joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ae890
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x1800ae8b1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1800ae8de
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1800ae8e0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1800ae939
test ecx, ecx
jle 0x1800ae919
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1800ae939
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1800ae939
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x1800ae960
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1800ae982
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1800ae991
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1800ae9b4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800ae9b6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800ae9f2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1800aea8e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1800aea2d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1800aea6e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1800aea8e
cmp rbx, rax
ja 0x1800aea40
test rbx, rbx
je 0x1800aea8e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1800aeeb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180101040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1800aeedd
xor eax, eax
jmp 0x1800af049
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1800aef17
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1800aef17
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1800af049
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1800af03c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800aef5a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1800aef85
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800af041
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800aeff4
sub eax, 1
je 0x1800aeff4
cmp eax, 2
jne 0x1800af03c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800af041
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1800af022
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1800af03c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1800af041
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800c6fb0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1800af400
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180101040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1800af4d3
cmp byte [rcx + 0x71], 0
je 0x1800af4d3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1800af4cf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800af494
sub eax, 1
je 0x1800af498
cmp eax, 2
jne 0x1800af4cf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800c6fb0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1800af4c6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1800af4cf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1800af47c
xor al, al
jmp 0x1800af47c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800c6fb0
add rsp, 0x60
pop rbx
ret
Function at 0x1800ba380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, eax
and r10d, 7
je 0x1800ba3b1
cmp eax, r10d
jge 0x1800ba39f
call fcn.1800b9b60
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov dword [rbx + 0x14], eax
mov eax, dword [rbx + 0x10]
xor r8d, r8d
mov r9d, eax
test eax, eax
jle 0x1800ba3f2
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r10d, cl
nop word [rax + rax]
shr ecx, 8
lea eax, [r9 - 8]
mov byte [rdx], r10b
lea rdx, [rdx + 1]
inc r8d
mov dword [rbx + 0x14], ecx
mov r9d, eax
movzx r10d, cl
test eax, eax
jg 0x1800ba3d0
mov dword [rbx + 0x10], eax
jns 0x1800ba41f
mov edx, dword [0x1801c50e8]
mov rax, qword gs:[0x58]
mov ecx, 0x28
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x1800ba452
mov r8, qword [rbx + 8]
nop dword [rax]
mov rax, qword [rbx]
cmp rax, r8
jb 0x1800ba43c
xor dl, dl
jmp 0x1800ba445
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1800ba430
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x1800ba3f4
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x1800ba4c7
mov edx, dword [0x1801c50e8]
mov rax, qword gs:[0x58]
mov ecx, 0x28
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x1800ba4e1
mov rcx, rbx
call fcn.1800b9ca0
test eax, eax
je 0x1800ba4ba
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1800c43e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
lea rdx, str.Build_20240317___f5c3a08
lea rcx, [0x1801bd248]
call fcn.180076190
call fcn.1800b1eb0
call fcn.180045ca0
call fcn.1800c53e0
call fcn.1800b14a0
call fcn.1800b01c0
call fcn.1800c4560
cmp dword [0x1801bd154], 7
je 0x1800c4427
call fcn.1800c42e0
jmp 0x1800c4446
xor eax, eax
lea r8, [0x1800c3f60]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.180051cf0
mov rcx, rax
