joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002640
Capabilities:
Get file version info

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rbx, rcx
xor ebp, ebp
mov qword [0x18002ac30], rbp
mov qword [0x18002ac38], rbp
mov dword [rsp + 0x70], ebp
cmp qword [rcx + 0x18], 8
jb 0x18000267a
mov rcx, qword [rcx]
lea rdx, [rsp + 0x70]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
je 0x180002737
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov edx, esi
lea rcx, [rsp + 0x28]
call fcn.1800027f0
cmp qword [rbx + 0x18], 8
jb 0x1800026b4
mov rbx, qword [rbx]
mov rdi, qword [rsp + 0x28]
mov r9, rdi
mov r8d, esi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov qword [rsp + 0x80], rbp
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x80]
lea rdx, [0x18001ffe8]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov r11, qword [rsp + 0x80]
test r11, r11
jne 0x1800026fe
jmp 0x18000272a
movzx eax, word [r11 + 0x12]
mov dword [0x18002ac30], eax
movzx eax, word [r11 + 0x10]
mov dword [0x18002ac34], eax
movzx eax, word [r11 + 0x16]
mov dword [0x18002ac38], eax
movzx eax, word [r11 + 0x14]
mov dword [0x18002ac3c], eax
test rdi, rdi
je 0x180002737
mov rcx, rdi
call fcn.18000c574
lea rax, [0x18002ac30]
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x180005120
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x18002991c]
test ecx, ecx
je 0x180005150
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180005150
mov rcx, rax
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, dword [0x18002991c]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x28
ret

Function at 0x180005160
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x18002991c]
test ecx, ecx
je 0x1800051aa
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180005190
mov rcx, rax
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, dword [0x18002991c]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [0x18002991c]
test ecx, ecx
je 0x1800051aa
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x18002991c], 0
add rsp, 0x28
ret

Function at 0x180005c70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x18002991c]
test ecx, ecx
je 0x180005cb5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x180005cb5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
lea rdx, [0x180005ab0]
lea ecx, [r8 + 0xc]
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ecx, dword [0x18002991c]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x28
ret
Function at 0x180005cc0
Capabilities:
Allocate thread local storage
Create thread
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.180002ea0
test al, al
je 0x180005d1b
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x18002991c], eax
test eax, eax
je 0x180005d39
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x180005d39
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
lea rdx, [0x180005ab0]
lea ecx, [r8 + 0xc]
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ecx, dword [0x18002991c]
mov rdx, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.180002f90
test al, al
jne 0x180005d39
mov r8, qword [0x180029900]
lea rcx, [0x180005110]
xor edx, edx
call fcn.18000d810
add rsp, 0x28
ret
Function at 0x180005e10
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180005e84
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x180005e9f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x180005e9f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x180005e9f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x180005eee
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180005e10
cmp byte [0x180029928], 0
jne 0x180005f39
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180005f29
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x180029928], 1
mov qword [0x180029920], rax
jmp 0x180005f40
mov rax, qword [0x180029920]
mov byte [0x180029928], 1
jmp 0x180005f40
mov rax, qword [0x180029920]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x180005f5f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x68
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm3
mov rdx, rax
lea rcx, [0x1800251b8]
call fcn.18000b864
movdqa xmm0, xmmword [rsp + 0x20]
movdqa xmm1, xmmword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
movdqa xmm3, xmmword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x88]
add rsp, 0x68
jmp 0x18000b644
jmp rax
lea rax, sym.imp.ADVAPI32.dll_RegDeleteKeyW
jmp 0x18000b5cd
Function at 0x180005ec0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180005e84
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x180005e9f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x180005e9f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x180005e9f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x180005eee
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180005e10
cmp byte [0x180029928], 0
jne 0x180005f39
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180005f29
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x180029928], 1
mov qword [0x180029920], rax
jmp 0x180005f40
mov rax, qword [0x180029920]
mov byte [0x180029928], 1
jmp 0x180005f40
mov rax, qword [0x180029920]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x180005f5f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x68
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm3
mov rdx, rax
lea rcx, [0x1800251b8]
call fcn.18000b864
movdqa xmm0, xmmword [rsp + 0x20]
movdqa xmm1, xmmword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
movdqa xmm3, xmmword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x88]
add rsp, 0x68
jmp 0x18000b644
jmp rax
lea rax, sym.imp.ADVAPI32.dll_RegDeleteKeyW
jmp 0x18000b5cd

Function at 0x180005f70
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret
Function at 0x180005fb0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x30
mov rsi, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
jne 0x180005fe3
lea eax, [r8 + 0xd]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
xor edi, edi
mov rbx, r8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rbx, [rbx + rax*2]
lea edi, [rdi + rax*2]
cmp eax, 1
jne 0x180005ff2
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x1800066d0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x180027d40]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
lea rcx, [rsp + 0x48]
or r9d, 0x2001f
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
call fcn.180003830
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x1800067ec
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1800067c1
nop dword [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1800066d0
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x1800067ec
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180006770
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800067d6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x50], ebp
call fcn.180005ec0
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x1800067f7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18000ccb0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800089c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x4b0], rbx
mov rax, qword [0x180027d40]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rsi, r9
mov rbx, r8
mov rax, rdx
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x70], r12
xor edx, edx
lea r8d, [r12 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180008a38
call fcn.180005de0
mov ebx, eax
jmp 0x180008b5d
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x180008a59
call fcn.180005de0
jmp 0x180008b51
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x180008a7c
call fcn.180005de0
jmp 0x180008b51
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x180008a9e
mov ebx, 0x8007000e
jmp 0x180008b53
mov ecx, eax
test eax, eax
je 0x180008adb
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x180008ad1
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x180008adb
lea rcx, [rsp + 0x70]
call fcn.180006670
mov rax, qword [rsp + 0x70]
jmp 0x180008ae5
mov ecx, 0x80070216
call fcn.180002320
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x180008afd
test rax, rax
jne 0x180008b09
mov ebx, 0x8007000e
jmp 0x180008b53
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180008b2e
call fcn.180005de0
jmp 0x180008b51
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r12w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1800087d0
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x180008b74
lea rcx, [rsp + 0x70]
call fcn.180006660
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18000ccb0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x1800095d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x180009603
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180009646
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x180009641
cmp rbx, r11
jae 0x180009646
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x180009630
cmp rbx, r11
jb 0x18000964a
xor eax, eax
jmp 0x180009656
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18000b590
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 8
call fcn.18000cad8
test rax, rax
je 0x18000b5ab
mov qword [rax], rbx
lea rcx, [0x18000b220]
mov r8, rax
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.18000d810

Function at 0x18000bc60
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x1800299f8]
test rcx, rcx
jne 0x18000bbb7
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x18000bbb0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18000bbe2
and qword [rax], 0
and qword [rax + 8], 0
xor eax, eax
lock cmpxchg qword [rbx + 0x40], rdi
je 0x18000bbac
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx + 0x40]
mov qword [0x1800299f8], rcx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x18000bc55
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18000bc05
xor edx, edx
lea r9, [rsp + 0x30]
mov ecx, 0xc0000017
lea r8d, [rdx + 1]
mov qword [rsp + 0x30], 0x20
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [rax]
mov rcx, qword [0x1800299f8]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x18000bc32
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x18000bc55
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x1800299f8]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x18000bc39
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jmp 0x18000bb3c
Function at 0x18000d810
Capabilities:
Create thread
Resume thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor ebx, ebx
mov rbp, r8
mov r12d, edx
mov rsi, rcx
test rcx, rcx
jne 0x18000d84e
call fcn.1800108e4
mov dword [rax], 0x16
call fcn.1800112f0
jmp 0x18000d8d5
call fcn.18000ec04
mov edx, 0x2c8
mov ecx, 1
call fcn.180010fec
mov rdi, rax
test rax, rax
je 0x18000d8c2
call fcn.18000ed74
mov rcx, rdi
mov rdx, qword [rax + 0xc0]
call fcn.18000ec38
lea r8, [0x18000d798]
mov rdx, r12
mov r9, rdi
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov qword [rdi + 0x90], rsi
mov qword [rdi + 0x98], rbp
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov qword [rdi + 8], rax
test rax, rax
jne 0x18000d8f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.18000d5bc
test ebx, ebx
je 0x18000d8d5
mov ecx, ebx
call fcn.180010924
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x18000d8ba
mov rax, rbx
jmp 0x18000d8d9

Function at 0x18000ea13
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180027d40]
jne 0x18000ccca
rol rcx, 0x10
test cx, 0xffff
jne 0x18000ccc6
repz ret
ror rcx, 0x10
jmp 0x18000e96c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180029c10]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180029d08]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18000e9f1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180029c10]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18000ea13
mov rax, qword [rsp + 0x88]
mov qword [0x180029d08], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180029ca8], rax
mov rax, qword [0x180029d08]
mov qword [0x180029b80], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180029c90], rax
mov dword [0x180029b70], 0xc0000409
mov dword [0x180029b74], 1
mov rax, qword [0x180027d40]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180027d48]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180029c08], eax
mov ecx, 1
call fcn.180013d44
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18001dbb8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180029c08], 0
jne 0x18000ea9a
mov ecx, 1
call fcn.180013d44
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1800140e8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x180027d40]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18000ebe8
xor ebx, ebx
cmp qword [0x18002ab98], rbx
mov rdi, rax
jne 0x1800141fb
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1800142d2
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800142d2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18002ab98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18002aba0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x18002aba8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x18002abb8], rax
test rax, rax
je 0x1800141f2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x18002abb0], rax
jmp 0x180014202
mov rax, qword [0x18002abb0]
jmp 0x180014209
mov rax, qword [0x18002abb0]
mov r11, qword [0x18002abb8]
cmp rax, rdi
je 0x180014270
cmp r11, rdi
je 0x180014270
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x18002abb8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180014270
test rax, rax
je 0x180014270
call rsi
test rax, rax
je 0x18001426a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18001426a
test byte [rsp + 0x40], 1
jne 0x180014270
bts ebp, 0x15
jmp 0x1800142b0
mov rcx, qword [0x18002aba0]
cmp rcx, rdi
je 0x1800142b0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800142b0
call rax
mov rbx, rax
test rax, rax
je 0x1800142b0
mov rcx, qword [0x18002aba8]
cmp rcx, rdi
je 0x1800142b0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800142b0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18002ab98]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800142d2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1800142d4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18000ccb0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret