joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18007fce0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18007fd02
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x18007fd18
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18007fd34
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18007fd36
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18007fd72
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18007fe0e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18007fdad
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18007fdee
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18007fe0e
cmp rbx, rax
ja 0x18007fdc0
test rbx, rbx
je 0x18007fe0e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x180080240
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1802855b8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18008026d
xor eax, eax
jmp 0x1800803ca
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x180080298
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x180080298
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1800803ca
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1800803bd
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1800802db
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180080306
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800803c2
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180080375
sub eax, 1
je 0x180080375
cmp eax, 2
jne 0x1800803bd
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800803c2
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1800803a3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1800803bd
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1800803c2
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1801c77e0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180081440
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1802855b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180081513
cmp byte [rcx + 0x71], 0
je 0x180081513
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18008150f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800814d4
sub eax, 1
je 0x1800814d8
cmp eax, 2
jne 0x18008150f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801c77e0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180081506
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18008150f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1800814bc
xor al, al
jmp 0x1800814bc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801c77e0
add rsp, 0x60
pop rbx
ret

Function at 0x1800850e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r9, qword [r8 + 0x20]
mov rbx, r8
add r8, 0x10
mov r14, rdx
cmp qword [rbx + 0x28], 0x10
jb 0x18008510e
mov r8, qword [rbx + 0x10]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test r9, r9
je 0x180085144
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, r10
cmp rcx, r9
jb 0x180085130
and rdx, qword [0x180289ea0]
shl rdx, 4
add rdx, qword [0x180289e88]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x18008517e
cmp rax, rbx
jne 0x180085174
mov rax, qword [0x180289e78]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x180085189
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x180085189
cmp rax, rbx
jne 0x180085189
mov rax, qword [rbx]
mov qword [rdx], rax
mov rsi, qword [rbx]
lea rcx, [rbx + 0x30]
dec qword [0x180289e80]
mov rax, qword [rbx + 8]
mov qword [rax], rsi
mov rax, qword [rbx + 8]
mov qword [rsi + 8], rax
call fcn.18007bfc0
mov rdx, qword [rbx + 0x28]
cmp rdx, 0x10
jb 0x1800851e2
mov rcx, qword [rbx + 0x10]
inc rdx
cmp rdx, 0x1000
jb 0x1800851dd
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18008521f
mov rcx, r8
call fcn.1801c7800
mov edx, 0xc0
mov qword [rbx + 0x20], 0
mov rcx, rbx
mov qword [rbx + 0x28], recv
mov byte [rbx + 0x10], 0
call fcn.1801c7800
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x48]
mov qword [r14], rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x18009d7e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x440
mov rax, qword [0x1802855b8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rdi, rdx
mov r14, rcx
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
lea rbx, [rbx + 1]
cmp byte [rdx + rbx], 0
jne 0x18009d820
mov esi, 1
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea eax, [rbx - 2]
cmp eax, 0x3fe
ja 0x18009d949
xor eax, eax
movzx r10d, byte [rdi]
inc rdi
test r10b, r10b
je 0x18009d906
mov r9d, eax
and r9d, 1
lea r8d, [r10 - 0x30]
cmp r8b, 9
ja 0x18009d89c
mov ecx, eax
test eax, eax
jns 0x18009d87b
lea ecx, [rax + 1]
sar ecx, 1
movsxd rcx, ecx
lea rdx, [rsp + 0x30]
add rdx, rcx
xor r9d, 1
shl r9d, 2
movzx ecx, r9b
shl r8b, cl
add byte [rdx], r8b
jmp 0x18009d8e8
lea ecx, [r10 - 0x41]
cmp cl, 5
ja 0x18009d8b4
mov ecx, eax
test eax, eax
jns 0x18009d8ae
lea ecx, [rax + 1]
lea edx, [r10 - 0x37]
jmp 0x18009d8ca
lea ecx, [r10 - 0x61]
cmp cl, 5
ja 0x18009d8ea
mov ecx, eax
test eax, eax
jns 0x18009d8c6
lea ecx, [rax + 1]
lea edx, [r10 - 0x57]
sar ecx, 1
movsxd rcx, ecx
lea r8, [rsp + 0x30]
xor r9d, 1
add r8, rcx
shl r9d, 2
movzx ecx, r9b
shl dl, cl
add byte [r8], dl
inc eax
lea ecx, [rsi + 1]
cmp r10b, 0x20
cmovne ecx, esi
mov esi, ecx
movzx r10d, byte [rdi]
inc rdi
test r10b, r10b
jne 0x18009d861
mov ebx, esi
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, esi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18009d947
mov r8d, ebx
lea rdx, [rsp + 0x30]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x20]
mov edx, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x18009d949
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1801c77e0
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x18009d980
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1802855b8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18009da0c
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18009da0c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18009d9fa
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, dword [rsp + 0x28]
cmp r8d, eax
je 0x18009d9fa
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
je 0x18009d9fa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x18009d9c3
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801c77e0
add rsp, 0x50
pop rbx
ret
Function at 0x18009da20
Capabilities:
Enumerate threads
Resume thread

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1802855b8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18009daac
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18009daac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18009da9a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, dword [rsp + 0x28]
cmp r8d, eax
je 0x18009da9a
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
je 0x18009da9a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x18009da63
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801c77e0
add rsp, 0x50
pop rbx
ret
Function at 0x1800a09f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.1800a0c40
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800a0b0a
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800a0a54
mov rax, qword [0x180280008]
cmp qword [rsp + 0x20], rax
ja 0x1800a0a54
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800a0a16
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x1800a0a85
jmp 0x1800a0b0a
cmp dword [rsp + 0x50], 0x10000
jne 0x1800a0aed
cmp qword [rsp + 0x48], 0x10000
jb 0x1800a0aed
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800a0acb
mov rax, qword [rsp + 0x28]
jmp 0x1800a0b0c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1800a0adb
xor eax, eax
jmp 0x1800a0b0c
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800a0b05
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.1800a0c40
mov qword [rsp + 0x20], rax
jmp 0x1800a0a16
xor eax, eax
add rsp, 0x68
ret

Function at 0x1800a0b20
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800a0c80
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x1800a0c36
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800a0b7b
mov rax, qword [0x180280008]
cmp qword [rsp + 0x20], rax
ja 0x1800a0b7b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800a0b3d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x1800a0bac
jmp 0x1800a0c36
cmp dword [rsp + 0x50], 0x10000
jne 0x1800a0c14
cmp qword [rsp + 0x48], 0x10000
jb 0x1800a0c14
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800a0bf2
mov rax, qword [rsp + 0x28]
jmp 0x1800a0c38
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1800a0c02
xor eax, eax
jmp 0x1800a0c38
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800a0c31
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800a0c80
mov qword [rsp + 0x20], rax
jmp 0x1800a0b3d
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800a0cd0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800a1260
mov qword [rsp + 0x28], 0
cmp qword [0x180285eb8], 0
jne 0x1800a0d18
cmp qword [0x180285eb0], 0
je 0x1800a0d18
mov rax, qword [0x180285eb0]
mov qword [0x180285eb8], rax
cmp qword [0x180285eb8], 0
je 0x1800a0dbe
mov rax, qword [0x180285eb8]
cmp qword [rax + 0x10], 0
je 0x1800a0dbe
mov rax, qword [0x180285eb8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800a0dbe
mov rax, qword [0x180285eb8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800a0dbe
mov rax, qword [0x180285eb8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x1800a0d84
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x1800a0d8b
xor eax, eax
jmp 0x1800a0f35
mov rax, qword [0x180285eb8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x1800a0f35
mov rax, qword [0x180285eb0]
mov qword [0x180285eb8], rax
jmp 0x1800a0de0
mov rax, qword [0x180285eb8]
mov rax, qword [rax + 8]
mov qword [0x180285eb8], rax
cmp qword [0x180285eb8], 0
je 0x1800a0e2d
cmp qword [0x180285eb8], 0
je 0x1800a0e2b
mov rax, qword [0x180285eb8]
cmp qword [rax + 0x10], 0
je 0x1800a0e2b
mov rax, qword [0x180285eb8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800a0e2b
mov rax, qword [0x180285eb8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800a0e2b
jmp 0x1800a0d5c
jmp 0x1800a0dce
mov rax, qword [rsp + 0x60]
and rax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800a0f40
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1800a0f33
mov rax, qword [rsp + 0x48]
mov qword [0x180285eb8], rax
mov rax, qword [0x180285eb8]
mov dword [rax], 0x52727464
mov rax, qword [0x180285eb8]
mov qword [rax + 0x10], 0
mov rax, qword [0x180285eb8]
mov rcx, qword [0x180285eb0]
mov qword [rax + 8], rcx
mov rax, qword [0x180285eb8]
mov qword [0x180285eb0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x180285eb8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x1800a0ee4
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x1800a0f1e
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1800a0eda
mov rax, qword [0x180285eb8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x1800a0d5c
xor eax, eax
add rsp, 0x58
ret
Function at 0x1800a1c50
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800a1c97
xor al, al
jmp 0x1800a1d39
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x1800a1cc1
xor al, al
jmp 0x1800a1d39
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x1800a1d31
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x1800a1d31
mov al, 1
jmp 0x1800a1d39
jmp 0x1800a1d37
xor al, al
add rsp, 0x78
ret

Function at 0x1800a2040
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180285eb0]
mov qword [rsp + 0x28], rax
jmp 0x1800a2060
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800a208f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1800a208d
call sub.KERNEL32.dll_GetLastError
jmp 0x1800a2091
jmp 0x1800a2052
xor eax, eax
add rsp, 0x38
ret
Function at 0x1800a2750
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x180285ec8], eax
je 0x1800a276b
mov eax, 0x10dd
jmp 0x1800a2890
mov rax, qword [0x180285ee0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800a2815
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x1800a27e0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x1800a27e0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.1800a13a0
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.1801c7800
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x1800a2777
mov qword [0x180285ee0], 0
call fcn.1800a1e00
mov rax, qword [0x180285ed8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800a2879
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x48]
call fcn.1801c7800
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x1800a2831
mov qword [0x180285ed8], 0
mov dword [0x180285ec8], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800a2dc0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x180285ecc], 0
je 0x1800a2ddd
mov eax, dword [0x180285ecc]
jmp 0x1800a2ea3
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x1800a2df0
xor eax, eax
jmp 0x1800a2ea3
mov ecx, reloc.WS2_32.dll_recv
call fcn.1801c7834
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1800a2e5e
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x1800a2e43
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x38]
call fcn.1801c7800
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x180285ecc], eax
mov qword [0x180285ed0], 0
mov eax, dword [rsp + 0x20]
jmp 0x1800a2ea3
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1800a2e78
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x1800a2e19
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x180285ed8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x180285ed8], rax
xor eax, eax
add rsp, 0x48
ret