joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180036f4b
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
jmp 0x18004c7f0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
lea rcx, [0x1800fd1e7]
call fcn.180037c84
cmp qword [0x1800ebb68], 0
jne 0x18004c924
lea rcx, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rbp + 0x50]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x1b0], 0x40000000
jbe 0x18004c88b
mov rax, qword [rbp + 0x1b0]
sub rax, 0x40000000
cmp qword [rbp + 8], rax
jae 0x18004c88b
mov rax, qword [rbp + 0x1b0]
sub rax, 0x40000000
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x1b0]
add rax, 0x40000000
cmp qword [rbp + 0x28], rax
jbe 0x18004c8af
mov rax, qword [rbp + 0x1b0]
add rax, 0x40000000
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x1b0]
mov qword [rbp + 0x98], rax
mov rax, qword [rbp + 8]
cmp qword [rbp + 0x98], rax
jb 0x18004c924
mov r8d, dword [rbp + 0x70]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x98]
call fcn.18004ca60
mov qword [rbp + 0x98], rax
cmp qword [rbp + 0x98], 0
jne 0x18004c8f1
jmp 0x18004c924
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x1800ebb68], rax
cmp qword [0x1800ebb68], 0
je 0x18004c922
jmp 0x18004c924
jmp 0x18004c8bd
cmp qword [0x1800ebb68], 0
jne 0x18004c935
xor eax, eax
jmp 0x18004c9bb
mov rax, qword [0x1800ebb68]
mov qword [rbp + 0xb8], rax
mov rax, qword [rbp + 0xb8]
mov byte [rax], 0x48
mov eax, dword [rbp + 0x1c0]
or eax, 0xb8
mov rcx, qword [rbp + 0xb8]
mov byte [rcx + 1], al
mov rax, qword [rbp + 0xb8]
mov rcx, qword [rbp + 0x1b8]
mov qword [rax + 2], rcx
mov eax, dword [rbp + 0x1c0]
shl eax, 8
or eax, 0xe0ff
mov rcx, qword [rbp + 0xb8]
mov word [rcx + 0xa], ax
mov rax, qword [rbp + 0xb8]
movabs rcx, 0xcccccccccccccccc
mov qword [rax + 0xc], rcx
mov rax, qword [0x1800ebb68]
add rax, 0x14
mov qword [0x1800ebb68], rax
mov rax, qword [rbp + 0xb8]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1800ac8a0]
call fcn.1800377a7
mov rax, rdi
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret

Function at 0x18003704f
Capabilities:
Terminate process

Disassembly:
jmp 0x18009e610
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x180037103
Capabilities:
Create thread

Disassembly:
jmp 0x180080da0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x1800ea138]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1800fd48f]
call fcn.180037c84
lea rcx, [0x1800ebed8]
call fcn.18003639d
movzx eax, byte [0x1800ebed9]
test eax, eax
jne 0x180080e33
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [fcn.180037103]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x1800ebed9], 1
xor eax, eax
jmp 0x180080ef9
movzx eax, byte [0x1800ebed9]
test eax, eax
je 0x180080edb
movzx eax, byte [0x1800ebeda]
test eax, eax
jne 0x180080edb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp + 8], rax
mov dword [rbp + 0x30], 0x50
mov r8d, dword [rbp + 0x30]
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.18003662c
xor edx, edx
mov rax, qword [rbp + 0x40]
mov ecx, 0xfa000
div rcx
test rax, rax
jl 0x180080e8d
cvtsi2ss xmm0, rax
jmp 0x180080ea6
mov rcx, rax
shr rcx, 1
and rax, 1
or rcx, rax
cvtsi2ss xmm1, rcx
addss xmm1, xmm1
movaps xmm0, xmm1
cvtss2sd xmm0, xmm0
call qword [sym.imp.ucrtbased.dll_floor]
cvtsd2ss xmm0, xmm0
movss dword [rbp + 0x94], xmm0
movss xmm0, dword [rbp + 0x94]
comiss xmm0, dword [0x1800b7c68]
jbe 0x180080ed6
mov byte [0x1800ebeda], 1
jmp 0x180080edb
jmp 0x180080e42
movzx eax, byte [0x1800ebeda]
test eax, eax
je 0x180080ef7
lea rcx, [0x1800ebed8]
call fcn.1800364e2
call fcn.180037761
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1800b7bf0]
call fcn.1800377a7
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.180036e4c
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1800373ec
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x18006b0d0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, WSACleanup
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2c8]
mov rax, qword [0x1800ea138]
xor rax, rbp
mov qword [rbp + 0x278], rax
lea rcx, [0x1800fd347]
call fcn.180037c84
mov rax, qword [rbp + 0x2a0]
mov byte [rax], 0
lea rdx, [rbp + 0x10]
mov cx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x18006b13f
mov rax, qword [rbp + 0x2a0]
mov byte [rax], 1
mov rax, qword [rbp + 0x2a0]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1800b0910]
call fcn.1800377a7
mov rax, rdi
mov rcx, qword [rbp + 0x278]
xor rcx, rbp
call fcn.180036e4c
lea rsp, [rbp + 0x288]
pop rdi
pop rbp
ret
Function at 0x180037595
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
jmp 0x180070990
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1748
call fcn.1800364f6
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x442
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1768]
mov rax, qword [0x1800ea138]
xor rax, rbp
mov qword [rbp + 0x16f8], rax
lea rcx, [0x1800fd3aa]
call fcn.180037c84
mov byte [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x180070b85
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x180070b79
mov rcx, qword [rbp + 0x1720]
call fcn.1800369bf
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0xffffffffffffffff
je 0x180070b6f
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x10a4]
mov r8d, 0x1000
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180070adf
cmp dword [rbp + 0x10a4], 0
jbe 0x180070adf
xor r9d, r9d
mov r8d, dword [rbp + 0x10a4]
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
jmp 0x180070a8e
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x10c4], 0
mov dword [rbp + 0x10e4], 4
mov dword [rsp + 0x20], 0
lea r9, [rbp + 0x10e4]
lea r8, [rbp + 0x10c4]
mov edx, 4
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x180070b6f
mov eax, dword [rbp + 0x10c4]
mov edx, eax
mov rcx, qword [rbp + 0x1728]
call fcn.180036f1e
mov rcx, qword [rbp + 0x1728]
call fcn.180037ecd
mov dword [rsp + 0x20], 0
lea r9, [rbp + 0x10c4]
mov r8, rax
mov edx, 2
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x180070b6f
mov byte [rbp + 4], 1
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
movzx eax, byte [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x1800b10a0]
call fcn.1800377a7
mov eax, edi
mov rcx, qword [rbp + 0x16f8]
xor rcx, rbp
call fcn.180036e4c
lea rsp, [rbp + 0x1708]
pop rdi
pop rbp
ret
Function at 0x180037923
Capabilities:
Read file on windows

Disassembly:
jmp 0x180080430
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
lea rcx, [0x1800fd404]
call fcn.180037c84
cmp qword [rbp + 0x1b0], 0
jg 0x180080483
xor eax, eax
jmp 0x180080649
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x1800804b1
mov r8, qword [rbp + 0x1b0]
mov rdx, qword [rbp + 0x1a8]
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x180080649
mov rax, qword [rbp + 0x1b0]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x1b0]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jbe 0x18008054d
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 8]
call fcn.180036168
mov rax, qword [rax]
mov qword [rbp + 0x68], rax
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rbp + 0x68]
mov rdx, rax
mov rcx, qword [rbp + 0x1a8]
call fcn.180037a9a
mov rax, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x1a8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x68]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov edx, dword [rbp + 0x68]
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x80], 0
je 0x18008063b
mov rcx, qword [rbp + 0x1a0]
call fcn.180037cc5
mov qword [rbp + 0x88], 0xfff
cmp qword [rbp + 8], 0xfff
jbe 0x180080602
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.ucrtbased.dll_fread]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x1a8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
cmp qword [rbp + 0xa8], 0xfff
je 0x1800805fd
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x28]
sub rcx, rax
mov rax, rcx
jmp 0x180080649
jmp 0x180080579
cmp qword [rbp + 8], 0
jbe 0x18008063b
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 8]
mov edx, 1
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.ucrtbased.dll_fread]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x28]
sub rcx, rax
mov rax, rcx
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1800b05b0]
call fcn.1800377a7
mov rax, rdi
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x180037c2a
Capabilities:
Write file on windows

Disassembly:
jmp 0x1800742b0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x1800ea138]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x1800fd404]
call fcn.180037c84
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x180074316
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x18007431d
mov al, 1
jmp 0x180074477
call fcn.1800367d5
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.1800367d5
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.1800377e3
movzx eax, al
test eax, eax
je 0x180074378
xor al, al
jmp 0x180074477
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x1800743dd
cmp dword [rbp + 0x194], 1
je 0x1800743e8
cmp dword [rbp + 0x194], 3
je 0x180074466
jmp 0x180074475
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x180074438
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x180074438
xor al, al
jmp 0x180074477
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x180074453
mov dword [rbp + 0x194], 1
jmp 0x18007445d
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x180074477
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x180074477
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1800b0890]
call fcn.1800377a7
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.180036e4c
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x180037e64
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x180067fd0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x128]
lea rcx, [0x1800fd3a7]
call fcn.180037c84
lea rcx, [rbp + 0x100]
call fcn.180037d51
lea r9, [rbp + 4]
mov r8d, 0x40
mov edx, 4
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, 4
lea rdx, [rbp + 0x108]
mov rcx, qword [rbp + 0x100]
call fcn.180036e5b
lea r9, [rbp + 4]
mov r8d, dword [rbp + 4]
mov edx, 4
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp - 0x20]
lea rdx, [0x1800b5df0]
call fcn.1800377a7
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x180037eb9
Capabilities:
Check for peb beingdebugged flag

Disassembly:
jmp 0x180072ce0
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1800fd3aa]
call fcn.180037c84
mov rax, qword gs:[0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov byte [rax + 2], 0
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x180063f80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
lea rcx, [0x1800fd383]
call fcn.180037c84
mov rcx, qword [rbp + 0x148]
call fcn.180067540
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.180067970
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.18005d080
nop
lea rcx, [rbp + 0x108]
call fcn.18006bfc0
lea rax, [0x1800627e0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x140]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.18007ad80
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x140]
mov qword [rcx], rax
mov rax, qword [rbp + 0x140]
cmp qword [rax], 0
je 0x180064069
lea rcx, [rbp + 8]
call fcn.18007f260
jmp 0x180064082
mov rax, qword [rbp + 0x140]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.180036636
nop
lea rcx, [rbp + 8]
call fcn.18006bfc0
lea rcx, [rbp - 0x30]
lea rdx, [0x1800b57d0]
call fcn.1800377a7
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x18007c4b0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rcx, [0x1800fd3aa]
call fcn.180037c84
mov rax, qword [rbp + 0x120]
movzx eax, byte [rax + 0x18]
test eax, eax
je 0x18007c4e0
jmp 0x18007c557
lea rcx, str._n_n_n___________VVVVVVVVVVVVVVVVVVVVVCCCCCCCCCCCCCCCCCCCCCCCCCC_n_n
call fcn.180036de3
lea rax, str..H1EmuVoiceH1EmuVoice.exe
mov qword [rbp + 8], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 8]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rbp + 0x28], rax
cmp dword [rbp + 0x28], 0x20
jg 0x18007c557
lea rdx, str.ShellExecute_failed_with_error_code:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180036302
mov edx, dword [rbp + 0x28]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x180036127]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x180081a50
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1c8]
mov rax, qword [0x1800ea138]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x1800fd5c5]
call fcn.180037c84
mov eax, dword [rbp + 0x1a0]
imul rax, rax, 0x38
mov rcx, qword [0x1800ec6a0]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov qword [rbp + 0x48], 5
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180081af2
mov rax, qword [rbp + 0x68]
sub rax, 5
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
add rax, 2
mov qword [rbp + 0x48], rax
lea r9, [rbp + 0x24]
mov r8d, 0x40
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180081b18
mov eax, 0xa
jmp 0x180081c47
cmp dword [rbp + 0x1a8], 0
je 0x180081b8c
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov byte [rax], 0xe9
mov rax, qword [rbp + 0x68]
add rax, 5
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x88]
mov dword [rcx + 1], eax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180081b8a
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov byte [rax], 0xeb
mov rax, qword [rbp + 0xa8]
mov byte [rax + 1], 0xf9
jmp 0x180081bd3
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180081bb9
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call fcn.180036e5b
jmp 0x180081bd3
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call fcn.180036e5b
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 1
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 2
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1800b8090]
call fcn.1800377a7
mov rax, rdi
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.180036e4c
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x180081da0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x1800ea138]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x1800fd5c5]
call fcn.180037c84
xor edx, edx
mov ecx, 4
call fcn.180036df2
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x180081f6f
mov dword [rbp + 0x28], 0x1c
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call fcn.1800371fd
test eax, eax
je 0x180081f65
mov eax, dword [rbp + 0x28]
cmp rax, 0x10
jb 0x180081f49
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp + 0x34], eax
jne 0x180081f49
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbp + 0x30], eax
je 0x180081f49
mov rax, qword [rbp + 0x160]
cmp qword [rax], 0
jne 0x180081ea4
mov rax, qword [rbp + 0x160]
mov dword [rax + 8], 0x80
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x1800ebf20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbp + 0x160]
mov qword [rcx], rax
mov rax, qword [rbp + 0x160]
cmp qword [rax], 0
jne 0x180081ea2
jmp 0x180081f65
jmp 0x180081f19
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x160]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x180081f19
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 8]
shl eax, 1
mov eax, eax
shl rax, 2
mov r9, rax
mov rax, qword [rbp + 0x160]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1800ebf20]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x180081ef5
jmp 0x180081f65
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rbp + 0x160]
mov dword [rcx + 8], eax
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x68]
mov qword [rax], rcx
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0xc]
mov rcx, qword [rbp + 0x160]
mov rcx, qword [rcx]
mov edx, dword [rbp + 0x30]
mov dword [rcx + rax*4], edx
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rbp + 0x160]
mov dword [rcx + 0xc], eax
mov dword [rbp + 0x28], 0x1c
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call fcn.180036316
test eax, eax
jne 0x180081e20
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x20]
lea rdx, [0x1800b8010]
call fcn.1800377a7
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.180036e4c
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret