joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400de9a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400de9e2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400dea29
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400dea82
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400dea40
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400deac3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400f4422]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400f4423]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400dea90
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400deb64
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400deb9e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400deba3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400debec
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400debec
dec r8
sub rdx, 1
jne 0x1400debd2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400dff64
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400dffae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400dffae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400dffae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400dffae
cmp dword [rcx + 0x84], 0xe
jbe 0x1400dffae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400dffb0
xor al, al
add rsp, 0x28
ret
Function at 0x180002a50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x180051010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r15, rcx
cmp edx, 1
jne 0x180002c43
lea rcx, str.ArkAscended.exe
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180002c43
xor edx, edx
lea r8d, [rdx + 8]
lea rcx, str.C:windowsARK_ENGINE.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor r14d, r14d
mov dword [rsp + 0x30], r14d
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSCEnumProtocols]
cmp eax, 0xffffffff
jne 0x180002adf
cmp dword [rsp + 0x34], 0x2747
je 0x180002adf
xor ebp, ebp
mov edx, dword [rsp + 0x40]
jmp 0x180002b08
mov edx, dword [rsp + 0x30]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSCEnumProtocols]
mov edx, eax
xor ecx, ecx
test edx, edx
jle 0x180002ba8
mov r9, qword [0x180051048]
mov r10, qword [0x180051040]
movsxd r8, ecx
imul rax, r8, 0x274
cmp r10, qword [rax + rbp + 0x14]
jne 0x180002b38
cmp r9, qword [rax + rbp + 0x1c]
je 0x180002b40
inc ecx
cmp ecx, edx
jge 0x180002b4c
jmp 0x180002b20
imul rax, r8, 0x274
mov r14d, dword [rax + rbp + 0x24]
xor edi, edi
movsxd rsi, edx
test edx, edx
jle 0x180002b96
lea rbx, [rbp + 0x2c]
nop dword [rax]
cmp dword [rbx - 4], 1
jle 0x180002b87
cmp dword [rbx], r14d
jne 0x180002b87
movsxd rax, edi
imul rcx, rax, 0x274
add rcx, 0x14
add rcx, rbp
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSCDeinstallProvider]
inc edi
add rbx, 0x274
sub rsi, 1
jne 0x180002b60
lea rdx, [rsp + 0x40]
lea rcx, [0x180051040]
call qword [sym.imp.WS2_32.dll_WSCDeinstallProvider]
mov ecx, 0x10
call fcn.18003e9b0
mov qword [rax], r15
lea rcx, [0x1800026a0]
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180002d70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180002c2f
cmp dword [rsp + 0x58], 0
jne 0x180002c08
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x180002c2b
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov al, 1
jmp 0x180002c45
mov dword [rsp + 0x58], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18003e990
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x180002d20
Capabilities:
Encode data using add xor sub operations

Disassembly:
test rdx, rdx
je 0x180002d48
imul r8d, r8d, 0x91651
lea rcx, [rcx + 1]
add r8d, 0x654a6
mov eax, r8d
shr eax, 0x10
and al, 0xbe
xor byte [rcx - 1], al
sub rdx, 1
jne 0x180002d25
ret

Function at 0x180006760
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x180051010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 7
lea r8d, [rax + 0x26]
lea rdx, [0x180046b60]
lea rcx, [rsp + 0x38]
call fcn.1800062a0
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1800067fc
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, rbx
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
test eax, eax
je 0x1800067fc
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x180006841
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000683c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000683c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003e9ec
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18003e990
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x180028ce0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180051010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, r8
mov rsi, rdx
mov rbx, qword [0x18005c118]
cmp rbx, qword [0x18005c120]
je 0x180028d78
mov ecx, 0x10
call fcn.18003e9b0
mov ecx, dword [rdi]
mov dword [rax], ecx
mov qword [rax + 8], rsi
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
xor esi, esi
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x180038010]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x180028d6a
mov rax, qword [0x18005c118]
lea rcx, [rax + 0x10]
mov qword [0x18005c118], rcx
jmp 0x180028d86
mov dword [rdi], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r9, rdi
mov r8, rsi
mov rdx, rbx
call fcn.1800368f0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18003e990
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1800377b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
mov dword [rdx], 0xf43c5a33
mov dword [rdx + 4], 0xccf8c93a
mov dword [rdx + 8], 0x8d8da27d
mov dword [rdx + 0xc], 0x254d2ce4
mov dword [rdx + 0x10], 0x177d2030
mov dword [rdx + 0x14], 0x522e6d2b
mov dword [rdx + 0x18], 0x919fc470
mov dword [rdx + 0x1c], 0x89a78ff7
mov dword [rdx + 0x20], 0x88758064
mov dword [rdx + 0x24], 0xe9a4070a
mov dword [rdx + 0x28], 0x474e411a
mov dword [rdx + 0x2c], 0xe47946e
mov dword [rdx + 0x30], 0x8a6daa1d
mov dword [rdx + 0x34], 0xefd0b65
mov dword [rdx + 0x38], 0xec832822
mov dword [rdx + 0x3c], 0xf3c4f737
mov dword [rdx + 0x40], 0xa6eb5376
mov dword [rdx + 0x44], 0x3b52fe3
mov dword [rdx + 0x48], 0x64d8864
mov ecx, 0x8cb0
mov r8d, 0x9bbd4a7a
mov word [rdx + 0x4c], cx
mov edx, 0x27
mov rcx, rax
jmp fcn.180002ce0

Function at 0x18003b9d0
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov rcx, rdx
mov dword [rdx], 0xed62e7d8
mov dword [rdx + 4], 0xde534356
mov dword [rdx + 8], 0xfb5a4fa4
mov dword [rdx + 0xc], 0xdacd5861
mov dword [rdx + 0x10], 0xe7d75bef
mov dword [rdx + 0x14], 0xe1765932
mov dword [rdx + 0x18], 0xd0cb4e79
mov dword [rdx + 0x1c], 0x57c7604e
mov dword [rdx + 0x20], 0x6d5dd6f9
mov dword [rdx + 0x24], 0x7ffcf674
mov dword [rdx + 0x28], 0xdef76a6e
mov dword [rdx + 0x2c], 0x7445670e
mov dword [rdx + 0x30], 0xfae44b6e
mov dword [rdx + 0x34], 0x65c2d3ca
mov dword [rdx + 0x38], 0x534841ce
mov dword [rdx + 0x3c], 0xe27c6ade
mov dword [rdx + 0x40], 0xc3d4dbef
mov dword [rdx + 0x44], 0x656cd577
mov dword [rdx + 0x48], 0x517e5c63
mov dword [rdx + 0x4c], 0xc27fead6
mov word [rdx + 0x50], 0xa04b
mov r8d, 0x6999ad0a
mov edx, 0x52
jmp fcn.180002d20

Function at 0x18003ba80
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov rcx, rdx
mov dword [rdx], 0xff56c958
mov dword [rdx + 4], 0x5cfdc74e
mov dword [rdx + 8], 0x57fe4520
mov dword [rdx + 0xc], 0x6657d041
mov dword [rdx + 0x10], 0x67c14ddd
mov dword [rdx + 0x14], 0xc142cc10
mov dword [rdx + 0x18], 0xc5eae9d9
mov dword [rdx + 0x1c], 0x5fe8415e
mov dword [rdx + 0x20], 0x62574cff
mov dword [rdx + 0x24], 0x54db4af3
mov dword [rdx + 0x28], 0xc3797569
mov dword [rdx + 0x2c], 0x76f3f0e7
mov dword [rdx + 0x30], 0x885e50e1
mov dword [rdx + 0x34], 0x5f48e442
mov dword [rdx + 0x38], 0xfe6d4bee
mov dword [rdx + 0x3c], 0x49ec41dd
mov dword [rdx + 0x40], 0x50e1dad3
mov dword [rdx + 0x44], 0xffff68e1
mov dword [rdx + 0x48], 0xf5c845c6
mov word [rdx + 0x4c], 0xaac5
mov r8d, 0xe2792946
mov edx, 0x4e
jmp fcn.180002d20
Function at 0x18003bb20
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov rcx, rdx
mov dword [rdx], 0x6966fb5c
mov dword [rdx + 4], 0x42d74fea
mov dword [rdx + 8], 0x7fc64ba0
mov dword [rdx + 0xc], 0x56415ce5
mov dword [rdx + 0x10], 0xdbdb57e3
mov dword [rdx + 0x14], 0x657255b6
mov dword [rdx + 0x18], 0x6ccf427d
mov dword [rdx + 0x1c], 0xd34364ca
mov dword [rdx + 0x20], 0x5159d2fd
mov dword [rdx + 0x24], 0xe3f84a78
mov dword [rdx + 0x28], 0x5a6b6e52
mov dword [rdx + 0x2c], 0xf0f963b2
mov dword [rdx + 0x30], 0x7ee04f62
mov dword [rdx + 0x34], 0xe1c6cf46
mov dword [rdx + 0x38], 0xda4445c2
mov dword [rdx + 0x3c], 0x615350c1
mov dword [rdx + 0x40], 0x6be7c6d3
mov dword [rdx + 0x44], 0x52f1c0f8
mov dword [rdx + 0x48], 0xc9f641d2
mov byte [rdx + 0x4c], 0xb4
mov r8d, 0x7615ad0a
mov edx, 0x4d
jmp fcn.180002d20

Function at 0x18003bbc0
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov rcx, rdx
mov dword [rdx], 0xed6267d8
mov dword [rdx + 4], 0x5ed3c356
mov dword [rdx + 8], 0xfbda4f24
mov dword [rdx + 0xc], 0x5a4dd861
mov dword [rdx + 0x10], 0x67d75b6f
mov dword [rdx + 0x14], 0x6176d932
mov dword [rdx + 0x18], 0xd0cb4ef9
mov dword [rdx + 0x1c], 0x5747604e
mov dword [rdx + 0x20], 0xed5dd679
mov dword [rdx + 0x24], 0x7ffc76f4
mov dword [rdx + 0x28], 0xde776aee
mov dword [rdx + 0x2c], 0x74c5e70e
mov dword [rdx + 0x30], 0x7ae4cbee
mov dword [rdx + 0x34], 0x65c2d3ca
mov dword [rdx + 0x38], 0x5448c14e
mov dword [rdx + 0x3c], 0x42576940
mov dword [rdx + 0x40], 0xd2e95b65
mov dword [rdx + 0x44], 0xf6f6737f
mov dword [rdx + 0x48], 0x5bfc5c4f
mov word [rdx + 0x4c], 0xe74a
mov r8d, 0xe559ad0a
mov byte [rdx + 0x4e], 0x90
mov edx, 0x4f
jmp fcn.180002d20

