joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400161b0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.140015330
mov ecx, dword [0x14002a0b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400162b0
lea r13, [rbx + 0x68]
mov rcx, r13
call fcn.140014b20
cmp esi, dword [rbx + 0x48]
jae 0x140016230
mov rdi, qword [rbx + 0x50]
mov qword [rdi + rsi*8], r12
mov rax, qword [rbx + 0x58]
mov rcx, r13
mov byte [rax + rsi], 1
call fcn.140014b60
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r15d, [rsi + 1]
mov rcx, qword [rbx + 0x50]
movsxd r14, r15d
lea rdx, [r14*8]
call sub.msvcrt.dll_realloc
mov rdi, rax
test rax, rax
je 0x1400162bd
mov rcx, qword [rbx + 0x58]
mov rdx, r14
call sub.msvcrt.dll_realloc
mov r14, rax
test rax, rax
je 0x1400162bd
mov eax, dword [rbx + 0x48]
mov edx, r15d
sub edx, eax
lea rcx, [rdi + rax*8]
lea r8, [rdx*8]
xor edx, edx
call sub.msvcrt.dll_memset
mov ecx, dword [rbx + 0x48]
mov r8d, r15d
xor edx, edx
mov rax, rcx
add rcx, r14
sub r8d, eax
call sub.msvcrt.dll_memset
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], r14
mov dword [rbx + 0x48], r15d
jmp 0x1400161ff
call fcn.1400153e0
mov rbx, rax
jmp 0x1400161ea
mov rcx, r13
call fcn.140014b60
mov eax, 0xc
jmp 0x14001621d

Function at 0x140016340
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.140015330
mov ecx, dword [0x14002a0b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140016368
mov rax, qword [rax + 0x30]
add rsp, 0x28
ret
call fcn.1400153e0
test rax, rax
jne 0x14001635a
add rsp, 0x28
ret

Function at 0x1400163d0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.140015330
mov ecx, dword [0x14002a0b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400163f8
add rax, 0x18
add rsp, 0x28
ret
call fcn.1400153e0
test rax, rax
jne 0x1400163ea
jmp 0x1400163ee

Function at 0x140016510
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140036c08]
test eax, eax
jne 0x140016528
xor eax, eax
add rsp, 0x28
ret
call fcn.140015330
mov ecx, dword [0x14002a0b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140016558
mov edx, dword [rax + 0x20]
test edx, edx
jg 0x14001651e
test byte [rax + 0x40], 3
je 0x14001651e
mov eax, dword [rax + 0x44]
and eax, 1
jmp 0x140016520
call fcn.1400153e0
test rax, rax
jne 0x14001653e
jmp 0x14001651e

Function at 0x140016570
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.140015330
mov ecx, dword [0x14002a0b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400165b0
test ebx, ebx
jle 0x1400165a0
lock add dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
lock sub dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
call fcn.1400153e0
test rax, rax
jne 0x14001658d
add rsp, 0x20
pop rbx
ret
Function at 0x1400166a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140015330
mov ecx, dword [0x14002a0b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140016718
test byte [rbx + 0x40], 0xc
jne 0x1400166cf
mov eax, dword [0x140036c08]
test eax, eax
jne 0x1400166e0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140014540
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140016703
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140016703
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x14001672c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140014810
call fcn.1400153e0
mov rbx, rax
test rax, rax
jne 0x1400166bf
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14001674a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140014810
call fcn.1400165c0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x1400167d0
call fcn.1400142d0
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140016808
call fcn.140015330
mov ecx, dword [0x14002a0b8]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140016860
test esi, esi
je 0x1400167e6
call fcn.1400166a0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140016840
mov edx, edi
call fcn.1400143a0
call fcn.1400166a0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140015330
mov ecx, dword [0x14002a0b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140016850
call fcn.1400166a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400166a0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140015330
mov ecx, dword [0x14002a0b8]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x1400167a5
call fcn.1400153e0
mov rbx, rax
jmp 0x1400167a5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400167be
call fcn.1400153e0
jmp 0x1400167e6
call fcn.1400153e0
mov rbx, rax
jmp 0x1400167a1
Function at 0x140016760
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140015330
mov ecx, dword [0x14002a0b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140016718
test byte [rbx + 0x40], 0xc
jne 0x1400166cf
mov eax, dword [0x140036c08]
test eax, eax
jne 0x1400166e0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140014540
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140016703
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140016703
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x14001672c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140014810
call fcn.1400153e0
mov rbx, rax
test rax, rax
jne 0x1400166bf
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14001674a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140014810
call fcn.1400165c0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x1400167d0
call fcn.1400142d0
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140016808
call fcn.140015330
mov ecx, dword [0x14002a0b8]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140016860
test esi, esi
je 0x1400167e6
call fcn.1400166a0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140016840
mov edx, edi
call fcn.1400143a0
call fcn.1400166a0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140015330
mov ecx, dword [0x14002a0b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140016850
call fcn.1400166a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400166a0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140015330
mov ecx, dword [0x14002a0b8]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x1400167a5
call fcn.1400153e0
mov rbx, rax
jmp 0x1400167a5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400167be
call fcn.1400153e0
jmp 0x1400167e6
call fcn.1400153e0
mov rbx, rax
jmp 0x1400167a1

Function at 0x140016870
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.140015330
mov ecx, dword [0x14002a0b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400168e0
test esi, esi
je 0x1400168c0
call fcn.1400166a0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400168f0
mov edx, esi
call fcn.1400143a0
call fcn.1400166a0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.1400166a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400166a0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.1400153e0
mov rbx, rax
jmp 0x140016891
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400168aa
Function at 0x1800068c0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x180096eb0], 0
mov qword [rsp + 0x20], rbx
jne 0x180006967
lea rcx, [0x18006ccc8]
mov byte [0x180096eb0], 1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x180006967
lea rdx, str.GetEnabledXStateFeatures
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InitializeContext
mov rcx, rbx
mov qword [0x180082e70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetXStateFeaturesMask
mov rcx, rbx
mov qword [0x180082e68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LocateXStateFeature
mov rcx, rbx
mov qword [0x180082e60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetXStateFeaturesMask
mov rcx, rbx
mov qword [0x180082e58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180082de8], rax
jmp 0x18000696e
mov rax, qword [0x180082de8]
cmp qword [0x180082e70], 0
mov rbx, qword [rsp + 0x20]
je 0x1800069a7
cmp qword [0x180082e68], 0
je 0x1800069a7
cmp qword [0x180082e60], 0
je 0x1800069a7
cmp qword [0x180082e58], 0
je 0x1800069a7
test rax, rax
je 0x1800069a7
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x1800069b0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
mov rcx, rbx
cmp word [rdi + rbx*2], 0x5c
je 0x1800069f6
test rcx, rcx
je 0x1800069f6
dec rcx
dec ebx
cmp word [rdi + rcx*2], 0x5c
jne 0x1800069e5
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.18004c900
mov rdx, rdi
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
test ebx, ebx
je 0x180006ad8
movsxd rax, ebx
mov qword [rsp + 0x468], rbp
mov qword [rsp + 0x470], rsi
lea rax, [rax*2 + 2]
cmp rax, 0x208
jae 0x180006af9
xor ebp, ebp
lea rcx, [rsp + 0x20]
mov word [rsp + rax + 0x20], bp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x208
movsxd rbx, eax
call fcn.18004c900
mov rsi, rbx
cmp rbx, 3
jle 0x180006ac8
mov ebx, 3
nop dword [rax]
lea rdi, [rbx + rbx]
cmp word [rsp + rdi + 0x20], 0x5c
jne 0x180006ac0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp rdi, 0x208
jae 0x180006af9
xor edx, edx
mov word [rsp + rdi + 0x230], bp
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
inc rbx
cmp rbx, rsi
jl 0x180006a80
mov rbp, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180049ad0
mov rbx, qword [rsp + 0x478]
add rsp, 0x450
pop rdi
ret
call fcn.180049f80
int3
Function at 0x180006e50
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x200
call fcn.18004c900
test rdi, rdi
je 0x180006fd0
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180006eed
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180006ee6
test byte [rsp + 0x40], 2
jne 0x180006ee6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x180006fd2
mov edx, 0x200
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x180006f63
lea rdx, [0x18006cce4]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rcx, [rsp + 0x50]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x180006f63
mov rcx, rax
call fcn.18000d5c0
mov al, 1
jmp 0x180006fd2
mov edx, 0x200
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x180006fd0
lea rdx, [0x18006cd04]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rcx, [rsp + 0x50]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x180006f57
nop dword [rax]
xor al, al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180049ad0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x180007830
Capabilities:
Get file size
Parse pe header

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, r9
mov rsi, r8
mov rdi, rdx
xor eax, eax
mov qword [rsp + 0x30], rax
cmp byte [rsp + 0x1b0], al
je 0x1800078d2
test rdx, rdx
jne 0x180007873
mov r8d, 0xffffffff
jmp 0x180007881
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8d, eax
mov ecx, 0x5a4d
cmp word [rbx], cx
jne 0x1800078c8
mov ecx, dword [rbx + 0x3c]
test eax, eax
je 0x1800078a5
cmp ecx, eax
jae 0x1800078c8
mov edx, ecx
add rcx, 0x18
mov eax, eax
cmp rcx, rax
jae 0x1800078c8
jmp 0x1800078a8
mov rdx, rcx
test r8d, r8d
je 0x1800078c8
mov eax, r8d
sub rax, 0x18
cmp rdx, rax
jae 0x1800078c8
cmp dword [rdx + rbx], 0x4550
sete al
jmp 0x180007957
jmp 0x180007955
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
mov r9d, 0x18
lea r8, [rsp + 0x38]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.PSAPI.DLL_GetModuleInformation]
nop
mov ecx, 0x5a4d
cmp word [rbx], cx
jne 0x180007953
mov eax, dword [rbx + 0x3c]
mov edx, dword [rsp + 0x40]
cmp eax, edx
jae 0x180007953
mov ecx, eax
add rax, 0x18
cmp rax, rdx
jae 0x180007953
lea rax, [rdx - 0x18]
cmp rcx, rax
jae 0x180007953
lea rdx, [rcx + rsi]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x108
lea r8, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180007953
cmp dword [rsp + 0x50], 0x4550
sete al
jmp 0x180007957
jmp 0x180007955
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x170
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800082b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rdx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180008378
movsxd rax, dword [r14 + 0x3c]
movzx ecx, word [rax + r14 + 0x18]
mov edx, 0x10b
cmp cx, dx
jne 0x1800082fe
mov esi, dword [rax + r14 + 0x78]
jmp 0x180008310
mov edx, 0x20b
cmp cx, dx
jne 0x180008372
mov esi, dword [rax + r14 + 0x88]
add rsi, r14
mov ebx, dword [rsi + 0x20]
add rbx, r14
mov qword [rsp + 0x28], rbx
mov edx, dword [rsi + 0x24]
mov ecx, dword [rsi + 0x1c]
mov r15d, edx
add r15, r14
mov r12d, ecx
add r12, r14
xor edi, edi
mov dword [rsp + 0x20], edi
cmp edi, dword [rsi + 0x18]
jge 0x18000836e
mov edx, dword [rbx]
add rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180008361
lea eax, [rdi + rdi]
movsxd rcx, eax
movzx eax, word [rcx + r15]
mov eax, dword [r12 + rax*4]
add rax, r14
jmp 0x180008378
add rbx, 4
mov qword [rsp + 0x28], rbx
inc edi
jmp 0x180008332
xor eax, eax
jmp 0x180008378
xor eax, eax
jmp 0x180008378
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
Function at 0x18000a7d0
Capabilities:
Hash data using crc32b

Disassembly:
xor r10d, r10d
lea r11, [0x180090b10]
nop word [rax + rax]
mov ecx, r10d
mov r8d, r10d
and ecx, 1
shr r8d, 1
shl ecx, 7
mov eax, r8d
mov edx, ecx
or edx, 0x40
and al, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
mov eax, r8d
or ecx, 0x20
and al, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
mov eax, r8d
or edx, 0x10
and al, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
mov eax, r8d
or ecx, 8
and al, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
mov eax, r8d
or edx, 4
and al, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
mov eax, r8d
or ecx, 2
and al, 1
cmove ecx, edx
mov eax, ecx
or eax, 1
and r8b, 2
cmove eax, ecx
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
xor r9d, r9d
lea r8d, [r9 + 0x1e]
nop
test al, 1
je 0x18000a8f2
lea ecx, [r8 + 1]
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
test al, 1
je 0x18000a905
mov ecx, r8d
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
sub r8d, 2
cmp r8d, 0xfffffffe
jg 0x18000a8e0
mov dword [r11], r9d
inc r10d
add r11, 4
cmp r10d, 0xff
jle 0x18000a7e0
ret

Function at 0x18000a930
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [0x180096eb2], 0
je 0x18000a971
movzx eax, byte [0x180096eb1]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x158
ret
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x110
call fcn.18004c900
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
mov byte [0x180096eb2], 1
setae al
mov byte [0x180096eb1], al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x158
ret
Function at 0x18000b3c0
Capabilities:
Enumerate process modules

Disassembly:
push rbx
push rdi
push r14
push r15
sub rsp, 0x258
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r15, r8
mov r14, rdx
mov rdi, rcx
test rcx, rcx
jne 0x18000b403
mov rdi, qword [0x180082d08]
test rdi, rdi
jne 0x18000b403
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
xor ebx, ebx
mov qword [rsp + 0x298], rbp
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
xor r8d, r8d
mov qword [rsp + 0x250], rsi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x18000b4d9
mov ecx, dword [rsp + 0x20]
shl rcx, 3
call fcn.180050474
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x18000b4d1
test dword [rsp + 0x20], 0xfffffff8
jbe 0x18000b4d1
nop dword [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.18004c900
mov rdx, qword [rsi + rbx*8]
lea r8, [rsp + 0x30]
mov r9d, 0x104
mov ebp, ebx
mov rcx, rdi
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x18000b4c4
mov edx, 0x5c
lea rcx, [rsp + 0x30]
call fcn.18004acc4
test rax, rax
je 0x18000b4c4
lea rcx, [rax + 2]
mov rdx, r14
call fcn.180050580
test eax, eax
je 0x18000b509
mov eax, dword [rsp + 0x20]
inc ebx
shr eax, 3
cmp ebx, eax
jb 0x18000b470
mov rcx, rsi
call fcn.18005047c
xor eax, eax
mov rsi, qword [rsp + 0x250]
mov rbp, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x258
pop r15
pop r14
pop rdi
pop rbx
ret
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x18000b4d1
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x18000b4d1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rsi + rbp*8]
sub rax, rbx
add rax, rdi
jmp 0x18000b4db
Function at 0x18000b5f0
Capabilities:
Enumerate process modules

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x18000b618
mov rdi, qword [0x180082d08]
test rdi, rdi
jne 0x18000b618
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
xor ebx, ebx
mov qword [rsp + 0x68], r14
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], ebx
xor r8d, r8d
mov qword [rsp + 0x70], r15
xor edx, edx
mov rcx, rdi
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x18000b6d6
mov ecx, dword [rsp + 0x60]
shl rcx, 3
call fcn.180050474
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rax
mov rcx, rdi
mov r15, rax
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x18000b6ce
test dword [rsp + 0x60], 0xfffffff8
jbe 0x18000b6ce
nop word [rax + rax]
mov rdx, qword [r15 + rbx*8]
lea r14, [r15 + rbx*8]
xor eax, eax
lea r8, [rsp + 0x20]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
mov rcx, rdi
movups xmmword [rsp + 0x20], xmm0
lea r9d, [rax + 0x18]
call qword [sym.imp.PSAPI.DLL_GetModuleInformation]
test eax, eax
je 0x18000b6c1
mov rcx, qword [r14]
cmp rsi, rcx
jb 0x18000b6c1
mov eax, dword [rsp + 0x28]
add rax, rcx
cmp rsi, rax
jb 0x18000b6ea
mov eax, dword [rsp + 0x60]
inc ebx
shr eax, 3
cmp ebx, eax
jb 0x18000b680
mov rcx, r15
call fcn.18005047c
xor eax, eax
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov rax, rcx
jmp 0x18000b6d8

Function at 0x18000b6f0
Capabilities:
Enumerate process modules

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r14, rdx
mov rdi, rcx
test rcx, rcx
jne 0x18000b72e
mov rdi, qword [0x180082d08]
test rdi, rdi
jne 0x18000b72e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
xor ebx, ebx
mov qword [rsp + 0x280], rbp
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
xor r8d, r8d
mov qword [rsp + 0x288], rsi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x18000b7fa
mov ecx, dword [rsp + 0x20]
shl rcx, 3
call fcn.180050474
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x18000b7f2
test dword [rsp + 0x20], 0xfffffff8
jbe 0x18000b7f2
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.18004c900
mov rdx, qword [rsi + rbx*8]
lea r8, [rsp + 0x30]
mov r9d, 0x104
mov rcx, rdi
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x18000b7e5
mov edx, 0x5c
lea rcx, [rsp + 0x30]
call fcn.18004acc4
test rax, rax
je 0x18000b7e5
lea rcx, [rax + 2]
mov rdx, r14
call fcn.180050580
test eax, eax
je 0x18000b828
mov eax, dword [rsp + 0x20]
inc ebx
shr eax, 3
cmp ebx, eax
jb 0x18000b793
mov rcx, rsi
call fcn.18005047c
xor eax, eax
mov rsi, qword [rsp + 0x288]
mov rbp, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x250
pop r14
pop rdi
pop rbx
ret
mov rax, qword [rsi + rbx*8]
jmp 0x18000b7fc