rdx + 8]
mov rcx, rbx
shr rcx, 0xc
cmp rcx, rax
jae 0x18002ad45
mov r9d, ecx
mov qword [rsp + 0x20], rbx
mov rcx, rdi
xor r8d, r8d
call fcn.180013330
jmp 0x18002ad16
mov rax, qword [rdx]
test rax, rax
jne 0x18002ad54
mov ecx, dword [rdx + 8]
dec ecx
jmp 0x18002ad30
mov rdx, rax
mov eax, dword [rax + 8]
jmp 0x18002ad2b
lea rax, [rdx + 0xfff]
and rax, 0xfffffffffffff000
cmp rax, rbx
je 0x18002aced
mov rax, qword gs:[0x60]
cmp qword [rax + 0x18], 0
je 0x1800ad455
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
lea rcx, str.HEAP__wZ_:
add rdx, 0x58
call sym.ntdll.dll_DbgPrint
jmp 0x1800ad461
lea rcx, str.HEAP:
call sym.ntdll.dll_DbgPrint
lea rcx, str._ROUND_UP_TO_POWER2_Size__PAGE_SIZE___Size_
call sym.ntdll.dll_DbgPrint
mov ecx, 1
call fcn.1800fc294
nop
jmp 0x18002aced
Function at 0x18002b540
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x30
mov rsi, qword [rcx + 0x38]
lea rdi, [rcx + 0x70]
mov rbx, rcx
lea rax, [rbp + 0x38]
mov r9, rdi
mov qword [rsp + 0x20], rax
mov r8w, 0xc
mov dl, 1
mov rcx, qword [rsi + 0x30]
call fcn.18001014c
mov rcx, qword [rbp + 0x38]
xor r14d, r14d
test eax, eax
cmovs rcx, r14
test dword [rbx + 0x20], 0x800000
mov qword [rbp + 0x38], rcx
mov qword [rbx + 0x68], rcx
jne 0x18002b691
mov rdx, qword [rsi + 0x30]
lea r9, [rbp + 0x30]
xor r8d, r8d
lea ecx, [r14 + 3]
call sym.ntdll.dll_RtlImageNtHeaderEx
mov rcx, qword [rsi + 0x30]
call fcn.18002b3ec
test rax, rax
je 0x18002b5f6
cmp dword [rax], 0x94
jb 0x18002b5f6
mov rdx, qword [rbp + 0x30]
mov ecx, 0x4000
test word [rdx + 0x5e], cx
je 0x18002b5fa
test dword [rax + 0x90], 0x100
je 0x18002b5fa
mov rax, qword [rax + 0x70]
mov qword [rbx + 0x98], rax
test rax, rax
je 0x18002b5fa
mov rax, qword [rax]
mov qword [rbx + 0x90], rax
mov rdx, qword [rbp + 0x30]
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x18002b66e
mov edx, r14d
test rcx, rcx
je 0x18002b661
mov rax, qword [rdi]
test rax, rax
je 0x18002b661
mov qword [rbp + 0x48], rax
lea r8, [rbp + 0x48]
lea rax, [rbx + 0x88]
mov qword [rbp + 0x40], rcx
mov r9d, 4
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x40]
or rcx, 0xffffffffffffffff
call sym.ntdll.dll_NtProtectVirtualMemory
mov edx, eax
test eax, eax
js 0x18002b663
mov rcx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x48]
add r8, rcx
mov rax, qword [rcx]
mov qword [rcx], rax
add rcx, 0x1000
cmp rcx, r8
jb 0x18002b64f
mov eax, edx
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
movzx eax, word [rdx + 0x14]
lea r8, [rdx + 0x18]
mov r10d, dword [rdx + 0x90]
add r8, rax
mov rcx, r14
test r10d, r10d
je 0x18002b603
jmp 0x1800ad4fe
xor eax, eax
jmp 0x18002b663
movzx r11d, word [rdx + 6]
mov r9d, r14d
test r11d, r11d
je 0x18002b603
mov edx, dword [r8 + 0xc]
cmp r10d, edx
jb 0x1800ad549
mov ecx, dword [r8 + 0x10]
add ecx, edx
cmp r10d, ecx
jae 0x1800ad549
mov ecx, edx
add rcx, qword [rsi + 0x30]
mov qword [rbx + 0x68], rcx
mov eax, dword [r8 + 8]
mov qword [rdi], rax
test rax, rax
jne 0x18002b603
mov eax, dword [r8 + 0x10]
mov qword [rdi], rax
jmp 0x18002b603
inc r9d
add r8, 0x28
cmp r9d, r11d
jb 0x1800ad50f
mov rcx, r14
jmp 0x18002b603
Function at 0x18002c8c4
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, qword gs:[0x60]
mov rsi, rcx
movzx edi, word [0x18015d010]
mov eax, dword [rbx + 0xe8]
add edi, eax
cmp edi, 0xfffe
jae 0x18002c930
mov ecx, dword [rbx + 0xec]
cmp edi, ecx
je 0x18002c94b
mov ecx, eax
mov rax, qword [rbx + 0xf0]
mov qword [rax + rcx*8], rsi
mov eax, dword [rbx + 0xe8]
inc eax
mov dword [rbx + 0xe8], eax
cmp dword [rsi + 0x10], 0xddeeddee
je 0x18002c945
mov word [rsi + 0xd0], ax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov word [rsi + 0x3c], ax
jmp 0x18002c930
lea eax, [rcx + rcx]
xor edx, edx
mov dword [rbx + 0xec], eax
mov rcx, qword gs:[0x60]
mov r8d, eax
shl r8, 3
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov rbp, rax
test rax, rax
je 0x1800ada2e
mov r8d, dword [rbx + 0xe8]
mov rcx, rax
mov rdx, qword [rbx + 0xf0]
shl r8, 3
call sym.ntdll.dll_RtlCopyMemory
mov r8, qword [rbx + 0xf0]
lea rax, [0x18015ab20]
cmp r8, rax
jne 0x18002c9ba
mov eax, dword [rbx + 0xe8]
mov qword [rbx + 0xf0], rbp
jmp 0x18002c905
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
jmp 0x18002c9a8
mov dword [rbx + 0xec], edi
jmp 0x18002c930
Function at 0x18002d1d8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov r13, rcx
cmp qword [0x18015d408], r15
lea rcx, [0x1801564c0]
mov esi, r15d
mov edi, r15d
lea eax, [r15 + 1]
cmovne esi, eax
mov rax, qword gs:[0x60]
mov dword [rsp + 0x78], esi
mov ebp, dword [rax + 0xbc]
call sym.ntdll.dll_RtlEnterCriticalSection
cmp byte [0x18015cfb4], r15b
jne 0x18002d302
mov r14, qword [r13 + 8]
mov r12d, r15d
cmp r14, r13
je 0x18002d2bd
and ebp, 0x100
mov dword [rsp + 0x80], ebp
lea rbx, [r14 - 0xa0]
test ebp, ebp
jne 0x1800adb46
xor r8d, r8d
mov rcx, rbx
call fcn.18002d3b8
test rdi, rdi
jne 0x18002d2e4
test esi, esi
jne 0x18002d290
mov rsi, qword [rbx + 0x50]
mov edx, 0x10
mov rcx, rsi
call fcn.18003ff10
test eax, eax
jne 0x1800adb5e
mov esi, dword [rsp + 0x78]
mov edx, 1
mov rcx, rbx
call fcn.18002d32c
mov rcx, qword [rbx + 0x30]
lea rdx, [rbx + 0x48]
or dword [rbx + 0x68], 8
mov r8d, 0x14ad
call fcn.18003bc9c
mov r14, qword [r14 + 8]
cmp r14, r13
jne 0x18002d250
lea rcx, [0x1801564c0]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov rbx, qword [rsp + 0x88]
mov eax, r12d
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp byte [0x18015cfbc], r15b
jne 0x18002d26f
mov rcx, rbx
mov rax, rdi
call qword [section..00cfg]
or byte [rbx + 0x69], 8
jmp 0x18002d26f
mov edx, dword [0x7ffe0330]
mov eax, 0x40
mov rdi, qword [0x18016f260]
mov ecx, edx
and ecx, 0x3f
sub eax, ecx
mov cl, al
mov eax, edx
ror rdi, cl
xor rdi, rax
jmp 0x18002d237
mov rcx, rbx
call fcn.180082f30
mov r12d, eax
test eax, eax
js 0x18002d2bd
jmp 0x18002d25f
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rsi + rcx*2], r15w
jne 0x1800adb62
cmp qword [0x18015d408], r15
je 0x1800adb84
mov r15, qword [0x18015c310]
inc r15
add r15, rcx
jmp 0x1800adb88
lea r15, [rcx + 2]
mov rcx, qword gs:[0x60]
lea r8, [r15 + r15]
mov edx, 8
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov rbp, rax
xor eax, eax
test rbp, rbp
jne 0x1800adbf2
mov eax, dword [0x180156a70]
test al, 3
je 0x1800adbe4
lea rax, str.Failed_to_allocated_memory_for_shimmed_module_list_n
xor r9d, r9d
lea r8, str.LdrpCheckModule
mov qword [rsp + 0x20], rax
mov edx, 0xa90
lea rcx, [0x180118390]
call fcn.1800ca394
mov eax, dword [0x180156a70]
test al, 0x10
je 0x1800adc82
int3
mov rdx, qword [0x18015d408]
test rdx, rdx
je 0x1800adc58
mov rax, qword [0x18015c310]
mov rcx, rbp
lea r13, [rax + rax]
mov r8, r13
call sym.ntdll.dll_RtlCopyMemory
or r8, 0xffffffffffffffff
xor eax, eax
inc r8
cmp word [rsi + r8*2], ax
jne 0x1800adc1a
lea rcx, [r13 + 2]
add r8, r8
add rcx, rbp
mov rdx, rsi
call sym.ntdll.dll_RtlCopyMemory
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [0x18015d408]
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
mov r13, qword [rsp + 0x70]
jmp 0x1800adc74
or r8, 0xffffffffffffffff
inc r8
cmp word [rsi + r8*2], ax
jne 0x1800adc5c
add r8, r8
mov rdx, rsi
mov rcx, rbp
call sym.ntdll.dll_RtlCopyMemory
mov qword [0x18015d408], rbp
mov qword [0x18015c310], r15
mov ebp, dword [rsp + 0x80]
xor r15d, r15d
jmp 0x18002d28c
Function at 0x18002dcd4
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
mov r8, qword gs:[0x60]
mov r15d, 0xddeeddee
cmp dword [rcx + 0x10], r15d
je 0x18002de10
movzx eax, word [rcx + 0xd0]
mov edx, dword [r8 + 0xe8]
xor r14d, r14d
test edx, edx
je 0x18002dd63
test ax, ax
je 0x18002dd63
movzx r11d, ax
cmp r11d, edx
ja 0x18002dd63
mov r9, qword [r8 + 0xf0]
mov r10d, edx
movzx eax, ax
lea rbx, [r9 + rax*8]
lea rdi, [rbx - 8]
sub r10d, r11d
jne 0x18002dd7e
lea eax, [rdx - 1]
mov dword [r8 + 0xe8], eax
mov qword [r9 + rax*8], r14
cmp dword [rcx + 0x10], r15d
je 0x18002de19
mov word [rcx + 0xd0], r14w
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
movzx r11d, word [0x18015a7ea]
mov r12d, 0xffff
movzx esi, word [0x18015a7da]
movzx ebp, word [0x18015a7ca]
mov rdx, qword [rbx]
lea rbx, [rbx + 8]
mov qword [rdi], rdx
cmp dword [rdx + 0x10], r15d
je 0x18002de23
movzx r9d, word [rdx + 0xd0]
cmp bp, r9w
lea eax, [r9 - 1]
cmove bp, ax
cmp si, r9w
cmove si, ax
cmp r11w, r9w
cmove r11w, ax
cmp dword [rdx + 0x10], r15d
je 0x18002de2a
add word [rdx + 0xd0], r12w
add rdi, 8
add r10d, 0xffffffff
jne 0x18002dd9a
mov edx, dword [r8 + 0xe8]
mov r9, qword [r8 + 0xf0]
mov word [0x18015a7ea], r11w
mov word [0x18015a7da], si
mov word [0x18015a7ca], bp
jmp 0x18002dd43
movzx eax, word [rcx + 0x3c]
jmp 0x18002dd0d
mov word [rcx + 0x3c], r14w
jmp 0x18002dd63
movzx r9d, word [rdx + 0x3c]
jmp 0x18002ddb2
add word [rdx + 0x3c], r12w
jmp 0x18002dddd
Function at 0x18002e46c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r9d, 0x4c
mov byte [rsp + 0x30], 0
mov dword [rsp + 0x34], r9d
lea r8, [rbp - 0x79]
mov dword [rsp + 0x38], r9d
lea rsi, [rbp - 0x79]
mov rax, qword gs:[0x60]
mov r15, rdx
mov rbx, rcx
lea edx, [r9 - 0x23]
mov rcx, 0xfffffffffffffffc
mov r14, qword [rax + 0x30]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call sym.ntdll.dll_NtQueryInformationToken
mov edi, eax
test eax, eax
js 0x18002e57b
test rbx, rbx
je 0x18002e5be
mov r9d, dword [rsp + 0x38]
lea rax, [rsp + 0x38]
lea r8, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov edx, 0x29
mov rcx, rbx
call sym.ntdll.dll_NtQueryInformationToken
mov edi, eax
test eax, eax
js 0x18002e57b
mov rdx, qword [rbp - 0x29]
lea r8, [rsp + 0x30]
mov rcx, qword [rbp - 0x79]
call sym.ntdll.dll_RtlSidDominatesForTrust
mov edi, eax
test eax, eax
js 0x18002e57b
cmp byte [rsp + 0x30], 0
je 0x18002e5be
mov ecx, dword [rsp + 0x38]
lea rsi, [rbp - 0x29]
mov dword [rsp + 0x34], ecx
mov edx, dword [0x18015c294]
mov r8d, ecx
add edx, 0x140000
mov rcx, r14
call sym.ntdll.dll_RtlAllocateHeap
mov rbx, rax
test rax, rax
je 0x18002e5c4
cmp qword [rsi], 0
jne 0x18002e5a0
and qword [rax], 0
mov qword [r15], rbx
xor ebx, ebx
test rbx, rbx
jne 0x1800ae37a
mov eax, edi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.18008b0e0
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rax + 8]
mov qword [rax], rdx
mov ecx, dword [rsp + 0x34]
mov r8, qword [rsi]
add ecx, 0xfffffff8
call sym.ntdll.dll_RtlCopySid
mov edi, eax
test eax, eax
jns 0x18002e56d
jmp 0x18002e572
mov ecx, dword [rsp + 0x34]
jmp 0x18002e544
mov edi, 0xc0000017
jmp 0x18002e57b
mov r8, rbx
xor edx, edx
mov rcx, r14
call sym.ntdll.dll_RtlFreeHeap
nop
jmp 0x18002e57b
Function at 0x1800380f0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test rcx, rcx
je 0x1800b059c
test rdx, rdx
je 0x1800b059c
test rbx, rbx
je 0x1800b059c
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x30]
call sym.ntdll.dll_memset
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 0x2c]
call sym.ntdll.dll_memset
mov r8b, 1
lea rcx, [rbp - 0x69]
mov rdx, rsi
call sym.ntdll.dll_RtlUpcaseUnicodeString
test eax, eax
js 0x18003825d
movzx r8d, word [rbp - 0x69]
lea rcx, [rbp - 0x59]
mov rdx, qword [rbp - 0x61]
and dword [rbp - 0x39], 0
and dword [rbp - 0x35], 0
mov dword [rbp - 0x59], 0x6a09e667
mov dword [rbp - 0x55], 0xbb67ae85
mov dword [rbp - 0x51], 0x3c6ef372
mov dword [rbp - 0x4d], 0xa54ff53a
mov dword [rbp - 0x49], 0x510e527f
mov dword [rbp - 0x45], 0x9b05688c
mov dword [rbp - 0x41], 0x1f83d9ab
mov dword [rbp - 0x3d], 0x5be0cd19
call fcn.180044954
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x59]
call fcn.180044814
mov r8b, 9
lea rdx, [0x180114790]
mov rcx, rdi
call sym.ntdll.dll_RtlInitializeSid
movups xmm0, xmmword [rbp + 0x17]
mov dword [rdi + 8], 0x20
movups xmm1, xmmword [rbp + 0x27]
movups xmmword [rdi + 0xc], xmm0
movups xmmword [rdi + 0x1c], xmm1
xor edi, edi
lea rax, [0x180110260]
mov edx, edi
shl rdx, 4
lea rcx, [rbp - 0x69]
add rdx, rax
lea esi, [rdi + 1]
xor r8d, r8d
call sym.ntdll.dll_RtlEqualUnicodeString
test al, al
jne 0x18003827c
mov edi, esi
cmp esi, 0xc
jb 0x1800381f3
lea rcx, [rbp - 0x69]
call sym.ntdll.dll_RtlFreeAnsiString
cmp edi, 0xc
jne 0x18003825b
mov r8b, 0xa
lea rdx, [0x180114628]
mov rcx, rbx
call sym.ntdll.dll_RtlInitializeSid
movups xmm0, xmmword [rbp + 0x17]
mov dword [rbx + 8], 3
movups xmm1, xmmword [rbp + 0x27]
mov dword [rbx + 0xc], 0x400
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm1
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.18008b0e0
mov rbx, qword [rsp + 0x108]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
mov r8b, 2
lea rdx, [0x180114628]
mov rcx, rbx
call sym.ntdll.dll_RtlInitializeSid
mov dword [rbx + 8], 3
mov dword [rbx + 0xc], esi
jmp 0x18003821d
mov ecx, 5
int 0x29
int3
Function at 0x180038ed4
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xd0
mov r9, rcx
mov r10, qword gs:[0x30]
mov rsi, qword [r10 + 0x60]
xor r14d, r14d
cmp byte [0x18015c308], r14b
jne 0x1800390e8
mov rcx, r10
call fcn.180072ad0
mov r9, qword gs:[0x30]
test byte [r9 + 0x17ee], 8
jne 0x1800b086b
mov eax, 0x2000
test word [r10 + 0x17ee], ax
jne 0x1800390ce
call fcn.18005088c
mov ebx, eax
cmp eax, 0xc0000017
je 0x1800b0886
test eax, eax
js 0x1800b08a7
xor ecx, ecx
call fcn.1800435b4
call fcn.180046fbc
nop
mov rbx, qword [0x18015c370]
lea rax, [0x18015c370]
cmp rbx, rax
je 0x180039041
mov qword [rsp + 0x20], rbx
mov rax, qword [rbx + 0x98]
cmp dword [rax + 0x38], 9
jl 0x1800390b8
mov rax, qword [rbx + 0x30]
cmp qword [rsi + 0x10], rax
je 0x180039039
mov eax, dword [rbx + 0x68]
bt eax, 0x12
jb 0x180039039
mov rdi, qword [rbx + 0x38]
mov qword [rsp + 0x28], rdi
test rdi, rdi
je 0x180039039
and eax, 0x80004
cmp eax, 0x80004
jne 0x180039039
cmp byte [0x18015c3a8], r14b
jne 0x1800390bd
mov qword [rsp + 0x30], 0x48
mov dword [rsp + 0x38], 1
xor edx, edx
lea r8d, [rdx + 0x38]
lea rcx, [rsp + 0x40]
call sym.ntdll.dll_memset
mov rdx, qword [rbx + 0x88]
lea rcx, [rsp + 0x30]
call sym.ntdll.dll_RtlActivateActivationContextUnsafeFast
nop
cmp word [rbx + 0x6e], r14w
je 0x18003901b
mov rdx, rbx
mov ecx, 2
call fcn.18003b5f8
xor r9d, r9d
lea r8d, [r9 + 2]
mov rdx, qword [rbx + 0x30]
mov rcx, rdi
call fcn.18003b518
nop
lea rcx, [rsp + 0x30]
call sym.ntdll.dll_RtlDeactivateActivationContextUnsafeFast
mov rbx, qword [rbx]
jmp 0x180038f6c
mov rbx, qword [0x18015bf88]
cmp word [rbx + 0x6e], r14w
je 0x1800390bd
cmp byte [0x18015c3a8], r14b
jne 0x1800390bd
mov qword [rsp + 0x80], 0x48
mov dword [rsp + 0x88], 1
xor edx, edx
lea r8d, [rdx + 0x38]
lea rcx, [rsp + 0x90]
call sym.ntdll.dll_memset
mov rdx, qword [rbx + 0x88]
lea rcx, [rsp + 0x80]
call sym.ntdll.dll_RtlActivateActivationContextUnsafeFast
nop
mov rdx, qword [0x18015bf88]
mov ecx, 2
call fcn.18003b5f8
nop
lea rcx, [rsp + 0x80]
call sym.ntdll.dll_RtlDeactivateActivationContextUnsafeFast
jmp 0x1800390bd
jmp 0x180039039
xor r8d, r8d
lea edx, [r8 + 0x15]
call fcn.180046f60
call fcn.180047b2c
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov eax, 0x400
test word [r10 + 0x17ee], ax
je 0x180038f0c
jmp 0x1800b083a
mov r8d, dword [0x7ffe0330]
mov edx, r8d
and edx, 0x3f
mov ecx, 0x40
sub ecx, edx
mov rdx, qword [0x18015c3c0]
ror rdx, cl
mov eax, r8d
xor rax, rdx
mov qword [r9 + 0x80], rax
jmp 0x180038f0c
mov rax, qword gs:[0x30]
test byte [rax + 0x17ee], 0x20
je 0x1800390ce
jmp 0x180038f2b
mov qword [rsp + 0xe8], 0xffffffffffd23940
lea rdx, [rsp + 0xe8]
xor ecx, ecx
call sym.ntdll.dll_NtDelayExecution
nop
jmp 0x180038f3e
mov edx, ebx
or rcx, 0xffffffffffffffff
call sym.ntdll.dll_NtTerminateProcess
mov ecx, ebx
call sym.ntdll.dll_RtlRaiseStatus
nop
Function at 0x18003b518
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, r9
mov esi, r8d
mov r14, rdx
mov r12, rcx
mov rax, qword gs:[0x60]
mov r10, qword [rax + 0x90]
test r10, r10
jne 0x18003b5cb
mov edi, 0x7ffe0384
mov edx, edi
cmp byte [rdx], 0
jne 0x1800b0c55
mov ebx, 0x7ffe0385
mov byte [rsp + 0x30], 0
mov r8, r15
mov edx, esi
mov rcx, r14
mov rax, r12
mov r9, qword [section..00cfg]
call r9
mov byte [rsp + 0x30], al
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
test rcx, rcx
jne 0x18003b5d6
cmp byte [rdi], 0
jne 0x1800b0cdf
mov bl, byte [rsp + 0x30]
test bl, bl
je 0x18003b5c1
mov al, bl
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp esi, 1
jne 0x18003b5ad
jmp 0x1800b0d44
cmp dword [r10], 0
je 0x18003b554
jmp 0x1800b0c34
cmp dword [rcx], 0
je 0x18003b59c
jmp 0x1800b0cc3
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x90]
add rdx, 0x22a
mov edi, 0x7ffe0384
jmp 0x18003b55b
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 4
je 0x18003b564
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
mov ebx, 0x7ffe0385
test eax, eax
je 0x1800b0c92
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22b
jmp 0x1800b0c95
mov rcx, rbx
test byte [rcx], 0x20
je 0x18003b569
mov ecx, 0x14a3
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r9b, sil
xor r8d, r8d
mov rdx, r14
call fcn.1800cb8f0
nop
jmp 0x18003b569
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x90]
add rdi, 0x22a
jmp 0x18003b59c
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 4
je 0x18003b5a5
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800b0d15
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x90]
add rbx, 0x22b
mov al, byte [rbx]
test al, 0x20
je 0x18003b5a5
mov ecx, 0x1496
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r9b, 0xff
mov r8b, r9b
mov rdx, r14
call fcn.1800cb8f0
nop
jmp 0x18003b5a5
mov edx, 0x1496
xor r9d, r9d
mov r8b, 1
mov ecx, 0xc0000142
call fcn.180043b30
nop
jmp 0x18003b5ad