joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800df410
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180007ae0
mov ecx, eax
call fcn.180028030
mov ecx, eax
mov edx, 2
add rsp, 0x28
jmp fcn.1800deee0

Function at 0x1800df450
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180007ae0
mov ecx, eax
call fcn.180028030
mov ecx, eax
mov edx, 1
add rsp, 0x28
jmp fcn.1800deee0

Function at 0x1800df490
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180007ae0
mov ecx, eax
call fcn.180028030
mov ecx, eax
xor edx, edx
add rsp, 0x28
jmp fcn.1800deee0

Function at 0x1800df4d0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x781b3d62bb013ef5
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov dword [rax], ecx
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 1
inc dword [0x1802b4268]
jmp fcn.1800b8dc0
sub rsp, 0x28
call fcn.180007ae0
mov ecx, eax
call fcn.180028030
mov ecx, eax
add rsp, 0x28
jmp 0x1800dee90

Function at 0x1800df510
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180007ae0
mov ecx, eax
call fcn.180028030
mov ecx, eax
xor edx, edx
call fcn.1800deee0
call fcn.180007ae0
mov ecx, eax
call fcn.180028030
mov ecx, eax
mov edx, 1
call fcn.1800deee0
call fcn.180007ae0
mov ecx, eax
call fcn.180028030
mov ecx, eax
mov edx, 2
call fcn.1800deee0
call fcn.180007ae0
mov ecx, eax
call fcn.180028030
mov ecx, eax
mov edx, 3
call fcn.1800deee0
call fcn.180007ae0
mov ecx, eax
call fcn.180028030
mov ecx, eax
mov edx, 4
call fcn.1800deee0
call fcn.180007ae0
mov ecx, eax
call fcn.180028030
mov ecx, eax
mov edx, 5
call fcn.1800deee0
call fcn.180007ae0
mov ecx, eax
call fcn.180028030
mov ecx, eax
mov edx, 6
call fcn.1800deee0
call fcn.180007ae0
mov ecx, eax
call fcn.180028030
mov ecx, eax
mov edx, 7
add rsp, 0x28
jmp fcn.1800deee0

Function at 0x1800df840
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0xb736a491e64a32cf
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov qword [rax], rcx
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800df910
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov dword [rax], ecx
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], edx
movabs rdx, 0x89f149b6131e57da
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800dfa00
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0xb96b00e976be977f
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
movss dword [rax], xmm0
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800dfa30
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x5e5e99285ae812db
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
jmp fcn.1800b8dc0
Function at 0x1800e1540
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180007ae0
mov ecx, eax
xor edx, edx
call fcn.180031130
movss xmm1, dword [0x180278e3c]
mov ecx, eax
add rsp, 0x28
jmp fcn.18007f380

Function at 0x1800e1590
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180007ae0
mov ecx, eax
xor edx, edx
call fcn.180031130
xorps xmm1, xmm1
mov ecx, eax
add rsp, 0x28
jmp fcn.18007f380

Function at 0x1800e15d0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
call fcn.180007ae0
mov ecx, eax
xor edx, edx
call fcn.180031130
mov ecx, eax
mov ebx, eax
call fcn.18007f4b0
mov ecx, ebx
call fcn.18007f4e0
xorps xmm1, xmm1
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp fcn.18007f380

Function at 0x1800e1680
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0xbaa045b4e42f3c06
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov dword [rax], ecx
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
movss dword [rax + rcx*8], xmm1
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800e24c0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0xbffb028b3dd0a97
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov dword [rax], ecx
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 1
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800e2ee0
Capabilities:
Hash data using fnv

Disassembly:
mov rcx, qword [rcx + 8]
mov r9d, dword [0x1802ec300]
mov r8d, dword [0x1802ec2fc]
mov edx, dword [0x1802ec2f8]
mov ecx, dword [rcx]
jmp fcn.18007edd0

Function at 0x1800e43b0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x539e0ae3e6634b9f
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov qword [rax], rcx
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800e5680
Capabilities:
Hash data using fnv

Disassembly:
mov rcx, qword [rcx + 8]
mov r9d, dword [0x1802ec330]
mov r8d, dword [0x1802ec32c]
mov edx, dword [0x1802ec328]
mov ecx, dword [rcx]
jmp fcn.18007ef10
Function at 0x1800e7ba0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [0x1802b4270]
xor edx, edx
mov dword [0x1802b4268], edx
mov dword [0x1802b4278], edx
mov dword [rax], ecx
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 1
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 0x2bc
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 1
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 1
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], edx
movabs rdx, 0x7e5b515db0636fc
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800e7cd0
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [0x1802edc14]
xor eax, eax
mov dword [0x1802b4268], eax
movabs rdx, 0x865908c81a2c22e9
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov dword [rax], ecx
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 1
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800e7d20
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x8e5fb15663f79120
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov dword [rax], 1
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800e7d50
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [0x1802edc14]
xor eax, eax
mov dword [0x1802b4268], eax
movabs rdx, 0x26fb97d0a425f84
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov dword [rax], ecx
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 1
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800e7da0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [0x1802b4270]
xor edx, edx
mov dword [0x1802b4268], edx
mov dword [0x1802b4278], edx
mov dword [rax], ecx
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
movss dword [rax + rcx*8], xmm1
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
movss dword [rax + rcx*8], xmm2
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
movss dword [rax + rcx*8], xmm3
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], edx
movabs rdx, 0x85973643155d0b07
inc dword [0x1802b4268]
jmp fcn.1800b8dc0
Function at 0x1800e7e40
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [0x1802b4270]
xor r8d, r8d
mov edx, dword [0x1802edc10]
mov ecx, dword [0x1802edc14]
mov dword [0x1802b4268], r8d
mov dword [0x1802b4278], r8d
mov dword [rax], ecx
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], edx
movabs rdx, 0xfedb7d269e8c60e3
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], r8d
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], r8d
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], r8d
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 1
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800e7f50
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0xa50a1eedad01e65
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov dword [rax], ecx
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 1
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800e7fe0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x2c933abf17a1df41
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov qword [rax], rcx
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800e8010
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x719ff505f097fd20
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
jmp fcn.1800b8dc0

Function at 0x1800e8090
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x8d8acd8388cd99ce
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov dword [rax], ecx
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800e80c0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x71bc8e838b9c6035
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov dword [rax], ecx
inc dword [0x1802b4268]
jmp fcn.1800b8dc0
Function at 0x1800e80f0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x96a05e4fb321b1ba
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov dword [rax], ecx
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
movss dword [rax + rcx*8], xmm1
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
movss dword [rax + rcx*8], xmm2
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
movss dword [rax + rcx*8], xmm3
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 1
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800e8190
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0xce07b9f7817aada3
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov dword [rax], ecx
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 0x47c34f80
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800e81e0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x4a3dc7eccc321032
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov dword [rax], ecx
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 0x47c34f80
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 1
inc dword [0x1802b4268]
jmp fcn.1800b8dc0

Function at 0x1800e8310
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x183dadc6aa953186
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov dword [rax], ecx
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 1
inc dword [0x1802b4268]
jmp fcn.1800b8dc0
Function at 0x1800eaec0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0xf6062e089251c898
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
jmp fcn.1800b8dc0

Function at 0x1800eba50
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0xfc4842a34657bfcb
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov qword [rax], rcx
mov eax, dword [0x1802b4268]
inc eax
mov dword [0x1802b4268], eax
mov ecx, eax
mov rax, qword [0x1802b4270]
mov dword [rax + rcx*8], 0x40400000
inc dword [0x1802b4268]
jmp fcn.1800b8dc0
mov rcx, qword [0x1802ec450]
lea rax, str.shower
mov rcx, qword [rax + rcx*8]
jmp 0x1800eaee0

Function at 0x1800eba90
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0xed712ca327900c8a
mov dword [0x1802b4268], eax
mov dword [0x1802b4278], eax
mov rax, qword [0x1802b4270]
mov qword [rax], rcx
inc dword [0x1802b4268]
jmp fcn.1800b8dc0
mov rcx, qword [0x1802ec448]
lea rax, str.clear
mov rcx, qword [rax + rcx*8]
jmp 0x1800eae60
Function at 0x1800eecf0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1802ae740]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x1800eeee9
mov dword [rsp + 0x38], 0x1c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1800eeede
mov dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x38]
cmp rax, 0x10
jb 0x1800eee70
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x44], eax
jne 0x1800eee70
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x40], eax
je 0x1800eee70
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x1800eedd9
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0x80
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x1802e4d88]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x1800eedd7
mov dword [rsp + 0x20], 0
jmp 0x1800eee8f
jmp 0x1800eee47
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x1800eee47
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl rax, 2
mov r9, rax
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1802e4d88]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1800eee3a
mov dword [rsp + 0x20], 0
jmp 0x1800eee8f
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
mov edx, dword [rsp + 0x40]
mov dword [rcx + rax*4], edx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x38], 0x1c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1800eed54
cmp dword [rsp + 0x20], 0
je 0x1800eeea9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1800eeea9
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
jne 0x1800eeede
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x1800eeede
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1802e4d88]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x70]
mov qword [rax], 0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801942d0
add rsp, 0x68
ret
Function at 0x1800eef10
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rcx, qword [rsp + 0x40]
call fcn.1800eecf0
test eax, eax
jne 0x1800eef69
mov dword [rsp + 0x24], 9
jmp 0x1800eefeb
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x1800eefeb
mov dword [rsp + 0x20], 0
jmp 0x1800eef88
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x1800eefeb
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800eefe9
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.1800eeb40
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800eef7e
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret

Function at 0x1800ef000
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x1800ef08f
mov dword [rsp + 0x20], 0
jmp 0x1800ef028
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x1800ef078
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800ef076
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800ef01e
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1802e4d88]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x38
ret
Function at 0x1800ef0a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov eax, dword [rsp + 0x60]
imul rax, rax, 0x38
mov rcx, qword [0x1802edc40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 5
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800ef10a
mov rax, qword [rsp + 0x30]
sub rax, 5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800ef133
mov eax, 0xa
jmp 0x1800ef264
cmp dword [rsp + 0x68], 0
je 0x1800ef19e
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x30]
add rax, 5
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800ef19c
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x48]
mov byte [rax + 1], 0xf9
jmp 0x1800ef1ea
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800ef1ce
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call fcn.1801ca540
jmp 0x1800ef1ea
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call fcn.1801ca540
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x68]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x68]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x28]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x20], al
xor eax, eax
add rsp, 0x58
ret