joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18024251f
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x1804e6c60
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x128]
mov rax, qword [0x180ad8300]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x180b304f2]
call fcn.18024a9d1
nop
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax]
test eax, eax
je 0x1804e6cbd
jmp 0x1804e6d8a
mov dword [rbp + 4], 0
mov rax, qword [rbp + 0x100]
mov rax, qword [rax + 0x10]
movzx eax, byte [rax]
cmp eax, 0xe9
jne 0x1804e6d56
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax + 1]
lea r9, [rbp + 4]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1804e6d56
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax + 1]
mov r8d, eax
mov rax, qword [rbp + 0x100]
mov rdx, qword [rax + 0x18]
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 0x10]
call fcn.18024418a
nop
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax + 1]
lea r9, [rbp + 4]
mov r8d, dword [rbp + 4]
mov edx, eax
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
mov r8d, 0x8000
xor edx, edx
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov r8d, 0x8000
xor edx, edx
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x1807abe40]
call fcn.18024867c
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.180244135
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x180243a50
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1805f32e0
mov rax, rcx
neg rcx
test rax, 7
je 0x1805f32fd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1805f3358
test al, 7
jne 0x1805f32f0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1805f3311
mov rdx, qword [rax - 8]
test dl, dl
je 0x1805f3382
test dh, dh
je 0x1805f337c
shr rdx, 0x10
test dl, dl
je 0x1805f3376
test dh, dh
je 0x1805f3370
shr rdx, 0x10
test dl, dl
je 0x1805f336a
test dh, dh
je 0x1805f3364
shr edx, 0x10
test dl, dl
je 0x1805f335e
test dh, dh
jne 0x1805f3311
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x180243abe
Capabilities:
Query environment variable

Disassembly:
jmp 0x18068ea80
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.18068e600
lea rcx, [rsp + 0x20]
call fcn.18068e650
movzx eax, al
test eax, eax
jne 0x18068eac5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.18068e630
mov rax, qword [rsp + 0x40]
jmp 0x18068ebbf
lea rcx, [rsp + 0x20]
call fcn.18068e750
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.18068e6f0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.18024432e
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180242a88
lea rcx, [rsp + 0x28]
call fcn.180244ecd
movzx eax, al
test eax, eax
jne 0x18068eb5f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.180248109
lea rcx, [rsp + 0x20]
call fcn.18068e630
mov rax, qword [rsp + 0x50]
jmp 0x18068ebbf
lea rcx, [rsp + 0x20]
call fcn.18068e750
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.18024a738
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.18024418a
lea rcx, [rsp + 0x28]
call fcn.18024be08
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.180248109
lea rcx, [rsp + 0x20]
call fcn.18068e630
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x180244248
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1804ce200
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x180b2df65]
call fcn.18024a9d1
nop
mov qword [rbp + 8], 0x26f
mov qword [rbp + 0x28], 0xe3
mov qword [rbp + 0x48], 0
jmp 0x1804ce245
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xe3
jae 0x1804ce2d6
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
and eax, 1
test eax, eax
je 0x1804ce29b
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x1804ce2a5
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0x64]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1804ce23a
mov qword [rbp + 0x88], 0xe3
jmp 0x1804ce2f4
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x26f
jae 0x1804ce39d
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0xa4]
and eax, 1
test eax, eax
je 0x1804ce359
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x1804ce363
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xa4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1804ce2e3
mov qword [rbp + 0xc8], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rbp + 0x1e0]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0xe4]
and eax, 1
test eax, eax
je 0x1804ce3fd
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x1804ce407
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xe4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rbp + 0x1e0]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rbp + 0x1e0]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x1802446ee
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x180599d60
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1805996e0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180599d9f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x180b32020]
jmp 0x180599da9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x180244cd9
Capabilities:
Query environment variable

Disassembly:
jmp 0x18068e7d0
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18068e600
lea rcx, [rsp + 0x40]
call fcn.18068e780
movzx eax, al
test eax, eax
jne 0x18068e818
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.18068e630
mov rax, qword [rsp + 0x70]
jmp 0x18068e9e9
lea rcx, [rsp + 0x40]
call fcn.18068e750
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.18068e6f0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.18068e750
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1802477e0
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x18068e8be
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.18068e630
mov rax, qword [rsp + 0x80]
jmp 0x18068e9e9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.18024432e
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180243e10
lea rcx, [rsp + 0x48]
call fcn.180242fce
movzx eax, al
test eax, eax
jne 0x18068e925
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.18023ff40
lea rcx, [rsp + 0x40]
call fcn.18068e630
mov rax, qword [rsp + 0x88]
jmp 0x18068e9e9
lea rcx, [rsp + 0x48]
call fcn.1802458c3
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.18068e750
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1802477e0
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x18068e9bb
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.18023ff40
lea rcx, [rsp + 0x40]
call fcn.18068e630
mov rax, qword [rsp + 0xa0]
jmp 0x18068e9e9
lea rcx, [rsp + 0x48]
call fcn.180243d5c
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.18023ff40
lea rcx, [rsp + 0x40]
call fcn.18068e630
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x180244d06
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x180599c90
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.180599660
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180599cd1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x180b32020]
jmp 0x180599cd7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x180244ee6
Capabilities:
Get geographical location

Disassembly:
jmp 0x18066a920
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.180669850
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18066a987
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x180b32030]
jmp 0x18066a9a9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.180242e75
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x180244f1d
Capabilities:
Terminate process

Disassembly:
jmp 0x1805761b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1802457bf
Capabilities:
Print debug messages

Disassembly:
jmp 0x180698360
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x180ad8300]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x180698386
jmp 0x180698403
mov rcx, qword [rbp + 0x30]
call fcn.180243a50
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x18069839f
jmp 0x180698403
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1806983bc
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18024047c
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.18024136d
test eax, eax
jne 0x180698403
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.180244135
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x180246255
Capabilities:
Set environment variable

Disassembly:
jmp 0x180690930
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x1802465bb
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x180305ac0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x180b2922d]
call fcn.18024a9d1
nop
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1806f1bb0]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x180305c06
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x180305b5a
mov dword [rbp + 0x160], 1
jmp 0x180305b64
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x180305c01
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x180305bdb
cmp qword [rbp + 0x198], 2
jb 0x180305bdb
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180305bdb
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180305bdb
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x180305b25
jmp 0x180305ca0
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x180305ca0
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x180305c77
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180305c77
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180305c77
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x180305c06
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1802471be
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x180468840
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x128]
mov rax, qword [0x180ad8300]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x180b2da11]
call fcn.18024a9d1
nop
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax]
test eax, eax
je 0x18046889d
jmp 0x180468942
mov dword [rbp + 4], 0
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
mov rcx, qword [rcx + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0xe9
jne 0x180468928
lea r9, [rbp + 4]
mov r8d, 0x40
mov edx, 5
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180468928
mov r8d, 5
mov rax, qword [rbp + 0x100]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 8]
call fcn.18024418a
nop
lea r9, [rbp + 4]
mov r8d, dword [rbp + 4]
mov edx, 5
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
mov r8d, 0x8000
xor edx, edx
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x18077afe0]
call fcn.18024867c
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.180244135
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x180247e2a
Capabilities:
Terminate process

Disassembly:
jmp 0x18059ad50
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18059ad7e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.180249b03
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1802485b4
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x180460d90
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x128]
mov rax, qword [0x180ad8300]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x180b2d7e5]
call fcn.18024a9d1
nop
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax]
test eax, eax
je 0x180460ded
jmp 0x180460eba
mov dword [rbp + 4], 0
mov rax, qword [rbp + 0x100]
mov rax, qword [rax + 0x10]
movzx eax, byte [rax]
cmp eax, 0xe9
jne 0x180460e86
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax + 1]
lea r9, [rbp + 4]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180460e86
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax + 1]
mov r8d, eax
mov rax, qword [rbp + 0x100]
mov rdx, qword [rax + 0x18]
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 0x10]
call fcn.18024418a
nop
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax + 1]
lea r9, [rbp + 4]
mov r8d, dword [rbp + 4]
mov edx, eax
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
mov r8d, 0x8000
xor edx, edx
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov r8d, 0x8000
xor edx, edx
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x18077a010]
call fcn.18024867c
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.180244135
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x180249a63
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1803059a0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x180b2922d]
call fcn.18024a9d1
nop
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1806f1bb0]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x180305a20
mov dword [rbp + 0x120], 1
jmp 0x180305a2a
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x180305a73
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1803059eb
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x180249c34
Capabilities:
Print debug messages

Disassembly:
jmp 0x18065bdb0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x180249f45
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x180599dd0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.180599720
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180599e19
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x180b32020]
jmp 0x180599e28
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x18024a819
Capabilities:
Create thread

Disassembly:
jmp 0x1805f8510
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x90], 0
je 0x1805f853c
mov dword [rsp + 0x30], 1
jmp 0x1805f8544
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x1805f858d
lea rax, str.procedure___nullptr
mov qword [rsp + 0x28], rax
lea rax, [0x180a2ea60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0xc8
lea rdx, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
mov ecx, 2
call fcn.18023f662
cmp eax, 1
jne 0x1805f858d
int3
cmp dword [rsp + 0x34], 0
jne 0x1805f85cf
call fcn.180242817
mov dword [rax], 0x16
mov qword [rsp + 0x20], 0
mov r9d, 0xc8
lea r8, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
lea rdx, str._beginthreadex
lea rcx, str.procedure___nullptr
call fcn.180248c80
xor eax, eax
jmp 0x1805f86cf
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.1805f8000
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1805f7e00
lea rcx, [rsp + 0x40]
call fcn.1805f7e70
movzx eax, al
test eax, eax
jne 0x1805f861f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.1805f7e50
mov rax, qword [rsp + 0x50]
jmp 0x1805f86cf
lea rcx, [rsp + 0x40]
call fcn.1805f81b0
mov ecx, dword [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
mov edx, dword [rsp + 0xa0]
mov dword [rsp + 0x20], edx
mov r9, rax
lea r8, [0x1805f7bb0]
mov edx, ecx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1805f8693
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180241a9d
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x40]
call fcn.1805f7e50
mov rax, qword [rsp + 0x58]
jmp 0x1805f86cf
cmp qword [rsp + 0xa8], 0
je 0x1805f86ac
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
lea rcx, [rsp + 0x40]
call fcn.1805f8170
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x40]
call fcn.1805f7e50
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret