joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140113ab0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140113af2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140113b39
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140113b92
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140113b50
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140113bd3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14012ab7b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14012ab7c]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140113ba0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140113c2c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140113c66
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140113c6b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140113cb4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x140113cb4
dec r8
sub rdx, 1
jne 0x140113c9a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140115418
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140115462
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140115462
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140115462
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140115462
cmp dword [rcx + 0x84], 0xe
jbe 0x140115462
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140115464
xor al, al
add rsp, 0x28
ret

Function at 0x140e7e518
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140e7e522
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140e7e54b
pop rbp
sub rbp, 0x33
sub rbp, 0xe7e518
sub rsp, 0x20
jmp 0x140e7e56a
add al, 0
add byte [rax], al
fcom dword [rbx - 0x38b7747b]
rcr byte [rax], 0xe5
out 0, eax
mov rax, 0xe7e518
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff8fcadc36
xor byte [rax], dl
inc rax
dec rcx
jne 0x140e7e589
jmp 0x140e7e5a0
jle 0x140e7e561
fistp qword [rbp + 0x36360abf]
jle 0x140e7e562
idiv dword [rsi]
invalid
Function at 0x140001764
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1400017f5
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x1400017f5
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400017f5
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1400017d9
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1400017d3
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x1400017db
add rdx, 0x28
jmp 0x1400017b8
xor edx, edx
test rdx, rdx
jne 0x1400017e4
xor al, al
jmp 0x1400017fb
test dword [rdx + 0x24], 0x80000000
je 0x1400017f1
xor al, al
jmp 0x1400017fb
mov al, 1
jmp 0x1400017fb
xor al, al
jmp 0x1400017fb
add rsp, 0x18
ret

Function at 0x1400037c8
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14000359c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000359c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000359c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000359c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000359c
cmp dword [rcx + 0x84], 0xe
jbe 0x14000359c
cmp dword [rcx + 0xf8], esi
je 0x14000359c
mov ecx, r14d
call fcn.1400036e4
mov ecx, 2
call fcn.140005c34
nop
cmp byte [0x140015310], 0
jne 0x140003666
mov r15d, 1
mov eax, r15d
xchg dword [0x140015304], eax
test ebx, ebx
jne 0x14000360f
mov rdi, qword [section..data]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140015308]
cmp rcx, rax
je 0x140003606
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140001e68]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140015320]
jmp 0x14000361b
cmp ebx, r15d
jne 0x140003621
lea rcx, [0x140015338]
call fcn.140003cd8
nop
test ebx, ebx
jne 0x140003638
lea rdx, [0x14000b2a0]
lea rcx, [0x14000b280]
call fcn.14000345c
lea rdx, [0x14000b2b0]
lea rcx, [0x14000b2a8]
call fcn.14000345c
movzx eax, byte [0x140015310]
test esi, esi
cmove eax, r15d
mov byte [0x140015310], al
jmp 0x140003666
mov ecx, 2
call fcn.140005c88
test esi, esi
jne 0x14000367d
mov ecx, r14d
call fcn.140003698
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000352c
Function at 0x18008e889
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1800ab9a0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1802555c0]
call fcn.1800910cf
mov qword [rbp + 8], 0
jmp 0x1800ab9de
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x1800aba34
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1800ab9d3
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x18008f7b1
Capabilities:
Create thread

Disassembly:
jmp 0x1801a69a0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x1802568a1]
call fcn.1800910cf
cmp dword [rbp + 0xe8], 1
jne 0x1801a6a07
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0xe0]
lea r8, [0x1800904f4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18008fa2c
Capabilities:
Terminate process

Disassembly:
jmp 0x1801a4660
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1802568a1]
call fcn.1800910cf
mov cl, 1
call fcn.180091084
movzx eax, al
test eax, eax
je 0x1801a4697
lea rcx, str.__DEBUG___Il2Cpp_initialized_n
call fcn.18008f6a8
jmp 0x1801a46b6
lea rcx, str.__DEBUG___Il2Cpp_initialize_failed__quitting...
call fcn.18008f6a8
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x1802428b0], rax
mov rdx, qword [0x1802428b0]
lea rcx, str.__DEBUG___Base_Address:_0x_llX_n
call fcn.18008f6a8
lea rcx, str.GameAssembly.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x1802428b8], rax
mov rdx, qword [0x1802428b8]
lea rcx, str.__DEBUG___GameAssembly_Base_Address:_0x_llX_n
call fcn.18008f6a8
lea rcx, str.UnityPlayer.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x1802428c0], rax
mov rdx, qword [0x1802428c0]
lea rcx, str.__DEBUG___UnityPlayer_Base_Address:_0x_llX_n
call fcn.18008f6a8
lea rcx, str.___________________________________________________________n
call fcn.18008f6a8
lea rcx, [0x1801c6808]
call fcn.18008f6a8
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18008facc
Capabilities:
Terminate process

Disassembly:
jmp 0x1801aa5a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x180090062
Capabilities:
Read file on windows

Disassembly:
jmp 0x1800d47e0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x180256174]
call fcn.1800910cf
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x18009007b
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1800d4e00
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x180256174]
call fcn.1800910cf
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1801bc8e0]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1800d4f45
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1800d4e99
mov dword [rbp + 0x160], 1
jmp 0x1800d4ea3
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1800d4f40
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1800d4f1a
cmp qword [rbp + 0x198], 2
jb 0x1800d4f1a
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800d4f1a
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800d4f1a
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1800d4e64
jmp 0x1800d4fdf
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1800d4fdf
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1800d4fb6
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800d4fb6
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1800d4fb6
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1800d4f45
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x180090512
Capabilities:
Create thread
Execute command

Disassembly:
jmp 0x1801a45b0
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x1802568a1]
call fcn.1800910cf
call fcn.18008e992
lea rcx, [0x1801f018c]
call qword [sym.imp.ucrtbased.dll_system]
call fcn.18008fa2c
call fcn.180091296
lea r8, [0x180090616]
lea rdx, [0x180242918]
mov cx, 8
call fcn.18009134a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x18008edf2]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x180090d05
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1800d4ce0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x180256174]
call fcn.1800910cf
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1801bc8e0]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1800d4d5f
mov dword [rbp + 0x120], 1
jmp 0x1800d4d69
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1800d4db2
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1800d4d2a
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x180193b70
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1c8]
mov rax, qword [0x18023b1c0]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x18025665b]
call fcn.1800910cf
mov eax, dword [rbp + 0x1a0]
imul rax, rax, 0x38
mov rcx, qword [0x180243700]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov qword [rbp + 0x48], 5
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180193c12
mov rax, qword [rbp + 0x68]
sub rax, 5
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
add rax, 2
mov qword [rbp + 0x48], rax
lea r9, [rbp + 0x24]
mov r8d, 0x40
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180193c38
mov eax, 0xa
jmp 0x180193d67
cmp dword [rbp + 0x1a8], 0
je 0x180193cac
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov byte [rax], 0xe9
mov rax, qword [rbp + 0x68]
add rax, 5
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x88]
mov dword [rcx + 1], eax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180193caa
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov byte [rax], 0xeb
mov rax, qword [rbp + 0xa8]
mov byte [rax + 1], 0xf9
jmp 0x180193cf3
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180193cd9
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call fcn.18008f752
jmp 0x180193cf3
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call fcn.18008f752
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 1
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 2
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1801ee100]
call fcn.180090873
mov rax, rdi
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.18008f743
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x180193ec0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x18023b1c0]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x18025665b]
call fcn.1800910cf
xor edx, edx
mov ecx, 4
call fcn.18008f6c1
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x18019408f
mov dword [rbp + 0x28], 0x1c
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call fcn.18008fdfb
test eax, eax
je 0x180194085
mov eax, dword [rbp + 0x28]
cmp rax, 0x10
jb 0x180194069
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp + 0x34], eax
jne 0x180194069
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbp + 0x30], eax
je 0x180194069
mov rax, qword [rbp + 0x160]
cmp qword [rax], 0
jne 0x180193fc4
mov rax, qword [rbp + 0x160]
mov dword [rax + 8], 0x80
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x1802428a0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbp + 0x160]
mov qword [rcx], rax
mov rax, qword [rbp + 0x160]
cmp qword [rax], 0
jne 0x180193fc2
jmp 0x180194085
jmp 0x180194039
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x160]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x180194039
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 8]
shl eax, 1
mov eax, eax
shl rax, 2
mov r9, rax
mov rax, qword [rbp + 0x160]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1802428a0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x180194015
jmp 0x180194085
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rbp + 0x160]
mov dword [rcx + 8], eax
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x68]
mov qword [rax], rcx
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0xc]
mov rcx, qword [rbp + 0x160]
mov rcx, qword [rcx]
mov edx, dword [rbp + 0x30]
mov dword [rcx + rax*4], edx
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rbp + 0x160]
mov dword [rcx + 0xc], eax
mov dword [rbp + 0x28], 0x1c
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call fcn.18008e55f
test eax, eax
jne 0x180193f40
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x20]
lea rdx, [0x1801ee080]
call fcn.180090873
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.18008f743
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x180001620
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180001870
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18000173a
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180001684
mov rax, qword [0x180009008]
cmp qword [rsp + 0x20], rax
ja 0x180001684
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180001646
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x1800016b5
jmp 0x18000173a
cmp dword [rsp + 0x50], 0x10000
jne 0x18000171d
cmp qword [rsp + 0x48], 0x10000
jb 0x18000171d
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800016fb
mov rax, qword [rsp + 0x28]
jmp 0x18000173c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x18000170b
xor eax, eax
jmp 0x18000173c
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180001735
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180001870
mov qword [rsp + 0x20], rax
jmp 0x180001646
xor eax, eax
add rsp, 0x68
ret

Function at 0x180001750
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800018b0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180001866
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800017ab
mov rax, qword [0x180009008]
cmp qword [rsp + 0x20], rax
ja 0x1800017ab
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18000176d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x1800017dc
jmp 0x180001866
cmp dword [rsp + 0x50], 0x10000
jne 0x180001844
cmp qword [rsp + 0x48], 0x10000
jb 0x180001844
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180001822
mov rax, qword [rsp + 0x28]
jmp 0x180001868
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x180001832
xor eax, eax
jmp 0x180001868
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180001861
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800018b0
mov qword [rsp + 0x20], rax
jmp 0x18000176d
xor eax, eax
add rsp, 0x68
ret