Function at 0x18003bc70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rcx, rdx
mov dword [rdx], 0xd97cf7f2
mov dword [rdx + 4], 0xe6657df8
mov dword [rdx + 8], 0xe3e8eda2
mov dword [rdx + 0xc], 0xd47b467d
mov dword [rdx + 0x10], 0x73dd6353
mov dword [rdx + 0x14], 0xed484dac
mov dword [rdx + 0x18], 0xdad7ecdd
mov dword [rdx + 0x1c], 0xd3f7ce74
mov dword [rdx + 0x20], 0xe5517cc9
mov dword [rdx + 0x24], 0xc5e2f8ea
mov dword [rdx + 0x28], 0xfefdc264
mov dword [rdx + 0x2c], 0x7c73759c
mov dword [rdx + 0x30], 0xe4e6e36e
mov dword [rdx + 0x34], 0x47cdcdd3
mov dword [rdx + 0x38], 0xf859d4d7
mov dword [rdx + 0x3c], 0x406c7b68
mov dword [rdx + 0x40], 0x6fe17a55
mov dword [rdx + 0x44], 0x78f577c5
mov word [rdx + 0x48], 0xe143
mov r8d, 0x82e117f6
mov byte [rdx + 0x4a], 0xb8
mov edx, 0x4b
jmp fcn.180002d20
Function at 0x18003d848
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx]
mov rbx, rcx
test r8, r8
je 0x18003d8ae
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x18003d89f
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18003d895
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x18003d869
mov r8, qword [rbx]
mov rcx, qword [0x180059c08]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18003d8c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x38]
imul rbx, rax, 0x38
mov r8d, 0x40
add rbx, qword [0x18005c2d0]
mov rdx, qword [rbx]
mov al, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rbp, [rdx - 5]
cmove rbp, rdx
lea rdi, [rdx - 5]
test al, al
lea rsi, [rcx*2 + 5]
cmove rdi, rdx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18003d92b
mov eax, 0xa
jmp 0x18003d978
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18003d947
mov rax, qword [rbx]
mov word [rax], 0xf9eb
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [rbx + 0x20], 6
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x18003dc78
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x18003dc8f
cmp r8b, 0x90
je 0x18003dc8f
cmp r8b, 0xcc
jne 0x18003dcb1
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x18003dcad
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x18003dcb1
add edx, r10d
cmp edx, r9d
jb 0x18003dc9d
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x18003e030
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x18003e07a
lea rax, [rdi - 0x40000000]
cmp rsi, rax
cmovb rsi, rax
mov rbx, qword [0x18005c2c8]
lea r15, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r15
cmovbe r15, qword [rbp - 0x50]
sub r15, 0xfff
test rbx, rbx
je 0x18003e0b7
cmp rbx, rsi
jb 0x18003e0b2
cmp rbx, r15
jae 0x18003e0b2
cmp qword [rbx + 8], 0
jne 0x18003e213
mov rbx, qword [rbx]
jmp 0x18003e098
mov r14, rdi
cmp rdi, rsi
jb 0x18003e13b
mov r12d, dword [rbp - 0x38]
xor edx, edx
mov rax, r14
div r12
sub r14, rdx
sub r14, r12
cmp r14, rsi
jb 0x18003e132
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18003e132
cmp dword [rbp - 0x10], 0x10000
je 0x18003e102
mov r14, qword [rbp - 0x28]
cmp r14, r12
jb 0x18003e132
jmp 0x18003e0ce
test r14, r14
je 0x18003e132
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18003e1d3
cmp r14, rsi
jae 0x18003e0bf
test rbx, rbx
jne 0x18003e1d3
cmp rdi, r15
ja 0x18003e213
mov r14d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov esi, r14d
div r14
mov eax, r14d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18003e213
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18003e213
cmp dword [rbp - 0x10], 0x10000
je 0x18003e1a9
xor edx, edx
lea edi, [r14 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div rsi
sub rdi, rdx
cmp rdi, r15
jmp 0x18003e162
test rdi, rdi
je 0x18003e213
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jmp 0x18003e135
and qword [rbx + 8], 0
lea rcx, [rbx + 0x40]
and dword [rbx + 0x10], 0
mov rdx, rcx
sub rdx, rbx
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x18003e1e6
mov rax, qword [0x18005c2c8]
mov qword [rbx], rax
mov qword [0x18005c2c8], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180005dc1
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.180165853
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
call fcn.1801ba42f
jmp fcn.1801c7841

Function at 0x18002a710
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x18002a808
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18002a877
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18002a877
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18002a877
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18002a877
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18002a877
cmp dword [rcx + 0x84], 0xe
jbe 0x18002a877
cmp dword [rcx + 0xf8], 0
je 0x18002a877
mov ecx, ebx
call fcn.18002a740
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.18002a99c
nop
cmp dword [rbp + 0x20], 0
je 0x18002a8c5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18002a7d4
int3

Function at 0x18002a808
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x18002a808
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18002a877
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18002a877
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18002a877
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18002a877
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18002a877
cmp dword [rcx + 0x84], 0xe
jbe 0x18002a877
cmp dword [rcx + 0xf8], 0
je 0x18002a877
mov ecx, ebx
call fcn.18002a740
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.18002a99c
nop
cmp dword [rbp + 0x20], 0
je 0x18002a8c5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18002a7d4
int3

Function at 0x18002bd90
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18002bdb8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18002bdb8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18003197c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800319ac
xor eax, eax
jmp 0x180031a6f
mov rbp, rbx
cmp word [rax], si
je 0x1800319d1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800319b8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800319b4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18003189c
movsxd r14, eax
test eax, eax
jne 0x180031a0f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800319a5
mov rcx, r14
call fcn.18002ed14
mov rdi, rax
test rax, rax
jne 0x180031a28
xor ecx, ecx
call fcn.18002dd18
jmp 0x180031a04
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18003189c
test eax, eax
jne 0x180031a59
mov rcx, rdi
call fcn.18002dd18
jmp 0x180031a63
xor ecx, ecx
call fcn.18002dd18
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1800359f8
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x180035a0e
mov al, 1
jmp 0x180035a6e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x180035a1f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180035a6c
mov ecx, dword [rcx + 0x18]
nop
call fcn.1800323ac
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180035a6c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180035a6c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180035a6c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x180035a6e
xor al, al
add rsp, 0x20
pop rbx
ret