call fcn.180051d50
mov byte [0x1801c64c4], 1
call fcn.18006fe70
mov rcx, rax
call fcn.18006ff10
call fcn.180060330
lea rdx, str.Press_INSERT_to_open_Gui
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.1800405f0
mov r8d, 3
mov rdx, rax
mov rcx, rbx
call fcn.180060430
cmp byte [0x1801c64c4], 0
je 0x1800c4551
mov dword [rsp + 0x60], 1
cmp dword [0x1801bd154], 7
jne 0x1800c4510
call fcn.1800c60e0
test al, al
jne 0x1800c4510
call fcn.1800c60b0
mov rbx, rax
call fcn.1800c6090
mov edx, dword [rax]
cmp edx, dword [0x1801c5d4c]
jne 0x1800c44e1
cmp byte [0x1801c55d0], 0
sete cl
mov byte [0x1801c55d0], cl
jmp 0x1800c44e8
movzx ecx, byte [0x1801c55d0]
cmp edx, 0x1b
jne 0x1800c44f8
test cl, cl
je 0x1800c44f8
mov byte [0x1801c55d0], 0
call fcn.180095780
mov edx, dword [rbx]
mov rcx, rax
call fcn.180095910
call fcn.1800c60e0
test al, al
je 0x1800c44b8
call fcn.18004b770
lea rcx, [rsp + 0x68]
mov r8, rax
call fcn.1800b2b80
mov rdx, rax
mov rcx, r8
call fcn.1800c60f0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.180079640
mov rcx, rax
call fcn.180079650
cmp byte [0x1801c64c4], 0
jne 0x1800c44a6
mov rcx, qword [0x1801c64d0]
call fcn.1800c67c0
int3
Function at 0x1800c67e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x1800c6833
mov qword [0x1801c64d0], rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x1800c67b0]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800c6828
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret
test edx, edx
jne 0x1800c6828
call fcn.1800c67c0
int3

Function at 0x1800c82d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.1800c8520
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800c83ea
mov rax, qword [0x180101090]
cmp qword [rsp + 0x20], rax
jb 0x1800c8334
mov rax, qword [0x180101098]
cmp qword [rsp + 0x20], rax
ja 0x1800c8334
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800c82f6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x1800c8365
jmp 0x1800c83ea
cmp dword [rsp + 0x50], 0x10000
jne 0x1800c83cd
cmp qword [rsp + 0x48], 0x10000
jb 0x1800c83cd
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800c83ab
mov rax, qword [rsp + 0x28]
jmp 0x1800c83ec
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1800c83bb
xor eax, eax
jmp 0x1800c83ec
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800c83e5
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.1800c8520
mov qword [rsp + 0x20], rax
jmp 0x1800c82f6
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800c8400
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800c8560
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x1800c8516
mov rax, qword [0x180101090]
cmp qword [rsp + 0x20], rax
jb 0x1800c845b
mov rax, qword [0x180101098]
cmp qword [rsp + 0x20], rax
ja 0x1800c845b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800c841d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x1800c848c
jmp 0x1800c8516
cmp dword [rsp + 0x50], 0x10000
jne 0x1800c84f4
cmp qword [rsp + 0x48], 0x10000
jb 0x1800c84f4
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800c84d2
mov rax, qword [rsp + 0x28]
jmp 0x1800c8518
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1800c84e2
xor eax, eax
jmp 0x1800c8518
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800c8511
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800c8560
mov qword [rsp + 0x20], rax
jmp 0x1800c841d
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800c85b0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800c8b40
mov qword [rsp + 0x28], 0
cmp qword [0x1801c5108], 0
jne 0x1800c85f8
cmp qword [0x1801c5100], 0
je 0x1800c85f8
mov rax, qword [0x1801c5100]
mov qword [0x1801c5108], rax
cmp qword [0x1801c5108], 0
je 0x1800c869e
mov rax, qword [0x1801c5108]
cmp qword [rax + 0x10], 0
je 0x1800c869e
mov rax, qword [0x1801c5108]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800c869e
mov rax, qword [0x1801c5108]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800c869e
mov rax, qword [0x1801c5108]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x1800c8664
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x1800c866b
xor eax, eax
jmp 0x1800c8815
mov rax, qword [0x1801c5108]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x1800c8815
mov rax, qword [0x1801c5100]
mov qword [0x1801c5108], rax
jmp 0x1800c86c0
mov rax, qword [0x1801c5108]
mov rax, qword [rax + 8]
mov qword [0x1801c5108], rax
cmp qword [0x1801c5108], 0
je 0x1800c870d
cmp qword [0x1801c5108], 0
je 0x1800c870b
mov rax, qword [0x1801c5108]
cmp qword [rax + 0x10], 0
je 0x1800c870b
mov rax, qword [0x1801c5108]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800c870b
mov rax, qword [0x1801c5108]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800c870b
jmp 0x1800c863c
jmp 0x1800c86ae
mov rax, qword [rsp + 0x60]
and rax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800c8820
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1800c8813
mov rax, qword [rsp + 0x48]
mov qword [0x1801c5108], rax
mov rax, qword [0x1801c5108]
mov dword [rax], 0x52727464
mov rax, qword [0x1801c5108]
mov qword [rax + 0x10], 0
mov rax, qword [0x1801c5108]
mov rcx, qword [0x1801c5100]
mov qword [rax + 8], rcx
mov rax, qword [0x1801c5108]
mov qword [0x1801c5100], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1801c5108]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x1800c87c4
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x1800c87fe
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1800c87ba
mov rax, qword [0x1801c5108]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x1800c863c
xor eax, eax
add rsp, 0x58
ret
Function at 0x1800c9530
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800c9577
xor al, al
jmp 0x1800c9619
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x1800c95a1
xor al, al
jmp 0x1800c9619
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x1800c9611
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x1800c9611
mov al, 1
jmp 0x1800c9619
jmp 0x1800c9617
xor al, al
add rsp, 0x78
ret

Function at 0x1800c9920
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1801c5100]
mov qword [rsp + 0x28], rax
jmp 0x1800c9940
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800c996f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1800c996d
call sub.KERNEL32.dll_GetLastError
jmp 0x1800c9971
jmp 0x1800c9932
xor eax, eax
add rsp, 0x38
ret
Function at 0x1800ca030
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1801c5118], eax
je 0x1800ca05d
mov eax, 0x10dd
jmp 0x1800ca276
cmp dword [0x1801c511c], 0
je 0x1800ca071
mov eax, dword [0x1801c511c]
jmp 0x1800ca276
cmp qword [rsp + 0x78], 0
jne 0x1800ca083
mov eax, 0x57
jmp 0x1800ca276
cmp qword [rsp + 0x70], 0
jne 0x1800ca095
mov eax, 6
jmp 0x1800ca276
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x1800ca0c7
mov dword [rsp + 0x20], 6
mov eax, dword [rsp + 0x20]
mov dword [0x1801c511c], eax
mov rax, qword [rsp + 0x70]
mov qword [0x1801c5120], rax
mov eax, dword [rsp + 0x20]
jmp 0x1800ca276
mov ecx, 0x30
call fcn.1800c7724
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1800ca139
mov dword [rsp + 0x20], 8
mov eax, dword [rsp + 0x20]
mov dword [0x1801c511c], eax
cmp qword [rsp + 0x30], 0
je 0x1800ca124
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x50]
call fcn.1800c721c
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x70]
mov qword [0x1801c5120], rax
mov eax, dword [rsp + 0x20]
jmp 0x1800ca276
xor edx, edx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call fcn.1800ca000
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, qword [rsp + 0x78]
call fcn.1800ca000
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 0x3e]
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp dword [rsp + 0x24], 0
je 0x1800ca196
movsxd rax, dword [rsp + 0x24]
cmp rax, 0x1e
jbe 0x1800ca1b3
mov dword [rsp + 0x20], 9
cmp dword [0x1801c5110], 0
je 0x1800ca1ae
jmp 0x1800ca0fa
jmp 0x1800ca0f0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
cmp qword [rax + 0x50], rcx
je 0x1800ca1e0
mov dword [rsp + 0x20], 9
cmp dword [0x1801c5110], 0
je 0x1800ca1db
jmp 0x1800ca0fa
jmp 0x1800ca0f0
mov dword [rsp + 0x28], 0
movsxd rax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1800ca217
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x1800ca0f0
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 1
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x28]
mov dword [rax + 0x28], ecx
mov rax, qword [rsp + 0x30]
mov rcx, qword [0x1801c5130]
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov qword [0x1801c5130], rax
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800ca280
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1801c5118], eax
je 0x1800ca29b
mov eax, 0x10dd
jmp 0x1800ca3c0
mov rax, qword [0x1801c5130]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800ca345
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x1800ca310
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x1800ca310
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.1800c8c80
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.1800c721c
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x1800ca2a7
mov qword [0x1801c5130], 0
call fcn.1800c96e0
mov rax, qword [0x1801c5128]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800ca3a9
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x48]
call fcn.1800c721c
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x1800ca361
mov qword [0x1801c5128], 0
mov dword [0x1801c5118], 0
xor eax, eax
add rsp, 0x68
ret