joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009780
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x1400097b0
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1400097d8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400097da
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140009833
test ecx, ecx
jle 0x140009813
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140009833
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140009833
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
add byte [rax], al
add bh, bh
Function at 0x140009dc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14001b010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140009ded
xor eax, eax
jmp 0x140009f42
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140009e18
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140009e18
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140009f42
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140009f35
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140009e5b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140009e86
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140009f3a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140009ef5
sub eax, 1
je 0x140009ef5
cmp eax, 2
jne 0x140009f35
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140009f3a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140009f23
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140009f35
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140009f3a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000af90
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000a120
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14001b010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000a1f3
cmp byte [rcx + 0x71], 0
je 0x14000a1f3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000a1ef
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000a1b4
sub eax, 1
je 0x14000a1b8
cmp eax, 2
jne 0x14000a1ef
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000af90
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000a1e6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000a1ef
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000a19c
xor al, al
jmp 0x14000a19c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000af90
add rsp, 0x60
pop rbx
ret
Function at 0x1800786df
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18016db70
mov rax, rcx
neg rcx
test rax, 7
je 0x18016db8d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x18016dbe8
test al, 7
jne 0x18016db80
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x18016dba1
mov rdx, qword [rax - 8]
test dl, dl
je 0x18016dc12
test dh, dh
je 0x18016dc0c
shr rdx, 0x10
test dl, dl
je 0x18016dc06
test dh, dh
je 0x18016dc00
shr rdx, 0x10
test dl, dl
je 0x18016dbfa
test dh, dh
je 0x18016dbf4
shr edx, 0x10
test dl, dl
je 0x18016dbee
test dh, dh
jne 0x18016dba1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x18007890f
Capabilities:
Create thread
Set console window title

Disassembly:
jmp 0x180085f70
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rcx, [0x1801ba3b7]
call fcn.18007a255
nop
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
nop
mov eax, dword [rbp + 0x108]
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0
je 0x180086059
cmp dword [rbp + 0xd4], 1
je 0x180085fce
jmp 0x18008608c
call qword [sym.imp.KERNEL32.dll_AllocConsole]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_AttachConsole]
nop
lea rcx, [0x180173700]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
nop
mov ecx, 1
call fcn.18007a5ed
mov r8, rax
lea rdx, [0x180173734]
lea rcx, [0x180173738]
call fcn.18007792e
nop
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180079f8f]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x180086055
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
jmp 0x180086091
xor eax, eax
jmp 0x180086091
call fcn.18007796a
nop
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov ecx, 1
call fcn.18007a5ed
mov rcx, rax
call fcn.18007844b
nop
call qword [sym.imp.KERNEL32.dll_FreeConsole]
nop
mov eax, 1
jmp 0x180086091
mov eax, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x180078a18
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1800a2530
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1800a1eb0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800a256f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1801bb020]
jmp 0x1800a2579
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x180078b62
Capabilities:
Query environment variable

Disassembly:
jmp 0x1801381d0
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180138000
lea rcx, [rsp + 0x40]
call fcn.180138180
movzx eax, al
test eax, eax
jne 0x180138218
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.180138030
mov rax, qword [rsp + 0x70]
jmp 0x1801383e9
lea rcx, [rsp + 0x40]
call fcn.180138150
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1801380f0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.180138150
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1800795df
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1801382be
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.180138030
mov rax, qword [rsp + 0x80]
jmp 0x1801383e9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.180078919
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1800787ed
lea rcx, [rsp + 0x48]
call fcn.180078491
movzx eax, al
test eax, eax
jne 0x180138325
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1800777d0
lea rcx, [rsp + 0x40]
call fcn.180138030
mov rax, qword [rsp + 0x88]
jmp 0x1801383e9
lea rcx, [rsp + 0x48]
call fcn.180078e2d
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.180138150
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1800795df
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1801383bb
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1800777d0
lea rcx, [rsp + 0x40]
call fcn.180138030
mov rax, qword [rsp + 0xa0]
jmp 0x1801383e9
lea rcx, [rsp + 0x48]
call fcn.1800787c5
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1800777d0
lea rcx, [rsp + 0x40]
call fcn.180138030
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x180078b71
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1800a2460
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1800a1e30
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800a24a1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1801bb020]
jmp 0x1800a24a7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x180078bf3
Capabilities:
Get geographical location

Disassembly:
jmp 0x1801175a0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.180116440
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1801175fc
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call fcn.18007a732
jmp 0x18011761e
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.18007843c
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x180078c02
Capabilities:
Terminate process

Disassembly:
jmp 0x180088fc0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x180078ddd
Capabilities:
Print debug messages

Disassembly:
jmp 0x180156370
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1801a8280]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x180156399
jmp 0x18015641e
mov rcx, qword [rbp + 0x30]
call fcn.1800786df
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1801563b2
jmp 0x18015641e
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1801563cf
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18007791f
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 0
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.180077d16
test eax, eax
jne 0x18015641e
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1800788a1
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x180079765
Capabilities:
Terminate process

Disassembly:
jmp 0x180113360
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18011338e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.180079eae
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x180079f0d
Capabilities:
Print debug messages

Disassembly:
jmp 0x18012f190
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x180079fc6
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1800a25a0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1800a1ef0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800a25e9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1801bb020]
jmp 0x1800a25f8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret
Function at 0x180081f40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1c8]
mov rax, qword [0x1801a8280]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x1801ba164]
call fcn.18007a255
nop
mov eax, dword [rbp + 0x1a0]
imul rax, rax, 0x38
mov rcx, qword [0x1801ab630]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov qword [rbp + 0x48], 5
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180081fe3
mov rax, qword [rbp + 0x68]
sub rax, 5
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
add rax, 2
mov qword [rbp + 0x48], rax
lea r9, [rbp + 0x24]
mov r8d, 0x40
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180082009
mov eax, 0xa
jmp 0x18008213c
cmp dword [rbp + 0x1a8], 0
je 0x18008207d
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov byte [rax], 0xe9
mov rax, qword [rbp + 0x68]
add rax, 5
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x88]
mov dword [rcx + 1], eax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x18008207b
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov byte [rax], 0xeb
mov rax, qword [rbp + 0xa8]
mov byte [rax + 1], 0xf9
jmp 0x1800820c6
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1800820ab
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call fcn.1800788a6
nop
jmp 0x1800820c6
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call fcn.1800788a6
nop
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
nop
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 1
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 2
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x180173260]
call fcn.180079986
mov rax, rdi
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.1800788a1
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x1800822a0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [0x1801a8280]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x1801ba164]
call fcn.18007a255
nop
mov dword [rbp + 0x24], 0
xor edx, edx
mov ecx, 4
call fcn.180078833
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xffffffffffffffff
je 0x1800824dc
mov dword [rbp + 0x68], 0x1c
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call fcn.180078f04
test eax, eax
je 0x1800824d1
mov dword [rbp + 0x24], 1
mov eax, dword [rbp + 0x68]
cmp rax, 0x10
jb 0x180082462
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp + 0x74], eax
jne 0x180082462
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbp + 0x70], eax
je 0x180082462
mov rax, qword [rbp + 0x180]
cmp qword [rax], 0
jne 0x1800823ba
mov rax, qword [rbp + 0x180]
mov dword [rax + 8], 0x80
mov rax, qword [rbp + 0x180]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x1801a94e8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbp + 0x180]
mov qword [rcx], rax
mov rax, qword [rbp + 0x180]
cmp qword [rax], 0
jne 0x1800823b8
mov dword [rbp + 0x24], 0
jmp 0x18008247e
jmp 0x180082432
mov rax, qword [rbp + 0x180]
mov rcx, qword [rbp + 0x180]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x180082432
mov rax, qword [rbp + 0x180]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rbp + 0x180]
mov dword [rcx + 8], eax
mov rax, qword [rbp + 0x180]
mov eax, dword [rax + 8]
shl rax, 2
mov r9, rax
mov rax, qword [rbp + 0x180]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1801a94e8]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x180082424
mov dword [rbp + 0x24], 0
jmp 0x18008247e
mov rax, qword [rbp + 0x180]
mov rcx, qword [rbp + 8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x180]
mov eax, dword [rax + 0xc]
mov rcx, qword [rbp + 0x180]
mov rcx, qword [rcx]
mov edx, dword [rbp + 0x70]
mov dword [rcx + rax*4], edx
mov rax, qword [rbp + 0x180]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rbp + 0x180]
mov dword [rcx + 0xc], eax
mov dword [rbp + 0x68], 0x1c
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call fcn.1800775a0
test eax, eax
jne 0x18008232f
cmp dword [rbp + 0x24], 0
je 0x180082496
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x180082496
mov dword [rbp + 0x24], 0
cmp dword [rbp + 0x24], 0
jne 0x1800824d1
mov rax, qword [rbp + 0x180]
cmp qword [rax], 0
je 0x1800824d1
mov rax, qword [rbp + 0x180]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1801a94e8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rax, qword [rbp + 0x180]
mov qword [rax], 0
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x24]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1801731e0]
call fcn.180079986
mov eax, edi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.1800788a1
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x180082830
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x1801ba164]
call fcn.18007a255
nop
mov dword [rbp + 4], 0
mov rax, qword [rbp + 0x140]
mov qword [rax], 0
mov rax, qword [rbp + 0x140]
mov dword [rax + 8], 0
mov rax, qword [rbp + 0x140]
mov dword [rax + 0xc], 0
mov rcx, qword [rbp + 0x140]
call fcn.1800822a0
test eax, eax
jne 0x1800828a6
mov dword [rbp + 4], 9
jmp 0x18008292b
mov rax, qword [rbp + 0x140]
cmp qword [rax], 0
je 0x18008292b
mov dword [rbp + 0x24], 0
jmp 0x1800828c4
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
mov rax, qword [rbp + 0x140]
mov eax, dword [rax + 0xc]
cmp dword [rbp + 0x24], eax
jae 0x18008292b
mov eax, dword [rbp + 0x24]
mov rcx, qword [rbp + 0x140]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x180082929
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
nop
mov r8d, dword [rbp + 0x150]
mov edx, dword [rbp + 0x148]
mov rcx, qword [rbp + 0x48]
call fcn.1800836f0
nop
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x1800828bc
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x180083ae0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1801ba164]
call fcn.18007a255
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax], 0
je 0x180083b88
mov dword [rbp + 4], 0
jmp 0x180083b1e
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0xc]
cmp dword [rbp + 4], eax
jae 0x180083b6e
mov eax, dword [rbp + 4]
mov rcx, qword [rbp + 0x120]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x180083b6c
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x180083b16
mov rax, qword [rbp + 0x120]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1801a94e8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret